{ "Event": { "published": true, "date": "2024-02-28", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-28", "timestamp": 1709164981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "59c9b78b-6675-4beb-a44d-f6722ebdb626", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8542c9-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709128105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128105, "uuid": "d22d3a4a-ab09-4971-9c5e-53a7c48b3822", "comment": "Malware payload", "value": "6bb59137fb112f7970ffeca6f23365cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128105, "uuid": "35869dcf-4381-417f-868f-49e8e26bbd57", "comment": "Malware payload", "value": "026217c8f9f0c1871b66bc3f2f483326b995036bf5cc21da86223d16490f27bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128105, "uuid": "82e1e125-7889-4038-aedd-f7e03936f5a4", "comment": "Malware payload", "value": "c2d3ad4d1f5ec85453b4d9f92f660c4ec23779fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128105, "uuid": "799f4a0f-61fc-4132-b3d7-da29f90c523b", "comment": "Malware payload", "value": "f60ac48576f6c02297cc1bb4ef0a3ae2af2fe755acf66d411bed6d5b01b6851f705dcbd2a2f6f8a9ca09adb8be030239", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128105, "uuid": "b93e1302-6512-4f30-ae1e-ef318363a4a2", "value": "T19E34F1217BD0D832C09A223448B8D6F19E3ABC61D671408BF3D47B3E2FB6AD15678756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128105, "uuid": "0accec3f-1870-40e1-9535-f528a0b38607", "value": "fa9d771b11e0f02db434815b765f591e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128105, "uuid": "fac0f58b-c574-40c7-9c49-73049e77bf54", "value": "3072:sw7Q4Q0Xvbjsw9Nw6DNnsVid0HaaLnLHTfSKwqrYSKLoEZ4L4CM5e81:sUHQATAwVNWidUbAqzKLtwM5eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128105, "uuid": "414e3bd1-edd4-4f86-993a-49fc65d875ea", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128105, "uuid": "20738680-0086-4254-af47-585d5ba4e573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128105, "uuid": "2a939e4f-e8cf-41f8-b036-f3e9b66ff40f", "value": "6bb59137fb112f7970ffeca6f23365cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b9b696-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709128258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128258, "uuid": "b4ce5fd2-13f5-462a-a359-14aff81e212d", "comment": "Malware payload (AgentTesla)", "value": "852bc2cdc32032cdaffc6e416f575382", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128258, "uuid": "ccfc3227-176a-47aa-8396-e2aa36fbb7cd", "comment": "Malware payload (AgentTesla)", "value": "02a409733c223599defec67dad21f76ae46821bc83e4d9726ee203870dcc3105", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128258, "uuid": "a1db0dc1-1005-4aad-ac84-16af9fe864ee", "comment": "Malware payload (AgentTesla)", "value": "3a758f73fbc5bdbce2aaea3d53f3049106c4c1ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128258, "uuid": "cca4caf4-818b-417b-b6d1-4e45c3b16381", "comment": "Malware payload (AgentTesla)", "value": "d44396094092a7cd0d91e234bf2d17b82a3f189a21eb5cb8b965f3f27cb36144da3dd270549950425274e002fcbce17d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128258, "uuid": "caf7bdf4-acec-45a3-a4ab-335586a7f8f3", "value": "T14D25CF1373DD8361C3B25273BA65B741BEBF782506A1F86B2FD4093DE920122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128258, "uuid": "8f68b3af-6b40-4572-8643-930df9db0c84", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128258, "uuid": "33619ed3-27bd-4d77-8cbf-5333c33d2774", "value": "24576:rtb20pkaCqT5TBWgNQ7agocS0JK/+f9d6A:oVg5tQ7agXHUe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128258, "uuid": "b703e011-181e-44c7-a7ac-c2e0d6662969", "value": 1056256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128258, "uuid": "512fe87e-f7db-448f-aad9-c41b1a7e555f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128258, "uuid": "e5f25da1-7973-475b-9636-c15d5f4042ac", "value": "DE9U9088Y70_46677889999.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfcf032-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156855, "uuid": "3647ce5f-4886-4f46-be15-7beb651a7e03", "comment": "Malware payload (Mirai)", "value": "ceb50ac2b538cb675d758fa73f13eb1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156855, "uuid": "fd6473d7-3028-472e-b9d3-af47d58736a6", "comment": "Malware payload (Mirai)", "value": "08119d33def0cae3d39302486ef0782c368abb7296b0a94c2949cdd34ab1f012", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156855, "uuid": "302bda2f-d332-4226-82b8-7096a73aa9dd", "comment": "Malware payload (Mirai)", "value": "a4a7238f24ba300d426f6596478f8f1560e5e1cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156855, "uuid": "02439044-7110-4832-98a4-b84f3c855261", "comment": "Malware payload (Mirai)", "value": "c6a35530c5275b9c331c6a80cd7fd5f87992337df368e841346bf011be5a73b9feaf42220c61b274f8786babe6f95b6d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156855, "uuid": "762d777e-42b1-454a-8c7c-86a31304c559", "value": "T1EDD30946E7404B13C0D6177ABAEF42453323AB6493DB73069928AFF43F8679E4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156855, "uuid": "191cf742-d800-4939-bfa6-7e7683f76ec5", "value": "3072:3NQjr3B+3V/2a/FdvgfObSQcPoBP7Gb8b6M/9ZMLCNvV:3NQjr3S12a/Fdvg2bSsV7Gb8GM/92LC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156855, "uuid": "adadd951-e4a6-43d4-902f-fb8220f7fc08", "value": 137643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156855, "uuid": "d7ab1d76-88e4-4c8a-bcfa-404eab58e247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156855, "uuid": "a74921e7-a5eb-49cb-9e81-2fa56016d406", "value": "ceb50ac2b538cb675d758fa73f13eb1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9206c75c-d64f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709134773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134773, "uuid": "69ddd762-4244-4f1d-ac5c-b87eb5058de7", "comment": "Malware payload (RedLineStealer)", "value": "16e1d3054438b0bdb203936b79abaa17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134773, "uuid": "b77d8a57-3daa-49c4-bacd-e99c6343516f", "comment": "Malware payload (RedLineStealer)", "value": "09c7a8636ff0ffe35726c61b6f65cc7141ea469b86d995862ae032abe68eea57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134773, "uuid": "c9a0e42e-62da-4d6b-8265-28b1095d98b6", "comment": "Malware payload (RedLineStealer)", "value": "244484c1469af24d64765e483f65f758dc54cece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134773, "uuid": "88327ad3-87f2-44f0-a6d2-ae95593daf03", "comment": "Malware payload (RedLineStealer)", "value": "d7af9819d44a881075331f42f75cd84d57936d4d31bd18ddf65ed8db9b86bd6b8e49a681cb5f7ae7d817b7d7d180abd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134773, "uuid": "a6438e51-1c89-4597-a8ab-1cc0d8849fea", "value": "T1D9D4394FB519CD53C26F2672C0C947700F709E6E4DCAC616ABC6FFBA3A72351AA46106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134773, "uuid": "af73c623-bad6-46d5-b468-51129bbed685", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134773, "uuid": "6cd01d72-92ab-47e7-941a-b4a05708d8a9", "value": "12288:wvA42BXrQcTctlbkt28G6s2TSSbNrAng1c8hgx:cIQSGktY6XTSSbNrAng1cKgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709134773, "uuid": "c062a5c2-ce54-4bc1-86f9-98e80e44a1e9", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709134773, "uuid": "fb58c20b-d19c-4992-a95a-75edf8714202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134773, "uuid": "a8e62c02-72eb-4a54-bdf7-fed7ec86bf41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac874ba2-d659-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139113, "uuid": "f1ee641b-0951-4f6b-b80a-913feb46cb77", "comment": "Malware payload", "value": "8aff00774056fa9d2d14f82834162461", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139113, "uuid": "08e39792-7534-41da-8828-2a56e71fa98c", "comment": "Malware payload", "value": "0a6905b4333fa3f064690cf737d313cfbd5d4f4bac09de02565a42012ba78803", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139113, "uuid": "5d1de8e7-cfeb-4002-9d2a-3c0c3a6025f7", "comment": "Malware payload", "value": "05cd6e6cf6f48a82f794e4ff72a854b322f944b8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139113, "uuid": "d051b464-23bd-4a1b-bb07-56fe524492a2", "comment": "Malware payload", "value": "f38118a769818097eba50970b5be53ed1216dc884249e1c8e54ef4c1bf51826fffff67914daaf12acea67487fbf64773", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139113, "uuid": "38a5d9f2-d445-4fdb-9e74-da7e826ff0a4", "value": "T11443F168056F6D35E6C2D47908CE02BC5770589E87A1B2DE31A832BE79C2CD512E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139113, "uuid": "8ec31c40-ce48-4b14-8f57-6ba589f19378", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehcg:BoOAcw7nXDUsOjm3jTxhcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139113, "uuid": "ade10996-0a07-41d6-8b80-b61acf8446fd", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139113, "uuid": "916aa5dc-d5d0-494c-a250-fdc3958c95b5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139113, "uuid": "0cfd8ff8-6a8d-4218-9b4a-0e0825b16ebb", "value": "scanned_doc#2024-27-2_2398.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd17e14f-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709154280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709154280, "uuid": "8cbbdd11-a87d-4b66-8acf-61abfd92b09a", "comment": "Malware payload (VenomRAT)", "value": "a9bd8605a3911df7c12ddc7e5cd44db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709154280, "uuid": "46178b54-67ec-4438-a014-c57bd3c22493", "comment": "Malware payload (VenomRAT)", "value": "0c363101553b0ae76fd673bd22f91e76ea7acd7c406356539f25be4c532b044f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709154280, "uuid": "36c1fb41-c28b-4928-8766-5db6ddc1e825", "comment": "Malware payload (VenomRAT)", "value": "5897044e8349d43ed3c93c70d7afb1dfb940f24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709154280, "uuid": "55058cdd-f868-4cfd-a870-eced9a7d13ce", "comment": "Malware payload (VenomRAT)", "value": "56ab77f16d1b1e565c0d943f2f0d85d3f8380fd48ab9608eec615e8fed6c0077889cdc2f1dd5769d1afbfb526f22c472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709154280, "uuid": "9d028541-a125-4395-9544-8851dcc45952", "value": "T166735B013BE8CD2AF2AE47B9ACB251074EF4D5576112CE5E3CC440CD5A67BC68A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709154280, "uuid": "bbc68935-923e-499e-85a4-bcced7da84dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709154280, "uuid": "dac8415f-4e9a-4bf1-b889-a43dfbaf0044", "value": "1536:LUk0cxVGlCBiPMVye9VdQuDI6H1bf/6N1Qzc+LVclN:LURcxVMWiPMVye9VdQsH1bfCQXBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709154280, "uuid": "65153c53-6f55-4a29-ad42-28d1c7517eaf", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709154280, "uuid": "1e58a26b-bf59-4fa9-a947-c4deb174388d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709154280, "uuid": "1173c3f8-4ddb-406b-a2e6-0cac096d7c77", "value": "bTkd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb54c513-d656-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709137876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137876, "uuid": "cad0e9df-3d7a-49e8-8447-bc7af480c44d", "comment": "Malware payload", "value": "ffceafc521ba8fe2acf2778fb7c62262", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137876, "uuid": "9d8e91b6-2563-44d9-b29b-bc3a4b75c954", "comment": "Malware payload", "value": "0ccd7413f35b96014ff9816b87107c714a5ef679529e8ecc452ec8cf2e6a511a", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137876, "uuid": "e17ae98e-91e5-4a17-b5cc-49638557d7fa", "comment": "Malware payload", "value": "5db66097b402a31db43f2361f80c2fab657171b0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137876, "uuid": "d7171c1f-2a0e-4f92-9f07-a045a2476826", "comment": "Malware payload", "value": "cc8c02a8522c84b8577e708540d419fc2b9a87907d95de002c134bf3f86fe72ba813b2b3ed3a3f2c67073af3894dec9d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137876, "uuid": "773f5a90-7f7f-4dad-a193-02fa370d9651", "value": "T12D43F168056F7935E6C2D479088E02FC5770585D87A1B2DE36A833BE7982CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137876, "uuid": "fa52302a-c1df-4294-bc71-f9aa2b4e096d", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYweh1:BoOAcw7nXDUsOjm3jTxh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709137876, "uuid": "dfe9dcd7-6243-4e55-a2b7-a1d21ccf3261", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709137876, "uuid": "fbbc51a6-3cef-4ff2-a2ac-3995b4f7a575", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137876, "uuid": "b9931574-4215-45cc-8a96-55dbf0ddca97", "value": "scanned_doc#2024-27-2_5208.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90c897e-d64e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709134516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134516, "uuid": "397e87e7-6b37-409b-a43d-bb671ce7b94b", "comment": "Malware payload", "value": "506e5fd162fbc1902cd6492e3847fdac", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134516, "uuid": "effd80e3-8721-45a6-9363-8d00325b63db", "comment": "Malware payload", "value": "0d0ce645022fd264746503d9e355a1f59a0559086efd10093b5930e5ba34419a", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134516, "uuid": "df751b5e-6c44-4190-9dca-66a44f72191b", "comment": "Malware payload", "value": "253cc542b22ae8ed27f52d6aad184bc604e90620", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134516, "uuid": "a7dd8c82-3655-49e4-83e6-cdb02d0e5bf2", "comment": "Malware payload", "value": "c5bdabe5c42f110ae288ae8f72d00a915e4b16d7e366e285426ce0cc8cc8166a32f7b2913a8d4696a008a09d12ee3419", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134516, "uuid": "4143d5ca-98e5-4e8f-89de-97cc1ae1f980", "value": "T144D433DBE53C9004ED8B17FCEDB449BD8B99A49AED23681C987832DF64F494C7099834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134516, "uuid": "d5a42db4-6e08-4613-9395-6d65f914bc50", "value": "12288:GC8/VEBLsdOkRFVLRZYmK8X63Thepx0/oXS1LGYW6xR3OGENgsasZouSAn:z8aBLmpBRimK8cVAXSN7WoR+GuXxZtSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709134516, "uuid": "584e04cb-47d6-480d-9c2f-e787afdcf702", "value": 632912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709134516, "uuid": "bd6b2450-17a8-4dec-9fbe-ae3577584e27", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134516, "uuid": "26b970de-0bb3-4df7-9ce8-d1a3a6f29dac", "value": "Rechnungsbild pdf.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fccf751f-d685-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709158145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158145, "uuid": "27a58ae1-1451-41f4-99e8-98a68f964475", "comment": "Malware payload (VenomRAT)", "value": "47f726656e3f00c0eb04283a249bb11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158145, "uuid": "2afc72fa-7e9a-4709-859c-d3b712b549f4", "comment": "Malware payload (VenomRAT)", "value": "128568f3d106f5646d80885a44c080c3e8e90c3b061b16b1096bc97caa6a78c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158145, "uuid": "de5d2a76-b652-4eaf-9aba-6febdb64e857", "comment": "Malware payload (VenomRAT)", "value": "bdeee37bb889edda3acf5cd34c7f59de4a58f5f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158145, "uuid": "c3776227-fa75-4a87-8a0b-d78b21fe09ad", "comment": "Malware payload (VenomRAT)", "value": "45ee00feeae6c97bce7b5dddf009276337d0bbaaae4183f5d3c7372d58660f080780d160169538a672597ecda81d4f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158145, "uuid": "23ba84ea-642c-499f-bcc2-b13c6535e4d7", "value": "T16D734B013BE88D2AF2AE47B9BCB256070EF4D1576112CE5E3CC440DD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158145, "uuid": "7c532689-a043-4d27-9fa2-df9a6e3f1f8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158145, "uuid": "7607a5e7-2c47-449f-9a07-920f28500590", "value": "1536:aUZGcx5NVCMoPMVWe9VdQuDI6H1bf/lPBQzcZLVclN:aU8cx5zHoPMVWe9VdQsH1bfHQQBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709158145, "uuid": "c9bd662c-e669-47a3-ab9f-c1b8b42f3b44", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709158145, "uuid": "792fb8dc-2958-422f-8f85-cf1a8edac43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158145, "uuid": "bb1d335f-b41c-43ed-951e-d3f3738b152e", "value": "bLVz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c86c15-d65d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140609, "uuid": "a6e4d44d-e3f3-4425-985b-6b75f06a7ca1", "comment": "Malware payload", "value": "e0b18690ca81d0c04e143f9328828351", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140609, "uuid": "89ff10b7-eb2f-450a-ab6c-9cbab6bdc8c0", "comment": "Malware payload", "value": "128f7df33b4f6ba8fd5e1116683e1dcf9249451279467d421090a78a2f319771", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140609, "uuid": "a7e9d865-a99c-46db-9f5c-6339d4096b1e", "comment": "Malware payload", "value": "9b6fab80f939cee6746517fe3861138e1ffd828a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140609, "uuid": "7763d04d-6732-499f-9cdf-f4a714ff5e95", "comment": "Malware payload", "value": "0e567a7e634777f31b7097874a1ea5d12bf681ac773478c67753f8111ded66ea864bae1183f53202e1d3c3d675c8982d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140609, "uuid": "b1acac74-89d2-45ba-95d4-6e8eb0ee95dc", "value": "T15B738E2DD34B02598F620337AB5B1E5542BDBA7EF38552B1306C437933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140609, "uuid": "66235b2b-91db-4bba-851b-e79ae959a619", "value": "768:WwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjwwnunXibc4K+UCshEIa:WwAlRkwAlRkwAlRyunSbccVsPLdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140609, "uuid": "4d86560a-6188-4f5a-a536-b8764aa33b3b", "value": 79877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140609, "uuid": "2c4cfbd0-2b46-4c09-b7b6-10de49bd6ed0", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140609, "uuid": "90003b8c-14b3-450b-a3ab-eaa18930e7ee", "value": "SWIFT-547284.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04841a82-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156869, "uuid": "a2e5e079-db50-48ac-9c5a-11793d5502c5", "comment": "Malware payload (Mirai)", "value": "2fe1dc4cf6f894148ca4b4d288582196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156869, "uuid": "8cc64828-b3f6-45fa-bb61-5afcb5626b81", "comment": "Malware payload (Mirai)", "value": "14c33d849aaef82e11a51893ae24be8ce76afabfc96175deb38e654e82ca04dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156869, "uuid": "e70ec9c1-c45d-49b5-bccb-db6c996a0211", "comment": "Malware payload (Mirai)", "value": "eebddc31629696cd8eadc166e40aec6e4fa117e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156869, "uuid": "094e3c8e-586e-4b14-b6fb-40305e7b8692", "comment": "Malware payload (Mirai)", "value": "90c0950720a7213afd033a0a1ee770150bb03a043195ecf8aaf29661bc8db1e9d9fd3f8c0c54611ef5cc54421e5ebd40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156869, "uuid": "772e8e13-530a-4534-aad4-2c1e25bf3f06", "value": "T173C30906AF600EFBD89FCE3786A90B4625CC550622A93F76B670C428F64B54F1AD3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156869, "uuid": "b08afa77-da3d-4b18-9cc4-5a7c6d1fbf58", "value": "1536:i30waqWYKx5gX+1EpSOzwYaDLJVMMtDZKhZSYWeyKUuoNDg:i30HqWYKjNap+9VM4DDfDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156869, "uuid": "3fc10d28-2d13-4ddb-ac6b-cbd18098e579", "value": 126640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156869, "uuid": "8e93b697-ec18-4469-abe1-2f9eddc19243", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156869, "uuid": "16d8d2c4-c2bb-4d40-ba4c-4343a742ce01", "value": "2fe1dc4cf6f894148ca4b4d288582196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443eddef-d626-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709117033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117033, "uuid": "c572469f-5c08-467c-8dea-1878a0c86f17", "comment": "Malware payload", "value": "f09529be487a02ca6637cdafae71bbcd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117033, "uuid": "77034e66-5394-44e5-a798-74a0ff531644", "comment": "Malware payload", "value": "15277d4f13e407cf9044a963f97a27d81b3ea6ee4df85aa2443c7596f79bd2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117033, "uuid": "672247c6-0736-43c8-ad17-ce211a023549", "comment": "Malware payload", "value": "47f54aa2682275845734a6663b57e14fae8adf09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117033, "uuid": "9fe87696-b1ac-41ae-8e6b-e0d1d5b4efb7", "comment": "Malware payload", "value": "adb783b03651e4808b1f09b62f4ef6e0fc50d2e9c73ee2cfdb3a93060bc5539ec6e50d2eeff0aa11a42ed62d56e38300", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117033, "uuid": "277fe52b-848e-4012-8e5f-1399c660673f", "value": "T10976335B5E9A1073F172F2F241A1A76BF39C204D91360B8B6235DF197C20A66CE7E742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117033, "uuid": "82decb04-5330-45bb-a888-7427a1100608", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117033, "uuid": "4f5de11f-8aa9-45d1-930a-1643f3caf172", "value": "98304:GMt8k1h+HTKeI6Cv90r50KgY6fP/X4fDSkXlSAjTB3yehKJr3ZIriAgkRW79mO2M:GMtwueI19vKg4Sk1Sg5oxJhAB2Cwkt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709117033, "uuid": "13551850-cffa-442b-bb1c-6963013671a1", "value": 7377654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709117033, "uuid": "8e9846dc-f2f3-4a9a-b2ae-1ec5edada343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117033, "uuid": "d1c33217-d0f9-4440-9cf8-081f50d8a67d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91b7a68-d62e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709120746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120746, "uuid": "6743f279-f137-4f94-b2e6-b04927d80e23", "comment": "Malware payload (Mirai)", "value": "ebe2c8a6db3ebcea5e06d411335df1d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120746, "uuid": "c0d2794b-2476-43af-b335-a410ebbd81e8", "comment": "Malware payload (Mirai)", "value": "159e253d1044fcdc9a167e9370d772a173ffb00ad2ed530c9f115c2d07a1e256", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120746, "uuid": "7c35d96b-b941-4894-91e5-13a9b80a8802", "comment": "Malware payload (Mirai)", "value": "d38a236f9e9fe23be675da9bf774853b8845eb9e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120746, "uuid": "df554072-bbfe-41b6-832f-b964cbd8947d", "comment": "Malware payload (Mirai)", "value": "cd842e425f155ad18f8cef58819ddd9ffb2398b18572f02febd4670bdbc1e60db1703dfd7d52b50c2b351eeb765eb99b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709120746, "uuid": "b1cfe15c-5137-4484-a1e2-989d2ff08e4b", "value": "T119D34B46FA418A13C4D513BAFAAF4149333297A4D3DB730699185FB43FC67AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709120746, "uuid": "090c48a0-e91e-4485-ba69-94f4cf4be724", "value": "3072:nsaJBW3utlz1H8G9FDZOqMPzpctzkyYPL+E47M/9GNEYj:saJB2utlz1H8GTZOqMP1oYL+EAM/9FYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709120746, "uuid": "7883890d-5bc7-4d38-844b-6c5e874697d5", "value": 136482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709120746, "uuid": "3ac8ae77-9429-42d6-8d3a-5f3ee82d2581", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709120746, "uuid": "959a99d1-733b-4672-ab44-27eff0eb4265", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b8e3a5-d633-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709122565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122565, "uuid": "a90edbea-37cd-4fd3-9f6a-fe82cd0bf76e", "comment": "Malware payload (AgentTesla)", "value": "8a7ea7ff5e5cce2ca107a23aeb40b4e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122565, "uuid": "3457caad-b23b-4b8b-87c4-bb7d7ac028e4", "comment": "Malware payload (AgentTesla)", "value": "15bee5f27c8e807fca30b704600b5f4ffa67a5fa80d51bb444c42d52c9020cef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122565, "uuid": "b30213a4-980a-452d-ae33-734a7fcc9dd1", "comment": "Malware payload (AgentTesla)", "value": "0fe3cc81e2d4f294d80a8428783a72eb8cd82c6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122565, "uuid": "57c5ae62-e03f-4a5c-8956-6c133a5784d4", "comment": "Malware payload (AgentTesla)", "value": "593019f27c00eac709700bc372635c428c80b289524905e84912161ebde269f435b1fd4ee71a0d72cc948294c169eb86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122565, "uuid": "ea03126e-aaed-4415-b9cf-33f7e6477b30", "value": "T130F4E019237CAF76E77A43F454A098504BF1211FA53EE68A0EC264CB2A71FA05F52F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122565, "uuid": "ce9de7e1-9baa-4f3a-88c5-261cff2d32b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122565, "uuid": "26c0d7d4-1008-4280-9ee2-95d5fa2b758b", "value": "12288:C8S+oGOKcbWAL9bW9ezgqZDKogif+UPJsXf4vIUeVfvGMbvk1RsXS38Mc14hhjwd:RAL9iyga+ogimUmXgRnMY1RRg8hcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709122565, "uuid": "9b5efe43-d5e7-4108-ba09-51b2eb6fe4f2", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709122565, "uuid": "b668291b-d874-4c61-a06d-e769309ecc0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122565, "uuid": "671694e1-9935-42a7-aecb-73bbf731ce57", "value": "rScan_IMG-PaymentSheet_TillFEBUARY2024....pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab32571-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709125527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125527, "uuid": "1ca7af62-3e81-4812-b6b3-ce6ce89332d3", "comment": "Malware payload (Gafgyt)", "value": "13f8206ac19addb6d0aeaf38ea087551", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125527, "uuid": "234f3a8b-1ba8-4479-909e-bca5e5007b75", "comment": "Malware payload (Gafgyt)", "value": "170c84eb2f52087fb5a78f77a9d175e2a5bfee13aa61f67ed5c008ea7afff05e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125527, "uuid": "b812ac98-ecd5-4d64-a0a4-57c6f5d35243", "comment": "Malware payload (Gafgyt)", "value": "063439a6e3addbc7ceddb1bb9bf2f8659b2f7671", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125527, "uuid": "140c614c-61c4-403d-8d79-2f97da207f59", "comment": "Malware payload (Gafgyt)", "value": "b7d26f173ee47e4ea35eef699030f24a7971c7a45fe283b1fdcdc49357fdbc7eeef10e42ea255adadb69adeead2011ea", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125527, "uuid": "0aa1ba6a-1b9b-40e3-a983-ed90cf00e7a6", "value": "T105932B45F9418727C2D32BB6EB8F475D3B365A9467D733016A346EF02BC2B892E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125527, "uuid": "dd259b96-83f3-46c6-a501-7a0a24740792", "value": "1536:v5bc11gPfEIDRQqcfY4ayIFF14Xx6OMhgP/tBmRIqQ4DP/X7XtnQ:OgnRQSyu4XogP/fmRIqQ4DPv7XtnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125527, "uuid": "8b30b901-01df-49c7-877a-65af0f27a1fe", "value": 94777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125527, "uuid": "f553cabc-f179-4d7e-90f0-01fdad2588e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125527, "uuid": "d8403b51-4dbf-46f2-92cb-411d19eaf214", "value": "13f8206ac19addb6d0aeaf38ea087551", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dabec37-d633-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709122552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122552, "uuid": "525a626e-e9ac-412d-8775-3e30c924c7b0", "comment": "Malware payload (AgentTesla)", "value": "1466963e67354b94faa8ee645d8ac340", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122552, "uuid": "18724e83-382f-47ef-a902-a2ece4287238", "comment": "Malware payload (AgentTesla)", "value": "183d5fd2dd1124f92c03ec973c25c0ad0b8707ab3e5d494c9ffc93fbc59757d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122552, "uuid": "0824d6df-1a74-4a56-9e18-c95c5d09ea2c", "comment": "Malware payload (AgentTesla)", "value": "757aeca14cf95b926241fbd036a277ff1ce7797e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122552, "uuid": "02952c77-78d4-4d77-9869-09ff4a32fc8c", "comment": "Malware payload (AgentTesla)", "value": "daf7c10a3200f207256fd4a98af291771c1760482c450fca9385e14164319a7deda565d506f76136111e74eb9d014712", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122552, "uuid": "16618e13-a289-4b08-b2e5-ac3e3d9cbea5", "value": "T199E4239A6B88C5652A0D7BFECEC140D5F9850ACF9C8370F30DA0F576EE57120616EC6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122552, "uuid": "70174cb2-38b7-473a-92df-b489a4cecad0", "value": "12288:V/mlDi+IFY5YiRzcm3896vaOilE8OdIMWvKZYrh3m85sdJqbcu2to1TC3mlqLxCH:V/4DnIFY51Ncu8VeVdIcZC3mLdobcuYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709122552, "uuid": "6e8bce80-e905-4e11-9fc7-3f6c2db7d140", "value": 681745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709122552, "uuid": "1ee7dcac-ac9f-4521-b425-6fd3a04ed504", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122552, "uuid": "f91ddd19-6a76-4725-b34c-b40e5d8a3b4e", "value": "nScan_IMG-Payment Sheet _Till FEBUARY 2024....pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b364a1-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709129592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129592, "uuid": "59d5ee7c-0929-41c4-97bd-6a78635c7d28", "comment": "Malware payload (AgentTesla)", "value": "c56407abd66f8bb4eaa318e56f464f71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129592, "uuid": "d95e23f0-2297-4766-9a9e-4722481d438d", "comment": "Malware payload (AgentTesla)", "value": "18685cc299f03f907413c789321ea1131326fec4a71de97194814685ba0dba38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129592, "uuid": "c3e5765f-db5d-4283-a7a8-40ecaa0a5ba4", "comment": "Malware payload (AgentTesla)", "value": "134d8ad6789d8c500005754da686ddc7d46e92d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129592, "uuid": "ac6b0610-d05d-4111-95ed-bee4e4e445b2", "comment": "Malware payload (AgentTesla)", "value": "a01b27b7cf0c3f07e3d6ae6f96fb5cf3506f60a7db3133a9c18cf8a5314a9500791ee3421d856b4e6c8626ba9a5b3a14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129592, "uuid": "9c49e0df-944f-4e7c-b9c3-5ce5fc53a46c", "value": "T16DE4125426ACA18BC5EF96B5217464000BF2F41B7822EADD2DD070DF0AE7FD6DBA0617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129592, "uuid": "c8f3b720-5f4f-42a5-a7f0-64ac37a29430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129592, "uuid": "535b0ffd-8199-480f-b9db-c316f6ac98ff", "value": "12288:vW+L9bW9ezd6Ztw4C8zFVK52RoA5UCWEFElQ+Nij2DGoNHJqCf9OK96bkR:vbL9iyYnRC8zA26A5hxOlQ+cCJNHgKE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129592, "uuid": "2cc69094-a119-40df-bda8-b6e42cec7911", "value": 720392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129592, "uuid": "8959ff14-845d-42d3-abe6-82d880dad624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129592, "uuid": "6d044fb0-cc06-4f04-b63b-5f77faf8f671", "value": "Bank Copy 022824001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae38a49-d62b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709119326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119326, "uuid": "85f94ccc-756a-49f1-9ef3-a1921b3b83ac", "comment": "Malware payload", "value": "d44e193c467591433341367a22244d2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119326, "uuid": "1849679a-3067-4fd2-8091-49336bb1dd34", "comment": "Malware payload", "value": "19116581fbdb4c2acad3b938824d25909b94b05ed65a11c8a1f90d766810742b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119326, "uuid": "ac6c62b1-69d7-4ba6-9949-ff7697590468", "comment": "Malware payload", "value": "4fd40e32a725662c4daf29187cfbf030b021dd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119326, "uuid": "1917f23a-3a23-412b-954b-9e633853e1fb", "comment": "Malware payload", "value": "afa2cba6f74d21d6bb1f0969f1787e586da04efac665014e041990ffd08bf8ecbf1ff704f242ce9582e5c5f06d10d008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119326, "uuid": "7b93367b-10ec-4004-bb28-61b074cecde3", "value": "T1C1B533598A92923DC24D81302A73CFEF05F3E6B41CF097B5C7987B5FA31A4A215DB864", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119326, "uuid": "9bb313d8-e247-4fb2-bc5a-0e37f609a1b0", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119326, "uuid": "e5e0ff99-6019-4d0b-8a17-3440badac117", "value": "49152:AEO7kNbOnDT3Rn71zg+OVUHUo8yrnhjJ7m1kN1RlOSMB:AE8kNCn/hnR8+OVvybJN3EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709119326, "uuid": "4af78f9f-5aff-4014-9fee-f56da00b34a7", "value": 2354688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709119326, "uuid": "c096dfdd-aa19-4498-a6b1-396429564f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119326, "uuid": "91b4432a-5078-4cc7-9ec7-23418f68d6e5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30592.19518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47da6047-d623-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709115751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115751, "uuid": "ed0c09f3-45f8-4141-a4d3-a7e323ff1221", "comment": "Malware payload (AgentTesla)", "value": "150ca1eb55d54f8b9dc7de5c49f10fb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115751, "uuid": "19e8797a-2033-4998-b610-c38bcfa9a814", "comment": "Malware payload (AgentTesla)", "value": "1a2de0d2410c104d7f5b52650df1c1c20eaa6d53e9626a998079daadc719c3fc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115751, "uuid": "555e1800-8abd-4144-be59-c5feed72716c", "comment": "Malware payload (AgentTesla)", "value": "84db9259212990864343f71837afb541f56b4a4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115751, "uuid": "084bf235-5c15-441c-8336-0fdee0fab356", "comment": "Malware payload (AgentTesla)", "value": "15327df99ac75f863693aef23cdbc005cfe7d51bab174004daf1714d324e7486a797dde5aba2d1d79bc84d1145d5495d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115751, "uuid": "c9f5dce5-acde-4399-a052-f4c4d9081dae", "value": "T13FF4F149332C6BB2E67A87F404A098504BF5351FA63EE64A4DC274DB6A71F908F52F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115751, "uuid": "d2c95ffd-b58a-4e6f-9c1c-0f43f604f49f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115751, "uuid": "384d8d54-c683-4ccb-9e5d-06c260caf167", "value": "12288:U8S+oGOKclF81L9bW9ezTEaUABemXKkl6+K3U5aOTguFOS3DzmD0paNrEPOCs5gv:t1L9iyQanXKkIjWaOcuQSOD0paNriMfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709115751, "uuid": "36d2e378-40ef-42b7-9081-2db29b323013", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709115751, "uuid": "e2174fcd-b716-449b-9e57-650e49e1d717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115751, "uuid": "31486211-ca09-4fcf-aecb-995154bb1ea1", "value": "SecuriteInfo.com.Win32.MalwareX-gen.20699.29138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ed8603-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153897, "uuid": "c7e36f1e-f71c-4808-b6d7-15ceeb78c03b", "comment": "Malware payload (Mirai)", "value": "7ea0e7e3010f1d3105bb84a7c4db8491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153897, "uuid": "0f2e36c9-10e5-4450-824a-fd9e281d3422", "comment": "Malware payload (Mirai)", "value": "1a43d04468ca344a778a7d254eb4de069c2ab903c8b55fde4a5de13940c4d6e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153897, "uuid": "43d32672-a39a-49f2-81f1-129d93281a8b", "comment": "Malware payload (Mirai)", "value": "b45c847c16052401f18f0cfb45bc8d78d83f8cd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153897, "uuid": "97c02565-48f6-4bba-bb8a-8581b5a15b4f", "comment": "Malware payload (Mirai)", "value": "45a1ebd1f78aeab29bd8db32c81e1c5e35e2b9c65e24cb35ead9b6f14db81a13326183b32405762b908533dcab71f7cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153897, "uuid": "21f30946-df3a-4252-bc5e-fad6fae5d6fd", "value": "T1FB939EA3CD302DA8C2599673B1F04E795353B84097531FB461E1C7AAA443EDCBA193FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153897, "uuid": "2cacc741-ed6f-4b22-bd18-d4bf520f338f", "value": "1536:nsLbT8XhjQuBEEW7XLXdzekZM9KhpNnfK6aCOmCU3fMKO:nsLbT8xQcnyLXdvMkhXK6a8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153897, "uuid": "cec97c82-d91b-4f7c-9e95-14e5f53c3115", "value": 91576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153897, "uuid": "4f68f8c0-2c52-46f4-894f-171476554aa9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153897, "uuid": "5db2d046-ab1d-4cb3-82b8-33932a2b1b40", "value": "7ea0e7e3010f1d3105bb84a7c4db8491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143edca3-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709159473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159473, "uuid": "3a27fd4e-ffe1-45dd-a3ba-e2e05ee19ef9", "comment": "Malware payload (Gafgyt)", "value": "3ef9f87e0449f4ba89f82eb8e8c45d23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159473, "uuid": "45cf2df2-2463-4f1c-9528-756e3c85d318", "comment": "Malware payload (Gafgyt)", "value": "1a9a80aa0caa9a39f86aa572ad4a3c606ecb315760ca87351d3129af0501f24b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159473, "uuid": "bb4b9052-9460-4215-a43e-ebf97462a7d5", "comment": "Malware payload (Gafgyt)", "value": "0935c66034a7e3a5a4991cbbac6c468618068f7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159473, "uuid": "27355c5f-b500-4d83-abc8-f26594278ae4", "comment": "Malware payload (Gafgyt)", "value": "9cec686d5386a408938f9ff7225d7912a35d8cd3560cb46a93e02e8c43ab679d3d64084530befd1ec00470a55b5533ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159473, "uuid": "fdb370c2-b3a5-47f6-bf80-8b596b6660c3", "value": "T1F0347567C21684A5E1584CF2216732809E97923FC8FB71C3FA1A1DA0FEB485B157BED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159473, "uuid": "9d810165-74cf-47ac-9aec-80390f973ca1", "value": "3072:qN4XyaPA8VjJWRCsYJ72G3qFv/3YdhQvgTSzVcCNFNpmDqMB+YdxT:LDPA8VjJWRawn3YdcyCvzmDqMBNdxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159473, "uuid": "8e1f2023-8c71-4e1c-a2c2-dd40c984dd8d", "value": 237742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159473, "uuid": "7950add4-8f4b-4a4e-b8f2-b0a409663825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159473, "uuid": "c9d00a11-9145-4f9f-b061-3462e4c17e38", "value": "3ef9f87e0449f4ba89f82eb8e8c45d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdfa2fdd-d5e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709088139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088139, "uuid": "abbc11f6-0857-4805-8009-1f2e2fbbb3c9", "comment": "Malware payload (RiseProStealer)", "value": "eb29ae84cdf73d55a6ee2ec71ede2859", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088139, "uuid": "1ba772d8-9203-41cc-9b32-803449430ff8", "comment": "Malware payload (RiseProStealer)", "value": "1bbf4caf546512e09ca6c0dc5778857fc4ad629cd7dd856fe243cc99d05b25d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088139, "uuid": "3a883b5a-7cb1-4951-bd24-c582751c1584", "comment": "Malware payload (RiseProStealer)", "value": "6c36814f30e428e62c4ff1faa9b9eadc667a3a30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088139, "uuid": "27f4ac28-e3ca-4b71-8058-583d3a48ca6e", "comment": "Malware payload (RiseProStealer)", "value": "af7f19e93138d7a6c981f228e921345850df1de46386d9a114d4d57a1bd62ca195e3f0588933c135832ff1a208210fe4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088139, "uuid": "608b4cf4-4a85-46d0-a496-049bd3e467f8", "value": "T115B533432B856617C75D003698D1CA289F95EDE083F36E5E04B7BDE8F16B0E0957A4F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088139, "uuid": "5fbbc8b9-6504-4f1f-b983-bbfe20b2aa01", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088139, "uuid": "5a0bc35a-1752-4e81-b219-c6a1d84acfba", "value": "49152:yAr4AKdmtugimkwgKmodnb5GkF1scB7X/qnY8UFQGjEy7svgLnk:3rLZimkgmod71zl/P8AQGjh7sH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709088139, "uuid": "87b1e827-4107-4476-97ac-7992fc53ad88", "value": 2322944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709088139, "uuid": "1a484284-43e3-4eae-bf78-6f3be85c58cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088139, "uuid": "9d1f8931-ee4a-433a-8416-0a39cfcd6ed8", "value": "eb29ae84cdf73d55a6ee2ec71ede2859", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1456eb-d681-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709156209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156209, "uuid": "8448fc59-665e-439d-accc-ab2f704f352c", "comment": "Malware payload", "value": "b569d961b15d7bb0ccc640033f529ccc", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156209, "uuid": "7fc1e11d-864f-4ab2-a545-d1efa8a59487", "comment": "Malware payload", "value": "1be8c45867931b837a5630833a9e2a01846538118f9c8e345c1a23a5f2510343", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156209, "uuid": "89d8708e-1367-43b6-bca3-8d5de804042c", "comment": "Malware payload", "value": "f37cd9c5ef39d786823359876ef93431b8c28f52", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156209, "uuid": "3b7a5c9a-ed43-45ac-8c1f-4372debb59a1", "comment": "Malware payload", "value": "af5e2c295809330f0a60beb95b9ef3bec1a4978dd48ca8f2a4cfcc62a47c16ca7cb3078dd82f669df3c50d0ec6bec970", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156209, "uuid": "943baa86-551e-4467-baa3-5de82cd876e9", "value": "T13311C40CABE79302358E322A34C3F7260C4CEB62D0338A3559AD22C5C8483AAAB91048", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156209, "uuid": "bb71f22d-46e9-424f-a4a2-eed5b5b62660", "value": "24:ZOrg0vP+wUtJuOSolvuB/y2wQceUMUWLhQvM/0bLtVD:ZSgkPb6uOHk6pW7LCU8bLtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156209, "uuid": "41ce5425-104c-4164-af7e-edc04c2b7164", "value": 933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156209, "uuid": "dea922e0-b5d3-4c13-80e0-1aab08ac93cd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156209, "uuid": "534214ee-3d1b-416b-baea-286d2d7b93d8", "value": "=?utf-8?Q?WhatsApp_G=C3=B6rsel_2024-02-28_saat_14=2E52=2E35=5F809ff0ec=2ERAR?=", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b547ee-d5ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709100426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100426, "uuid": "de5755ac-a084-4772-af6c-f2d5879594f9", "comment": "Malware payload (Mirai)", "value": "b9bce82f41d06b11802c7d5140b75659", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100426, "uuid": "56bc7b57-cc9a-437a-b137-0dac4aff124b", "comment": "Malware payload (Mirai)", "value": "1c3a7dab14418e44d59d87b8285491f0821fe01a6b24ce33a244998bd8a7a08f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100426, "uuid": "ef9789d3-c1ff-4dc0-9555-96586f69a125", "comment": "Malware payload (Mirai)", "value": "a6ca900230f584e8a60bc0db54dc2e75d6c6c1a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100426, "uuid": "e568257b-475d-4b15-ae7d-2fa04dbea383", "comment": "Malware payload (Mirai)", "value": "aad970f5b4e473fca2d529e59ce2853a52bfe33ae264f2b164f5ab67e029b545847fabc4adeae5d8f4d47aadd016252f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100426, "uuid": "ea831855-8e0d-4335-b16f-f3ecce1ec94d", "value": "T111735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E61625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100426, "uuid": "885add3a-636a-4804-9ff3-7d18622e67a6", "value": "1536:b/DYQYs1ZokODichzx15UzOHIt09afsH18ruUGDKVQSi:zDhzUkODichz9Uzk40A0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709100426, "uuid": "fbb2269f-a66b-49fd-810e-1cc8c541dffc", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709100426, "uuid": "35c8f567-06f2-4c1a-8eed-6486eea213a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100426, "uuid": "a2f6a770-b426-4f16-ab5f-305a06f1da4f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71e159c8-d681-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709156194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156194, "uuid": "511c289e-6dd7-4759-aba3-fac805c728e7", "comment": "Malware payload", "value": "0f8dd025f4c930414f5adf5387342eab", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156194, "uuid": "eb230dcb-f059-45cf-903c-8987130e2e9b", "comment": "Malware payload", "value": "1ed0fd59fd0125ae3c9cbd51570119a46fd56a59fe5fff03421ffa62cc5e08b8", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156194, "uuid": "b986b56a-d67d-466f-8063-fb2e74855740", "comment": "Malware payload", "value": "c69fb0b4ad743edd3720f7ca822fbfa6a1eb6a85", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156194, "uuid": "9c158be9-d85b-4455-851e-65cd03f1bf18", "comment": "Malware payload", "value": "2a9a347851f00fc9d1c030458f2369215cdcd3133b105251cdf4f45cbd76109edea52941cd059c9aaba5e5ecff4b2ac2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156194, "uuid": "50cb6988-0d12-4be1-88b8-ba3d718109d5", "value": "T14711F70BC816A500FCD68064EAC8180801398333B1A4FA9EBB1770E83704A2D23F550F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156194, "uuid": "3b20114e-2e17-4510-a627-18f43950be98", "value": "24:ZOrGyvVEg3rM/Rxh8sS1RSHrKLWXMv6sj9Ce8Bw6WVkMP6gWvlrvE:ZSGyCAMpxuvHEe8BWrP61lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156194, "uuid": "bc8e5e50-a3f0-49f5-826e-2f1bd4629998", "value": 922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156194, "uuid": "c1e314e5-d118-46d8-a7ef-8e2a65442d17", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156194, "uuid": "5ef70d2d-447b-4015-9159-5abf34d25781", "value": "FYI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed354392-d658-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709138792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138792, "uuid": "c48d7d57-8f8d-4b8a-ab3f-cce5f3b01e15", "comment": "Malware payload", "value": "831f7b7758034004ac8eb13ece547a25", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138792, "uuid": "cd2bdf7b-a247-4aa8-82a0-649bea0d4576", "comment": "Malware payload", "value": "1f16afa813365827c89795d27ef380b32bee9bffcf7121a231a9e6b4a2b63b72", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138792, "uuid": "12cb6072-940f-429b-a7df-3078c72c11bb", "comment": "Malware payload", "value": "01da149037a7d0fccb4090c1c5e287813eae8662", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138792, "uuid": "c8048310-3c17-4be0-9eff-023f660e8c46", "comment": "Malware payload", "value": "b334b365a73e5d4a248b4196afe133be4bcd18fd848d27ac5346428ffb9e81b9cf0c4a570449d2a9addb9cbdd92899f5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709138792, "uuid": "9620b1e5-2e7c-4a39-a87d-cea18216bf4b", "value": "T13343F168456F6935E6C2D47908CE02BD5370585D87B1B2DE32A833BE7982CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709138792, "uuid": "357942cb-ab1c-4c79-80a5-017188bfc7c6", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYweha9:BoOAcw7nXDUsOjm3jTxh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709138792, "uuid": "5145258d-4c5d-4050-b28a-ed9fbb93437a", "value": 56842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709138792, "uuid": "e3f12135-9eee-4a36-8691-81210927d23c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709138792, "uuid": "803747f9-2967-402e-8129-250788ad7465", "value": "scanned_doc#2024-27-2_1341.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14c85dc-d5f4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709095822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709095822, "uuid": "51752889-61c5-4efb-b751-0ab0cfce5a31", "comment": "Malware payload (Socks5Systemz)", "value": "9476e7dd2ebed54259ab23bc453bbc24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709095822, "uuid": "65d85483-bb94-4234-915d-c3cbec6eff4f", "comment": "Malware payload (Socks5Systemz)", "value": "1f78ffc413e1efc75cd0f9b48888f8675ab026f704dd4eb72346e7c8ee471ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709095822, "uuid": "c649bfc3-308b-4419-92df-36c0264f9d9f", "comment": "Malware payload (Socks5Systemz)", "value": "15ee73cbfbd9b69f3a7ef647c172f2af893ddffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709095822, "uuid": "58411321-4354-4a1a-864c-2bb89dd09022", "comment": "Malware payload (Socks5Systemz)", "value": "90d4adb4b24c04b1bf58064b40b0ecb28c2abfae7ce5e90104e53d0ffe3adf83f74640796337a5ec430c63438dd044b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709095822, "uuid": "82395d0e-849c-428b-bb6c-ee90e0095825", "value": "T13EB5334189A4FA71E11147F00BA985587F337F56AE7AB8B521CC898B1F3AEE5CC053D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709095822, "uuid": "4f22e95a-4b3c-4df2-9db0-d25f797b0758", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709095822, "uuid": "552048ea-f70c-4e90-8720-0bd61d33ea9f", "value": "49152:C9A/wjF337k2wJy0I0X/sO6LoJCvnpmUN9sNsWaG3pQ/UXjH58:MR53r0Jp93Anp/DsTaG3pQMT58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709095822, "uuid": "3f2fbc27-03ba-4224-a879-86de2da08b26", "value": 2482744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709095822, "uuid": "b882bbea-7e78-4b97-b1e1-ed1fa79755a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709095822, "uuid": "c37df8bd-b7d1-44c7-9c61-dd5c05157ba7", "value": "9476e7dd2ebed54259ab23bc453bbc24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340dfef9-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709125596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125596, "uuid": "dce1cf39-4804-4af1-b851-ef01ec134e10", "comment": "Malware payload", "value": "b1119af9ab767942c6e84abd51030f16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125596, "uuid": "303fff2f-f17e-4789-99fb-cf0ef56b5ac3", "comment": "Malware payload", "value": "1fcc576fe855dcab37699cc0fbd041648d3bb073a66495eceb078f1786146839", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125596, "uuid": "235aed6b-96f2-4147-a149-d65cbdc5416f", "comment": "Malware payload", "value": "cbf5a688bc409cf8b50c3308b94ed15478ccb1bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125596, "uuid": "d5631a92-10f9-4bd7-b7c4-c57b07fceb8c", "comment": "Malware payload", "value": "27f01ec6e9528aa8387fd1a00815569d448ba73f8a1dd8e55c359802ff123df1992d8d7aa0ab38a6dbe4dc8819dd118b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125596, "uuid": "8805a808-c075-4450-a651-cca7ed355ccf", "value": "T14BB33905E5508757C2D3237AB78F865D37332BE893DB33225A247BB42BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125596, "uuid": "6200083b-5bc3-4d5e-b6e6-d5c7ad1a8a3e", "value": "3072:45aHleVtrWxIgIZY6DFl6534bmXQOY5sXvxN:45aHleVhZY6DFY5IbmXQOY5CvxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125596, "uuid": "374064d5-ba5a-4ab4-826d-6dae552fd67e", "value": 115329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125596, "uuid": "ec3ef2e1-cf9f-4550-bbdf-c4927efdb4f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125596, "uuid": "faee3fb1-c6f9-4400-b0a8-0faa418aacd4", "value": "b1119af9ab767942c6e84abd51030f16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb7c57c8-d67b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153848, "uuid": "ea885810-047e-455e-845e-44a51ed2a3e1", "comment": "Malware payload (Mirai)", "value": "2204dcf0c3e11d1b3da0628c29f167db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153848, "uuid": "100e6b7c-9cd0-4199-95dc-8fdbb6fbeb0c", "comment": "Malware payload (Mirai)", "value": "2016efe0a8b32f7bfbfc0acb745288cd6967cc9d3cb36eb32da52c364164dc17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153848, "uuid": "8457d854-c52c-4bd0-8e58-78256d673475", "comment": "Malware payload (Mirai)", "value": "25f4078e1631381ea456e717064c976d69ae4156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153848, "uuid": "3e25376a-0400-4a76-b9ad-cdfe678b25bc", "comment": "Malware payload (Mirai)", "value": "26b17199a41c641fb39a4298dacc73bf6f16bbefedd7590d7303a8ec72be8bfc6fb49818b831234058b84d721e66aad1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153848, "uuid": "685a16df-5be9-41d3-906e-b2ec9683f0a0", "value": "T16FB31996A8908B12C5D2257BFE1E558E3313177CE3DF72129E246F246B8B96F0E3B405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153848, "uuid": "c98a4d74-bccf-4e78-ad36-23a7274792af", "value": "1536:Iwnfih5Z7X5qSC5fRKyefqYs86SVJPxw8ZzJpvHkaSL/RNdZieNMl4t5MfEC8Ynz:E3e5oywHsHStw8pHvHkaSPNMl48YbRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153848, "uuid": "aed82bc3-ace0-448c-acc7-71b1bdb69d68", "value": 111980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153848, "uuid": "04d777e1-8461-497f-8b87-d8369b4558ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153848, "uuid": "3fe731e9-fea1-45f5-b4ae-f8ddb1577549", "value": "2204dcf0c3e11d1b3da0628c29f167db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141bd9c8-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709125542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125542, "uuid": "8c57f0fe-d61b-47c5-b676-872b80cdbc93", "comment": "Malware payload", "value": "eb6086dbe730895733065f1b6e109296", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125542, "uuid": "7a393372-45d2-4449-8812-fdb897cb0012", "comment": "Malware payload", "value": "20b5394c6183e9d8390ee06f1eab60f468b8f378caa906e2a58d500dce8f2dda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125542, "uuid": "f2e5ace9-1c41-4521-9337-8baf2f783856", "comment": "Malware payload", "value": "de20194c4f7cd4c3dfbb78fb4afd9b3125c7b176", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125542, "uuid": "5570b2fb-4139-4175-9ec9-c174884adbcd", "comment": "Malware payload", "value": "6d00c893e5a975b561169f1cb62906e0611de1a6718f41c149cefc2251730551685569553d13f4c787402f4904233169", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125542, "uuid": "35717b81-5383-4935-9bc1-8a87145b6fe7", "value": "T1E9933A03B71D0B53C49B59F12DFB2BF18769F9E123A26181B10AAFD44773AB02512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125542, "uuid": "04ac9812-ffab-4fe0-a5da-2cd7a46d6d7a", "value": "1536:5QcbFZl1qdpqP8WUgyc11dt3DKXRJ49ZG87LEmQBVqDrjtWfz+Q:5z/VAc11dt3I+Y87LEmQBVqDrBWfz+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125542, "uuid": "9c0319c9-6cc3-4b09-93f6-33879eae72f2", "value": 88901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125542, "uuid": "c911c641-1d16-4800-8030-ca86fcafdfbb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125542, "uuid": "f9a1d114-68e1-491d-9123-b33d9076c4de", "value": "eb6086dbe730895733065f1b6e109296", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3291be3d-d653-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709136331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136331, "uuid": "15b5b545-37c9-42bd-a6f9-748b00a618cc", "comment": "Malware payload (njrat)", "value": "8f92613e5a81aa192bc40a583bd7e1f3", "object_relation": "md5", "Tag": [ { "name": "a01", "colour": "#6F9B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136331, "uuid": "3d51eb22-74a2-4e33-b06c-06e99f67c135", "comment": "Malware payload (njrat)", "value": "20f833a2da03b679637ab02bf4c18d2fe731c7273e4333eef35e6c2d9b2ec67d", "object_relation": "sha256", "Tag": [ { "name": "a01", "colour": "#6F9B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136331, "uuid": "28d6dd8a-cb17-4f3e-af73-9c5ac11fbd00", "comment": "Malware payload (njrat)", "value": "888d4249cf1256a9683ee4b16a279ac433ca76ef", "object_relation": "sha1", "Tag": [ { "name": "a01", "colour": "#6F9B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136331, "uuid": "dfda79c5-0677-41df-9b47-a9c23879b9f6", "comment": "Malware payload (njrat)", "value": "a45bba95a0abcf3c01dc37c125291677b14aeac356709deb503e5e780ddb673d9b7d60587ee9483ea989b56b15401dd1", "object_relation": "sha3-384", "Tag": [ { "name": "a01", "colour": "#6F9B08", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136331, "uuid": "d0857553-35ea-489e-b5e0-3a2713a7b697", "value": "T10393088937F88C14E1BE677758B1920287B2B2571B23E24E0FB5C48D27737489D45BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136331, "uuid": "0476165b-898a-4d4a-8454-819d07dc813c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136331, "uuid": "7f721ea8-ff34-45e8-bb2e-4d5a6a7b122b", "value": "1536:8fjBqXbcDkWUtfcVIdcl0N0LPOBAmbmwHwNqhOtxR8o:2j4XIo1ndcl0N0LP0AwmwQNqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709136331, "uuid": "591356c9-493b-49cd-bf5e-c7dea77ac2bb", "value": 90624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709136331, "uuid": "9974ab77-fd85-47ac-9f95-6f71b8dfdb60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136331, "uuid": "4eb750f5-5188-4b81-9754-ed44254b9e20", "value": "vlc-3.0.17.4-win64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb8c431-d65c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140163, "uuid": "80f88988-88ce-4340-bc4c-81b58708a125", "comment": "Malware payload", "value": "f18c5997da1cd194ca4f5d7c7a492100", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140163, "uuid": "9a9c7004-3710-488d-a080-a667685d8e3b", "comment": "Malware payload", "value": "216cd080a5bc3191e3237c0a7fa6f7a712c8a840653b860ad0b037e65875c784", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140163, "uuid": "306c5b2f-ea1c-4b4f-960e-bae4a9c00c2b", "comment": "Malware payload", "value": "db57a74053da907b62dc14c6a1756fbcfbffb122", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140163, "uuid": "8dfd9330-6103-442d-bd44-eaaa8fa35eed", "comment": "Malware payload", "value": "ec6e8ee161698ece04184bc7eea584bf0e3eba7376ed255d6eb90060ac6b2a94f94e4337df7f3f6f596a86983ac63e11", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140163, "uuid": "0f72f27b-0d98-4529-99ab-f6ec8b0c6b62", "value": "T1064302784157B816DA82C83A0DCD02F963505C8E87E2F6DB35EC62BE6442CE641D87E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140163, "uuid": "e03bd43a-4f1c-4c06-8c1b-624e85d27bf5", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdz2:EoOAcw7nXDUsOjm3jTX6ot2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140163, "uuid": "3cd8df06-44fb-48c0-9e27-266c2884e236", "value": 59514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140163, "uuid": "2103b64d-1d45-4a71-9856-eaaecb681cf8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140163, "uuid": "0d9c70a7-a236-4463-a5e2-1ae2639e8951", "value": "scanned_doc#2024-27-2_9290.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc82676-d5f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709097370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097370, "uuid": "35c0991c-1f9e-47d9-a023-5b5aa129debb", "comment": "Malware payload (PureLogStealer)", "value": "a344d711eee57a20c4c56f3c642c7e2e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097370, "uuid": "79873887-e8a0-4c0c-8ee7-c780543bb0b1", "comment": "Malware payload (PureLogStealer)", "value": "2306a778adcf141db023e4aba49983ec16bfd1a88b0b1a59ac1a58a704dffe6b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097370, "uuid": "73bbe151-1764-44e3-baa9-e6668ba18551", "comment": "Malware payload (PureLogStealer)", "value": "d33b2efc719e6ede1af89db826b47315595c5cad", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097370, "uuid": "da137e1e-03db-4865-8f09-9c636e13198d", "comment": "Malware payload (PureLogStealer)", "value": "b5c0516bd804bf9b85fbc3aace4d0762dbe26e9520a55f5b3c18d7278e24435c7bda6c691392a8d9e0b0873f0580adac", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097370, "uuid": "4a4ae05f-7405-4cf0-becd-933216de6a35", "value": "T10066F843BB865DA2C64A233BC1970950677FEA846313DB47365F233A9C133FA2D191E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097370, "uuid": "a9dbac91-f378-4910-b5ee-edbbf8ca3174", "value": "49152:ZLL7HtK37BJNrmPws6bQuudtyA9Cqs6MiiIcu1TZmw8qn5KIXHAZ9rgxy:lYJNrmPvbhi/qK6LHAZ9yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709097370, "uuid": "b62077e6-801f-43b4-a1c4-512c60d47f86", "value": 6616120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709097370, "uuid": "3e015a8a-dbec-4711-b76c-4e1a0ad2254d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097370, "uuid": "b6d8023e-e20d-419b-a7cb-1f11061df3fa", "value": "a344d711eee57a20c4c56f3c642c7e2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a76a8e76-d65b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139963, "uuid": "dba6f83a-6066-4994-a9a8-c2081bca4255", "comment": "Malware payload", "value": "64c7635646d1928e22de8015dc685508", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139963, "uuid": "cb68e7bd-6533-404a-8e23-300aec0bfd40", "comment": "Malware payload", "value": "23f4bc035558da80620c5a07228cf04c59472f81e67cb28b0ac1c458dd42ffdc", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139963, "uuid": "fa85b64f-8168-43ea-9312-5994c9d437da", "comment": "Malware payload", "value": "33525206c6b680d55458fd17198bd87c35352483", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139963, "uuid": "2850f3f5-6a6c-4663-b681-f7aa6512d4e1", "comment": "Malware payload", "value": "6f432799b2f6bb530510af64bb92f5dce66a0f26c4efc0c8e31e074780903a352e3329cc70cd56a9d9e6b43759ec667d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139963, "uuid": "649f23e0-5b24-493d-a63d-cd3ebf7d0e3f", "value": "T1474302784157A816DA82C83E0DCD02F967506C9EC7E2F7EB35ECA2BE6442CE601D87D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139963, "uuid": "1b32341d-84c5-4878-8484-c6fceeed37a3", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdz8:EoOAcw7nXDUsOjm3jTX6ot8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139963, "uuid": "afc5df45-6cdb-49b6-8fbb-40c8035ac24f", "value": 59513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139963, "uuid": "37a97688-20c4-42d1-9e81-f8c8510eb6cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139963, "uuid": "0436f07f-6be7-45d2-b2b5-f4038423999c", "value": "scanned_doc#2024-27-2_7261.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cec9454-d62b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1709119329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119329, "uuid": "3c09aef2-7e71-43f3-a470-fd263ea805dc", "comment": "Malware payload (Adware.Generic)", "value": "1198daaa23f0af650c7cd4555fbef9e8", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119329, "uuid": "c4e77e21-d094-4043-8312-78734a8a1139", "comment": "Malware payload (Adware.Generic)", "value": "25c846183e10bd2a146325effecddbabf0f390717fd11d597012a033e6daf600", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119329, "uuid": "4c87ecd9-824b-4662-9c4e-1db0af01ed0f", "comment": "Malware payload (Adware.Generic)", "value": "783f86460785027a41a84e41b42a05b4d4a1a462", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119329, "uuid": "fe8f7ed8-2a74-4de8-877f-2ecb45829725", "comment": "Malware payload (Adware.Generic)", "value": "5b97b7d4c1cf05cc37b568eb9e3fa5524846938b28ced15f77a688ce265b20b911634115b0396716043e7c65fd8c78fa", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119329, "uuid": "1755ba36-85bf-4f59-9eba-8fd6915a545c", "value": "T153A6E1127951C06CC71101F06E9EFBB943B9DDA84FAB78C762F43EAC193AAD01C39959", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119329, "uuid": "01458983-4f18-4296-aa43-a74ab8232e95", "value": "4f9052bf7db48b38db711b14e02cf64c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119329, "uuid": "65940b21-1830-4639-bc42-eb5bac7ff1e3", "value": "196608:+5DcteeKaKIZJjwrqN/RFmQ3bKfIiaNPFHNRsiK1:8ctVtKckrqNnL3bIIiEHMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709119329, "uuid": "5bb531ee-2fc3-42cd-b98b-038e08765353", "value": 9990976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709119329, "uuid": "f38a3880-54e4-4c1c-87fb-a634b9b0eb8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119329, "uuid": "53b25e55-e5d5-4189-80ec-8aaea62b7b5b", "value": "SecuriteInfo.com.Program.Unwanted.5399.28168.2681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be45c0c6-d65b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140001, "uuid": "251dcfee-dd40-4f05-b23e-e9fcc532b54c", "comment": "Malware payload", "value": "77b2abbf135ce0b1be708162caeb8bff", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140001, "uuid": "8ea7d314-8317-4ba8-9677-5344e311a2c0", "comment": "Malware payload", "value": "264d07b87e63275b70b60deb53a00314edebcc29520e4dc6802f439b7ff4f78c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140001, "uuid": "e0e774ce-f5e8-43bf-99f3-7ace3e5403a0", "comment": "Malware payload", "value": "230bf810072fbdea3c21970252e1c25b6cc6fb5f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140001, "uuid": "5bcee624-2bcb-4513-9647-3a4a89f0ce43", "comment": "Malware payload", "value": "644a6dafd83951fb68bddf0ade2292acdfb1b9952527e924e91b01058d7074993ca8220e7ba80e829f91851424fff642", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140001, "uuid": "29c4d0ef-3660-4888-ae42-b076b75de52f", "value": "T14E4302784157A817DA82C83E0DCD02F963506C9E87E2F7EB35EC62BE6542CE601D97D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140001, "uuid": "e014545b-b6dc-4ecf-9749-c4c5726f8453", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdz6:EoOAcw7nXDUsOjm3jTX6ot6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140001, "uuid": "cd6819b5-1224-408c-8d52-aba6cb27d89d", "value": 59513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140001, "uuid": "6fe49e3e-9fa9-48cd-8160-3ddf1a6cdd1e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140001, "uuid": "71ad856d-fe7d-4aea-b4f5-af5bdab4b543", "value": "scanned_doc#2024-27-2_9631.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643d8779-d605-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709102913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102913, "uuid": "941e346e-f930-44ad-a908-ccb8b86f75b8", "comment": "Malware payload (Mirai)", "value": "11e624cf21186e49d447d714bbd95d15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102913, "uuid": "1ba12914-b295-436f-b725-2fde49c3bd30", "comment": "Malware payload (Mirai)", "value": "270fd609dedd07d3560ff22922cfacf97fb2ea0d2abfb38ce08da3a6a4e28b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102913, "uuid": "502254d8-5e5f-412a-903e-b52316bb4331", "comment": "Malware payload (Mirai)", "value": "1a491a000cabbc43219418613e9de0da901f17f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102913, "uuid": "ec55a736-2c61-40a0-9518-56085a1170b2", "comment": "Malware payload (Mirai)", "value": "cf0293a4b51b1b66dd880e048e433b64f32599fba3c78dbb912ff86f682f3761fa9656b7e0f6d960c2d92610da55ff3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102913, "uuid": "9606b058-2629-4e19-9b7e-c59bc5fa0b24", "value": "T141833924BC391E27C0E4A17A21F7C722F2F5228D21B4866D3D710F4EBF656407A47AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102913, "uuid": "312f2935-e19c-453b-ae42-1aafb4b48471", "value": "1536:FrWZnHJSkunDANOJpkwJ1+fUH4ZtNYMCcz75ZXbtAR:xWZQJ0SCftWzczVIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102913, "uuid": "06648115-1bff-4979-be13-8095d100c7ad", "value": 87844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102913, "uuid": "e6242652-5227-4982-9a2a-5e518bc0eac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102913, "uuid": "4dd0f397-c172-4cb4-a276-325f75c98d63", "value": "11e624cf21186e49d447d714bbd95d15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56a2633-d67e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709155072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155072, "uuid": "a38770db-bac5-4c6e-9aba-5988e8f6ec5e", "comment": "Malware payload", "value": "c0f6066a362f1f0a6bc04e0d16119ff8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155072, "uuid": "ec622574-3811-4903-95d0-65b08a01a69b", "comment": "Malware payload", "value": "28b18c105c82cd23a71516cec81f6ffd6c2ea30ecbf3084cd7c54eb2f2a6a92e", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155072, "uuid": "f8c313a1-4e83-40a3-83fa-2646364d93be", "comment": "Malware payload", "value": "b89ecfbadc421881b549dcbf87483784081c21a8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155072, "uuid": "dde09e0d-2453-438b-95c4-4d2b1f7206d2", "comment": "Malware payload", "value": "2909e69a93bf0c0f36e982648917a7ef4680f7c2721be3b79a1bb1db8618942430641bfec89d6c75937ee57c28cacb3f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155072, "uuid": "89fb5552-affa-4f6a-9d30-e5d0ccb63ee4", "value": "T1DC27E113B2C0903FD06B1A369A27E6C5253FFBA15A158D6B2BE42D8C5F34B81753E607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155072, "uuid": "dd391d04-6e55-4f83-b6c0-bc3530cbca50", "value": "393216:VLOTINI1t+huyjI7sMA8xdZ6F2W494kdw+re6pK7gpagVxtBqIRgF4MO0:NO0e1Qts7sMA8xdK/kvSP7gY6tBjBMO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155072, "uuid": "913632de-5545-4d7c-8abc-6a0478911e8b", "value": 20449792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155072, "uuid": "87addf31-4dad-4cfa-9f41-0bbcafb23224", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155072, "uuid": "b4b0e054-a5e4-478b-8063-0dd62b786cce", "value": "nopagadanueva.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "202b5e87-d664-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709143601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143601, "uuid": "0cc3d703-f60d-4ae0-b65f-a3eab3004884", "comment": "Malware payload (AgentTesla)", "value": "dd819f7a97a91010920c8cfd0634058a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143601, "uuid": "ed7be14f-e763-4ce4-9cd0-9eb8edd4896a", "comment": "Malware payload (AgentTesla)", "value": "2900a8519c935b8692da1898a84d47d8310480805620664e8e6f5dde3d2ff918", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143601, "uuid": "56315263-aa9a-43b4-9f21-f3797830792e", "comment": "Malware payload (AgentTesla)", "value": "716d53e5e014676b7339808d8f28467c86d9d1f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143601, "uuid": "76f86717-36fa-4580-8a42-2a1c69d4c68e", "comment": "Malware payload (AgentTesla)", "value": "7d9f3101405a65a8a56958eb05bd9790c0af0f5ee887c6ec9f26070e1660fe73f9bd5fa693d1633e9e984926cba36495", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143601, "uuid": "127c6a89-e9a8-4823-b3b4-c36f25ad29a9", "value": "T154D42339541D5271175F6BE074A71BA0CCAA21748BDCE738DC44E72849B5FBB0D2BC19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143601, "uuid": "6549bad4-5ae8-41a3-a5a4-7c0c3d5a0a46", "value": "12288:x1fB3OMZVSQeswyXU820tgMTvSE+oxrHRYpbfnEGI3N994mug/y4BtZG3L+IbcES:xj+MWsbXU8jgS39rHRW2NkAy4BbG7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709143601, "uuid": "6cb55cfe-44f6-4cb2-96c6-3cce8e76459a", "value": 653102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709143601, "uuid": "0a217041-2eeb-443a-a4a8-a91860ea6241", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143601, "uuid": "b0ba7989-47a2-42d4-bc07-be5936a3e3d9", "value": "LPO_QUOTATION PG2024-02-0170.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f6c1a34-d60a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1709105080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105080, "uuid": "49352019-728f-4878-a4c2-5b25bec6bd52", "comment": "Malware payload (Adware.InstallCore)", "value": "35311acb28048db824f385f14e09cd3f", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105080, "uuid": "ec17c986-7c41-47d0-9c72-844c639bb1e0", "comment": "Malware payload (Adware.InstallCore)", "value": "29e773c3c25f16b28fc92adc0aed9761e56f5656f15b17106099c1b0f5439053", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105080, "uuid": "21dbdc3d-adf5-479d-89a1-5aa7acb15175", "comment": "Malware payload (Adware.InstallCore)", "value": "2b9c9bc9e8e06d87ab78db022d07b287745e359e", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105080, "uuid": "9a6d1aa6-1e80-4530-8ae1-e25d48b807db", "comment": "Malware payload (Adware.InstallCore)", "value": "c900cf5aa5e78ec2c221cdd592e0e3e9bbf21070dcd1f47a6685c7bca06d486a783bc1227c23caaad196ecf153701c3e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105080, "uuid": "7657ef7f-e9fe-421a-8534-02deb9e72684", "value": "T168863354E2492EB1EBA171F08843AA1159067D164EB1455A30FEFE3D6F36B83CC9A43F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105080, "uuid": "785e7373-a6f7-4b2e-ab0f-77f3099dcc5a", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105080, "uuid": "a1b7c55a-27a0-490b-a58c-39a5b4153190", "value": "196608:v13JWRBO1jt4zyFKX1PRqsBXib06rpdl+:tZWRBO4x3qsBSDTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709105080, "uuid": "22218fbb-c7bc-4f10-96ae-fd8396df95e7", "value": 8222217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709105080, "uuid": "e3b265c2-1b0c-44b1-9cc3-b11d8c497dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105080, "uuid": "3f7187ef-01b8-4263-82d6-b53efe8c8fa4", "value": "SecuriteInfo.com.FileRepPup.26984.19735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8a9a137-d644-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709130221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130221, "uuid": "3b8adab8-51d2-4c4b-acfe-c1cace7f0bec", "comment": "Malware payload (GuLoader)", "value": "d844d1877e456c98d39c5ae4b5afa005", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130221, "uuid": "a1318e2d-1049-4043-b31e-ada41dc97b70", "comment": "Malware payload (GuLoader)", "value": "29f63518032bfeb419cea2e5fb207fd324a9928b762532c5864198ce6ce30b8f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130221, "uuid": "25102dcb-5c2f-461c-b665-1c7e4faf56dd", "comment": "Malware payload (GuLoader)", "value": "dd398afb0845afc4b0b180534f06950c500b73d0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130221, "uuid": "69d40f10-e6fe-40f9-ba9a-4e6d435851db", "comment": "Malware payload (GuLoader)", "value": "f0bfc29abbd7fd41d75410eb0b2d111702a9f04a5a746e3faef3211988dc6fb3831d7efec43bc732738c098d2c41fc1f", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130221, "uuid": "73fc4d45-2d42-465c-91e9-382c24cfd02b", "value": "T141833CE3DAC5261886461AB3EC1747738DA400AE3B031F3597BCE66D5483A4C96BFBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130221, "uuid": "2cd17438-2d33-484f-83af-507c7411893a", "value": "1536:UO+rAQgFXLEvvR6op8MiqKkjmyJ4BXwljIW84fEeHPD:UNcQgdLEXR6Y8MiqKkjmyJyXUOKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709130221, "uuid": "22d815fb-394a-4ada-a4cb-700e7a729fbe", "value": 86576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709130221, "uuid": "f1c646ad-1c06-4a59-a009-f552d56da2a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130221, "uuid": "3f9e51d9-e9ee-44e7-9ac4-928cacfe3984", "value": "nPO-519192411.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a96a888-d659-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709138975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138975, "uuid": "4a1344a1-4007-4d16-8274-3e841d546919", "comment": "Malware payload", "value": "f8c4a5644e4e5462db1f11122fb9d39b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138975, "uuid": "7e44e832-1719-459c-8b9a-26ee24b46a4c", "comment": "Malware payload", "value": "2a198d754b7d1eece1cd2cd71892371149b8d9e13227e70fb9f913cd81982982", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138975, "uuid": "44933bac-b552-42bb-8d2c-90ba50c0131c", "comment": "Malware payload", "value": "b71fc1dc388db7b91bc15221bd207bde2c3bddc2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709138975, "uuid": "28e73e40-6990-40a8-a7ac-389105b78079", "comment": "Malware payload", "value": "b0bfd6fd865ac94996cfcd9fcfd3394fbfa97aaac621b4d385514859b550791fb64703c1839a3cdf4b1c79509ab5bc87", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709138975, "uuid": "8bf29e91-d8ac-4762-9fa6-3e7b71070150", "value": "T16C43F168056F6935E6C2D479088E02FC5770589D87B1B2DE32A833BE3982CD512E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709138975, "uuid": "cefc2a9b-0deb-4dd8-84c2-21b75fddf3ee", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehO:BoOAcw7nXDUsOjm3jTxhO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709138975, "uuid": "69d1cbb8-3b88-4f12-9663-fb3b8639fae0", "value": 56841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709138975, "uuid": "5e0db25e-22f2-46c3-a1b7-d869bdc138d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709138975, "uuid": "0243f266-a25d-4b1d-8ae4-e9143871c1dc", "value": "scanned_doc#2024-27-2_9529.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7952ce84-d677-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709151911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151911, "uuid": "5a7f7e6d-f440-4fb4-8482-247bd7c2d5af", "comment": "Malware payload (AsyncRAT)", "value": "a4ddde2d6e9370b5cc5572f97eb2071d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151911, "uuid": "a1b632c1-85b3-4d02-9c7f-512bd2f45fac", "comment": "Malware payload (AsyncRAT)", "value": "2af994c5d5625be98c89248dca5bce26a40debf6b3c7b3b775a5ae916427a18b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151911, "uuid": "222c7faf-f3ad-4cab-a6e1-b228cc4737d6", "comment": "Malware payload (AsyncRAT)", "value": "ee88603b9e64f3af4de73a3a5f6f2676a84dafd8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151911, "uuid": "a7db0680-620c-4d41-b8d5-61a2579d4f46", "comment": "Malware payload (AsyncRAT)", "value": "d01aef87f0f01ab3af52b27cac4811c3e6cd39b26162abfc895801cac4ab025b1389a711b6766a3d7d3b510e7428948a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151911, "uuid": "7d41a64b-06cb-4586-b578-16d779e10a53", "value": "T19CE3CE4EB780DE27D28A153A1DF14C291B23D84B0AF6F31B114D772D9B62FE87059693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151911, "uuid": "4fcf3038-576f-4988-8547-3fc7978216b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151911, "uuid": "57e57a9a-cb19-4488-95c0-6eab22d19a99", "value": "3072:FiGpa7x6bEGuXYEzNfRWtA2zvigEyapFS/b6JQ9LaeMR:FiKa7kbwoEZqji9i/6QnQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709151911, "uuid": "fc6ca4d5-4b93-4ddb-8422-ea1d1f570096", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709151911, "uuid": "d65e86ef-187a-4fa5-8c1b-994ee95520d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151911, "uuid": "7d81ef4c-5ea4-4851-ad04-f0ffd0966c06", "value": "a4ddde2d6e9370b5cc5572f97eb2071d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abe700e-d5ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709100428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100428, "uuid": "dd779932-79f3-4174-b1f8-167abcb0440b", "comment": "Malware payload (Mirai)", "value": "e00a0f16c145d039dc3050c737569c71", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100428, "uuid": "aa463806-56a0-484d-9234-ef2745215de7", "comment": "Malware payload (Mirai)", "value": "2b5389ccfc733ec3477dfa9e4d217d4957552905c611d1afce8c602824c2fbbc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100428, "uuid": "668b912f-f0fe-40ab-babc-f74cb17efabf", "comment": "Malware payload (Mirai)", "value": "188c9b1a6e027a475c6c16176460974f4cc253fd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100428, "uuid": "a7089f0a-9b3a-4337-b31a-696fcf74eecc", "comment": "Malware payload (Mirai)", "value": "dc925fb94281597fd0751066dbf765f99a0c4ba4b9459e2077d4efa994a00e891433938d88adfa5ee9966fb3845ad776", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100428, "uuid": "d3b4b510-75b4-4042-aba5-0fe56dfe9c03", "value": "T1B5B3D40ABF610FF7E8ABEC3745A92B05249D514B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100428, "uuid": "ef7f1b76-7a24-4e2b-a8ff-a12d39417f91", "value": "1536:g9DYWFx+xx+AaEPiQMR2jk2EkZ+BzYtjKoOvDBgplbngVZ14hvG:gqWFx+xUA05R2hEkZ+BypZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709100428, "uuid": "5c5ab832-87fd-4e71-8768-83a8ae77c72d", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709100428, "uuid": "69d8c227-bd48-42a3-9442-6f76b96d22e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100428, "uuid": "f1e9a90f-3bb1-457b-88df-2f0ecafe0094", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f996de7-d603-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709102020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102020, "uuid": "c390ea49-2a0b-4b5d-8564-0548a05d9150", "comment": "Malware payload (Formbook)", "value": "3da716e7be62ce9f345c37c84fff8ed9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102020, "uuid": "e0313686-a0f6-4d02-905a-79b5340b5248", "comment": "Malware payload (Formbook)", "value": "2d450cf09b7158d5036e1e8572f9b0327d70670f0238ff963cad00aeb9020625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102020, "uuid": "93410b39-5f2c-4c06-8f8c-feb51abaa11d", "comment": "Malware payload (Formbook)", "value": "aa92605e8ffa40546407975c7f50f3abe7e3fa67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102020, "uuid": "3e9938f3-ba2c-4137-bedb-7faa6e2dd91f", "comment": "Malware payload (Formbook)", "value": "5e29318be6af3cd3693d6894bc37c013fb1f1e994887a27c3224fb5ed93b0bc9ebb048c751b2829ce4510c57c7562419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102020, "uuid": "5fbb5db4-837c-460b-ba89-9a7af076adf3", "value": "T153E4BF4DA3204297F0492B79DA7D7E1902201C7C75D2EBD4B56A762BEEE1BE6143302B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102020, "uuid": "c11fc5e6-c54c-4cc2-9177-68cc61b859e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102020, "uuid": "de2d3c36-f9e3-4ef8-b11a-74936b9e4c1f", "value": "12288:izNwnqs3y44sAGcprVjQSwMQTKilCj5If71Fs0576ivpVA5wN8wWEACrIYgI:HnPAGcpx5wMKPwC1Fsc76iv7BiC1gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102020, "uuid": "5960ae09-4e47-4daf-a154-e196af4668c8", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102020, "uuid": "b1324ddb-c50b-4e7f-b2d9-d7dd2684cdc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102020, "uuid": "7fe2f35e-99a6-4d88-9ebf-f66aa4a71b18", "value": "Confirm!!. PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0060ac28-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156863, "uuid": "aef786c9-9e54-40aa-ac4e-078b431c5912", "comment": "Malware payload (Mirai)", "value": "d17e290db716fd2cd7b74daa9f208d4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156863, "uuid": "7e4a03b1-983f-4aa6-94e5-ec1f2c56f174", "comment": "Malware payload (Mirai)", "value": "30497382cdc4880a2fc1ec24c843aed55df0f3ace7d8adb583c8ae81db1c7141", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156863, "uuid": "34ee2286-3fbc-4bd0-afd5-a202022f2e12", "comment": "Malware payload (Mirai)", "value": "ba0962649f90e1aab9188b114703cfc0b943d70b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156863, "uuid": "b60a3952-f538-4dda-9d21-ccb4532f76a4", "comment": "Malware payload (Mirai)", "value": "923b80f7e8a9533371b322b9855ae7e2a74d75e7b64222729b3be6e70d2ee531cceb811baa54cb56b7e749187494243b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156863, "uuid": "d266ceac-c43f-4a80-ab73-41fe939ed77d", "value": "T170632956F8819B11D5D402BAFE1E118E3323177CE3DE72129D20AF2077C6A6B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156863, "uuid": "20d07252-359c-4379-bd66-3211f7c5c54e", "value": "1536:r4nmc6wXDLMguTE6VyH4aBF56cI3ixC9Hni3Wry5GY3b:7wzL9I24aZC9Hni3WrycAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156863, "uuid": "d7fadf4f-a772-43b0-9151-87a967d26f76", "value": 66948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156863, "uuid": "3ee38167-5fd9-4599-9ba9-82e3e15d2e8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156863, "uuid": "ea8bfc30-fd17-420d-8996-2e05c29e1c8b", "value": "d17e290db716fd2cd7b74daa9f208d4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a66441-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145025, "uuid": "b0c913c3-3507-46c5-9818-d670e6283b8c", "comment": "Malware payload", "value": "3744d4fd7ba093923174696b56d05f9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145025, "uuid": "3baddb8f-528f-4106-8931-35bb8be1f946", "comment": "Malware payload", "value": "3101a828d70c878e777a15ebb522b6a2f82e30fb2217ce66df0f161a57656301", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145025, "uuid": "81db431a-849e-430c-a879-e928c260bf95", "comment": "Malware payload", "value": "f5ce183eae50c86baae034aed1ce11c0ad15fecf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145025, "uuid": "6b34ac51-b23a-4fe0-b83c-f89eba7c470d", "comment": "Malware payload", "value": "828307f558840148fa0bc9ef68055a41ff1a0678209e78e74b77d48f47c752557c376ee498dce2731e8743ce6e5d4b80", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145025, "uuid": "bb94c3bc-a247-4afa-b64d-d21718cda0df", "value": "T109F28D166B24AC1BCE8E8E7474C809325A70E3657991CCD36A68C2E5CED17C127B91FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145025, "uuid": "8c1e2bfe-766c-42e3-808f-f1cbf4d5aad7", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145025, "uuid": "7f92f083-6d5d-4a7f-8495-988591398267", "value": "768:3/ImTZNNBGXjO9hwjLZEJPx4SjL8PxWEY9iYX:pT/u6wjwPxvjoPxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145025, "uuid": "2737f240-e539-4a09-8601-4a0cb4bcab7f", "value": 37096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145025, "uuid": "c6cfb225-c140-4e19-bdfa-69835426bf7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145025, "uuid": "e6e3c58f-66a5-4eb3-8264-3e881676cf62", "value": "SecuriteInfo.com.Program.Unwanted.5492.32511.824", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "085f10b8-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156876, "uuid": "f914cd49-e2b3-439e-9306-9db37fbf0ad3", "comment": "Malware payload (Mirai)", "value": "b7c2dcd3553491bd7e8584d3d0ad43f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156876, "uuid": "d72b42f0-fe35-44c2-9c67-00ce131e0eed", "comment": "Malware payload (Mirai)", "value": "322cfa5edf8bba225579810f5c9ba3d310da16ac1e53a51df666a2825c4d08af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156876, "uuid": "07bd86ee-11c6-4959-acea-910cf6e99d0b", "comment": "Malware payload (Mirai)", "value": "17e32ecb86e4ba85b94d18492c905c60cb690910", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156876, "uuid": "edf16ff2-fced-4767-88f5-ef7fb1f46472", "comment": "Malware payload (Mirai)", "value": "30ae62e4bb924ad0309f84185d3db3fa7e2b772153a3bb48222d19b790c8b5d8ebad9f686a9e46c74ebba453fb7310d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156876, "uuid": "01d55eae-3ed0-4f63-9c89-c76c989a5fad", "value": "T1C5237D63C829BE48E54C8174B4248F781763E154C25B5EFB1A9AC279C017EBCF6293F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156876, "uuid": "a626cc7c-5fdd-4ed5-a187-c6ed64335852", "value": "768:AaLbWA1fwtyE6eapzfqEDI/qQCIkhKZGqpaVMonKIIVzCp4OpUfiWFBI:AaLtwty9pzfLk/qQcKZGqEhnKVzCpRWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156876, "uuid": "6773d906-72bb-4932-9bac-dd068832169e", "value": 46892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156876, "uuid": "f85bccfc-e176-43a2-8fff-d5314b02477e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156876, "uuid": "746fc296-41cf-4a4b-bd2e-87090ace85d2", "value": "b7c2dcd3553491bd7e8584d3d0ad43f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dad961f2-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156800, "uuid": "31800230-9325-4934-9eeb-b738c7367275", "comment": "Malware payload (Mirai)", "value": "7edc6e9af75777d4f433db38c5f72d1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156800, "uuid": "ba38356f-8365-4516-bcc6-f5b4283c676e", "comment": "Malware payload (Mirai)", "value": "32fb754a96f3707c9edc57d29004dd3c8bc1fd100b74bf11812a1dc6ac7291bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156800, "uuid": "75b03598-7bd3-435f-b1bf-265d586caf86", "comment": "Malware payload (Mirai)", "value": "2d1b4675a8da290ee8ac3b2953b278c310ea1acd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156800, "uuid": "fa3ac106-2c6d-4fc3-a297-f40a3f264583", "comment": "Malware payload (Mirai)", "value": "ee9b2ac254f76fda4908b861f89a117581c51bab23cf6b7ead9dd5da0d606ef071ff0d024e0af466207a8fb8b2e5b47c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156800, "uuid": "83d4f97b-81c3-498d-977a-89b6167c6622", "value": "T10D333B91B8C19A13C5D052BBFB6F028D372667A8E2DE33139D226F1177C6D2B0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156800, "uuid": "6510941d-693f-48d2-be2f-ae743b9f4098", "value": "1536:bVab/Nn7ioP60w92g+AELwt3LWj+g0//Y:ha9A92ghEMbWCg0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156800, "uuid": "9e8291ee-1fde-4303-8fc8-3f469252fc87", "value": 53032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156800, "uuid": "861723a7-fd3a-4d8b-be5f-c1e1be6c5cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156800, "uuid": "874aef36-b223-46ab-b2a6-6c4a21e4e321", "value": "7edc6e9af75777d4f433db38c5f72d1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84526075-d603-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709102108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102108, "uuid": "2090d744-6ef2-448c-babb-d3d8b222d293", "comment": "Malware payload (RiseProStealer)", "value": "ee51a656a02c2762825ebb50e00ae8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102108, "uuid": "3a883465-28de-4e62-b8af-dbc1f7eebd9c", "comment": "Malware payload (RiseProStealer)", "value": "333cb24e4c4eaf5768046651e18db25e540bcff4d6b7a48e0b021fab33858821", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102108, "uuid": "e2b0184a-39b5-420b-8ee8-b8003ed281da", "comment": "Malware payload (RiseProStealer)", "value": "36fff7d67192056c3901ea39b7dd544dee6e9511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102108, "uuid": "d435e006-6ce8-4239-8f18-c3bdf1719da8", "comment": "Malware payload (RiseProStealer)", "value": "16ac12916836d8745ed31b57920310872ecf15d834204def3d7c60fca918364bf71d097d636056081dff72fe69f7945a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102108, "uuid": "1a351ce6-b058-4fd1-a95d-fa38538c63d3", "value": "T14AB5333072410B18D61C64B0954B071BE76779A50AC7A739B149FDE13F2B073B4AEAEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102108, "uuid": "1756159c-3a30-4c2f-980e-4de24ce549cc", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102108, "uuid": "c264fdd8-e760-41e0-bde0-1add4dddbe8b", "value": "49152:j6BekJ0YTEEBIHlvZGFd+YoeOhmBb7u22uVmpcBfc32Xf1Evq:j8mYTNIvQrXOwm2BPNu2X6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102108, "uuid": "35ce0fb3-90a9-4083-893f-6ae6522a9281", "value": 2381824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102108, "uuid": "116fab3e-0b7a-4e04-be47-8d8de3276bcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102108, "uuid": "9e38a181-42c8-4c95-b45d-748ca91fe360", "value": "SecuriteInfo.com.Win32.TrojanX-gen.19416.32475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37de88ca-d680-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709155667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155667, "uuid": "8dff7413-867d-435b-a2c5-9cca82108a93", "comment": "Malware payload (VenomRAT)", "value": "2e8a03bcb8e001b299d41930508b3434", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155667, "uuid": "fd8fa2b3-b545-49a5-8db3-295fd151f2de", "comment": "Malware payload (VenomRAT)", "value": "34b3960a416bede381df24f25fc31efbd7eaed5338f9b0ca4bc285ec8ecc6081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155667, "uuid": "fefa8ee0-8825-4bdb-9e42-b313a4ade17d", "comment": "Malware payload (VenomRAT)", "value": "2983514d4101e43f365991db94ad2dec68cd990d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155667, "uuid": "0cee35f3-e88f-405b-a1d9-1ccfb1d077b8", "comment": "Malware payload (VenomRAT)", "value": "21f2cad058cc449b9e51666f0d675d57a488d3392709d19bb819687235cf7fed59037041498c9e79614736931b11a8a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155667, "uuid": "fcf14834-023d-4563-b6ab-eb97f91778ac", "value": "T192735A053BE88D26F2AE4BB9ACF251074EF4D5576512CE4E3CC800DD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155667, "uuid": "33aabcfe-f095-40d4-b39d-b8f4aefc7c38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155667, "uuid": "7517dd29-94cb-44a5-a960-271374fde160", "value": "1536:crULkcxVKpC6yPMV2Nqien8I8h1bq/oi/eKuQzcuLVclN:crUocxVENyPMVkqzah1bqgixuQnBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155667, "uuid": "142bd1d9-2dab-4d8f-9635-f192c846f2ae", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155667, "uuid": "2c457aec-805f-430c-b664-28d09b8a4968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155667, "uuid": "c8659c5d-babe-41e8-adfd-c412c997f2d5", "value": "xYqZbVF5pKV0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabadfa5-d60c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709106146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106146, "uuid": "a57d3c7c-af0d-489a-b889-b285d69095ac", "comment": "Malware payload", "value": "be0e1a0f7c01d1eb2ee5c19adaa4fc3d", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106146, "uuid": "cd1245b1-938e-4269-a580-51a43cb618b0", "comment": "Malware payload", "value": "3544b8e2da4fa50c613219b6bde107fefd74ed7200fbcec72c7e3fa9528bb616", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106146, "uuid": "d35b0c38-2eef-49e9-b75f-790b9f43cce0", "comment": "Malware payload", "value": "53fb03af32edc85adcac8f33766954517a719e28", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106146, "uuid": "63031680-3acc-4e5e-88b4-1727f0614145", "comment": "Malware payload", "value": "fc98fec861be6c47b68148e1bec33b10f0da04c033259241960142cc4f0fd01de4f66b00cca80c0983a9b910df43ed79", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106146, "uuid": "13339a7b-f889-4f2a-8191-64d379727c87", "value": "T1DD43F268056F6935E6C29479088E02BD5770585E83B1B2DE35A833BE79C2CD512E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106146, "uuid": "710d465d-fa14-4a11-baec-0a6e2e6465ed", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehP:BoOAcw7nXDUsOjm3jTxhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709106146, "uuid": "e50c71a0-9ad5-4a3a-a67d-5096d46b0fa2", "value": 56842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709106146, "uuid": "d76025ea-c8e2-4898-b8a3-0da173558a1c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106146, "uuid": "43d28462-55f5-4f7a-adac-2072a84d24ee", "value": "scanned_doc#2024-27-2_7062-be0e1a0f7c01d1eb2ee5c19adaa4fc3d.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04189f3c-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153862, "uuid": "daff4731-1bd6-4b5c-9b96-b3d9508f34e8", "comment": "Malware payload (Mirai)", "value": "09ca1921c15c8c8efedaf2d76ad1402a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153862, "uuid": "bc573c27-4686-45fc-9bb7-28412d6db1d3", "comment": "Malware payload (Mirai)", "value": "3638c9e10396730bb08613ae993e65b0898d6c702d07737c4b664b825314f19d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153862, "uuid": "f32ecfbd-a3ea-4c06-b7b4-41cffde3b3cc", "comment": "Malware payload (Mirai)", "value": "67338d8ca61b549edc9bb32de071e456fc2d643a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153862, "uuid": "db253023-f340-4260-af7b-41b51f7d7c14", "comment": "Malware payload (Mirai)", "value": "54c36841d5a14ea8fa326c172f231b810ad18e0b79ef466c40f613457d6449f14a8d65874cdd4b646e27792ad3aa417a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153862, "uuid": "ea2269cc-7b90-476d-a317-f524eceaad0f", "value": "T135B34BE3FC10DE7EF849D77744570A09B530A3A40EE20A37B35724ABEC761D85926E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153862, "uuid": "c3c3edc2-b236-4d15-a191-6d373d5ef1b6", "value": "3072:KXop5jhN7y9m9UR+J3bjEWhKp2jqEsqyVz88:K4p5jhN4OgqwaqkyVA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153862, "uuid": "44746a82-e2d3-45ca-9a06-1ae04d52889f", "value": 109480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153862, "uuid": "6e9010a3-7f6f-4216-a110-a4c598c4725c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153862, "uuid": "3957fd56-6c1d-4a84-99a3-c93429d2a538", "value": "09ca1921c15c8c8efedaf2d76ad1402a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65d56004-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709139423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139423, "uuid": "0f5c149c-9b85-44b4-b1eb-0986c06f7a35", "comment": "Malware payload (AgentTesla)", "value": "5af5e4eaefb3f39b14d69c1decacc699", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139423, "uuid": "fd9f7d47-2b16-4d43-81be-10e4587dd9e0", "comment": "Malware payload (AgentTesla)", "value": "36d0de64d749c1b1dff2b852b629ee5809b3d6cd1cd849d953d059138c7ea2a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139423, "uuid": "099d8e56-8cd0-4303-9ec9-4846344ab78a", "comment": "Malware payload (AgentTesla)", "value": "f974678de90216dc85e9b37ceae8478a04c25b25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139423, "uuid": "31658fb4-2e49-4497-854e-f6dc826fcf36", "comment": "Malware payload (AgentTesla)", "value": "59f48520c117632ae6381890b5f8acb021df19d133a9030032f0377b64f834a892627269af333657f2c06c5fb26d5829", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139423, "uuid": "8dc878de-0272-4476-92bc-98c545551d62", "value": "T195E423AA048D1F18E5D2D1BB66FC0170BEA071873C9D06ECADAA066C466577A309FC5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139423, "uuid": "74c4fd23-a0e2-4d6d-9589-93d78ef2e2ec", "value": "12288:DEPOaEE1m2lQugw3o/Vhmq7XXWavxEoA9t/QWgQafQ1wxyUz3x+5A:DEGaEE1mqQQYUFpzUrgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139423, "uuid": "5e95365f-3743-415f-8e58-b144f6efcc3e", "value": 688712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139423, "uuid": "aef24040-1bf3-4ecc-b241-843ddb71e5b2", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139423, "uuid": "5e73f7cf-c4a3-45e7-b1f1-9b009236afe8", "value": "PO 0000010231.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da295ad0-d688-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709159375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159375, "uuid": "bd041b13-65cd-4e4d-ae53-6219f2a5ac75", "comment": "Malware payload", "value": "153d4535be416ba12af411ce55f55e12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159375, "uuid": "a4ada113-6443-459d-8e88-002fe7ef457f", "comment": "Malware payload", "value": "391d0faf57a230b6e47debe38a9d2ba2a794b29713468e1a8c9917d79b8b636d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159375, "uuid": "921e52d4-fbb1-41c1-800f-a6c9c85f9db8", "comment": "Malware payload", "value": "70185bbc674a4c4396af613a14ec270a1441655f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159375, "uuid": "8b0dc136-6dd2-4e6a-953b-cb8d9acbc4ad", "comment": "Malware payload", "value": "bb937f2a27e23cb063242a479f4116d2912d481b09a2b535249b6c122cd07124fa511697e26e629fdf624d449045afb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159375, "uuid": "85249623-ca84-4f6b-ba66-33c89a447cdd", "value": "T1FC9523235F6DCE94C1481CB080D4DB24BAFA96A13D988D73CDA6AD2BFE311CD754A472", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159375, "uuid": "988e3332-c9fd-472c-bade-e7d1f049bd3b", "value": "5e2da45c5591cbc827ecaf03198ed17d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159375, "uuid": "ef794185-88ef-4085-afa8-d0040d205ee4", "value": "49152:wEpCX6SB8gwp3jHrkxxzCeX8eKGRf424IFNt5vLhu/hkJbcOsUb:lw8Fp3XOCe5KGRJ4IBi/uwpUb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159375, "uuid": "52f2808a-3bd7-4190-ac68-b26e7fa2a122", "value": 1948160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159375, "uuid": "cedc6ce7-3e38-49ae-be47-ef1234c96c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159375, "uuid": "ae4f9bd3-f295-4774-b12b-7753479d79a8", "value": "SecuriteInfo.com.W32.PossibleThreat.9762.18095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7c57f25-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156848, "uuid": "3039af59-e3d7-48e8-991c-07d5e275acf8", "comment": "Malware payload (Mirai)", "value": "e3a459d0b54bf9ed2f316dabc6ceead7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156848, "uuid": "cf80681a-9655-4fa3-a675-8d5b4a5274b4", "comment": "Malware payload (Mirai)", "value": "3972d39a2136fdedc0167e47e2dc0011632985240b86f78b14149b7197abdfaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156848, "uuid": "1bf47589-32ea-4f1d-9704-6dd72d774ed5", "comment": "Malware payload (Mirai)", "value": "0d6a01ebf276b51b2f78ac2a4fb5db566c8210a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156848, "uuid": "8092ba89-26ad-4904-8a56-3dda0a1d7218", "comment": "Malware payload (Mirai)", "value": "628324df8bbebccce84ac3ff7fed1d17de2c94df81fba9d1744a965f12f7ec5d46ea5ba4197947f59286bcd77469c1e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156848, "uuid": "a51f2c61-57e2-49a0-a261-407253269c42", "value": "T1CB835CE5D2C3DCB6E84200BA306BAF32D733F67A4067D786E3986D359827905921735E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156848, "uuid": "f7e3288d-2d9c-4e9b-adbe-1cb646b3d0b1", "value": "1536:7J3SzFxJIDNGeHCtWdj7GpL0fTDdFEMnb5YOFv2wjrgOLVFgg5:7J3SzFxJIRVicdj7GR0ftWM1YOJ2wPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156848, "uuid": "fdee9430-3681-403b-86d7-22a044819b79", "value": 87180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156848, "uuid": "f38ff3b7-fc0b-4032-a4e1-90d945fdc234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156848, "uuid": "aeb9443e-4d8f-405e-8aea-44953de919d0", "value": "e3a459d0b54bf9ed2f316dabc6ceead7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2074c102-d633-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709122557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122557, "uuid": "ce353a67-7ab0-46be-a78a-5f32d3d179cf", "comment": "Malware payload (Formbook)", "value": "f2d4dc4b906957f752eea63074e5e449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122557, "uuid": "7620f1c1-74d3-4f8d-98ac-7015873be635", "comment": "Malware payload (Formbook)", "value": "39ee7792661a34ecf6a0ffd3a32e97322935414389849ae1193ae05575de42ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122557, "uuid": "418dfc9f-db4a-4e48-a7c0-7a4631241589", "comment": "Malware payload (Formbook)", "value": "8739ff8013bf71ed68b057934ac27e46dcd08133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122557, "uuid": "f743636f-8886-4e7d-975b-e76c3b180841", "comment": "Malware payload (Formbook)", "value": "42f3c3ed9dfd40bb39ac1604f02c10a5dcf3da93d4d13e1e00e1c82f999710ba9cee8f0d064777e0bd5625168b54461d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122557, "uuid": "9845d054-5aa1-4f3b-a2b7-7dda280a6bf3", "value": "T1A835CF1373DE8361C7B25273BA257741BEBF782506A5F96B2FD8093DE820122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122557, "uuid": "7d58180d-646f-4f17-8fcd-13e2c1ade384", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122557, "uuid": "cebe411f-77d2-4242-aab8-87ca0c1f68a4", "value": "24576:otb20pkaCqT5TBWgNQ7a9cvBBYVHIQf2jyayUQ6A:xVg5tQ7a9mqoQfOJyN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709122557, "uuid": "0c8245be-fecd-45ad-96da-2be903b6b567", "value": 1158656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709122557, "uuid": "1f72f69c-a318-40ad-a5d4-a054c1b59d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122557, "uuid": "d33aff3b-bc78-4431-8819-6a07b04e33eb", "value": "rbankpay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fd4b51-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709128277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128277, "uuid": "92063620-0ad6-437f-b920-32d0349890bb", "comment": "Malware payload (Formbook)", "value": "0bd3ba54e625948b9378c9ff8f2905ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128277, "uuid": "e06b7d78-0f4d-4d52-bec4-a1487f2518bd", "comment": "Malware payload (Formbook)", "value": "3c2e45ec9a4b0e3b05b964f8cc1b5a124101e223aaad08f060c90e9140a34377", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128277, "uuid": "693b1704-a32b-4c94-925a-52224d9750ed", "comment": "Malware payload (Formbook)", "value": "aa2de74b5fdfd4e92bd5f8ee46b4cc2768d5b6b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128277, "uuid": "d8d3d24e-2954-4f5a-913c-4ed8890dcc83", "comment": "Malware payload (Formbook)", "value": "f7076b426acc03d6c5ce308a1dae09baf8ee614cac8f22cf7e81e1710cb8bdfb5c91586482f09eb6783aa368cddbd823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128277, "uuid": "c58f0345-f941-4d02-896e-1264917c8d16", "value": "T14BC42392A6D4CCB2EA623331C17BDEE016687D31CECA7B4D47D5E11978723436886B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128277, "uuid": "5f30c2ba-c439-4c9d-961c-c3c9bfc866d8", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128277, "uuid": "3bd91fd4-2d48-47d2-b021-7797aa72b932", "value": "12288:VOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPin2Acooe1GJqAAdR5VOkO:Vq5TfcdHj4fmb4HTbr5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128277, "uuid": "cd93635f-669d-43e1-b0a7-00d8499a7766", "value": 591360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128277, "uuid": "7d24a2c3-7a72-4406-a1e4-a924ea0de9b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128277, "uuid": "d4b6f86b-5ddc-4249-af4b-b435c624158e", "value": "Orden de compra 0001-0025545456745869768968.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f23a9b2-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145022, "uuid": "e4519ecf-03b2-4a2a-9faf-4ad41de46a2a", "comment": "Malware payload", "value": "631228c0e20b6c52e70e5afe0611eef8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145022, "uuid": "38a94f39-7cb7-4bf0-8d15-1cc919fd5d3b", "comment": "Malware payload", "value": "3d1a71511d53a680e85711eb6ad628cc21c226aa4b798b667277ce956b740a1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145022, "uuid": "dbc1f22e-7cd0-4b55-a412-9aeca2358a5c", "comment": "Malware payload", "value": "b856b5aa71d71657c61785fb55f89a58b972d87b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145022, "uuid": "70641566-a9c0-461c-beb6-afd674b80413", "comment": "Malware payload", "value": "9120209f2614bf71c522146953e3d856198f3d9652c7441f08e512849f480093519d0f8c7afc4438a98e214475ee933d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145022, "uuid": "b27d3c12-721b-4237-a9df-071771be99c5", "value": "T1CA95180AFA7581E0C4BAD079C5A3666AF8713C4987309AE35746BF1A1F333D1E93A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145022, "uuid": "cc78f6f1-e27a-4d97-90df-8cc80e9b844d", "value": "e99bbbf2c71e32ec28ec8a86aac5e1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145022, "uuid": "f4b7c52b-2952-4158-9282-bef32c1334ac", "value": "49152:V8YqJu7nAuYMECIycFpw6RvPl2TaVdxPs9Fvcw5OZdiuo7j81XUO:e7eukj8WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145022, "uuid": "91000e4c-0972-4a9f-96da-dbe7ba6c5085", "value": 1899320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145022, "uuid": "73c546d3-2f34-4901-b48f-cbc9cb681eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145022, "uuid": "bd7ecdc1-926c-49e3-8a32-36ac37bc8096", "value": "SecuriteInfo.com.Heur.16207.20001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50c8536-d5ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709100445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100445, "uuid": "2c47d3d4-2dc3-4b5b-a959-e744a7fe9629", "comment": "Malware payload (Mirai)", "value": "76b3e24f313cc27132b7c1da3fdeb463", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100445, "uuid": "3f1be846-4e46-4aaa-b8e2-4e411e78a637", "comment": "Malware payload (Mirai)", "value": "413d50ec85dc5f37357877457e48a3eb40363d758e893825f00e67652d0701df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100445, "uuid": "3da937fe-2f8f-4fa2-b4d2-c97d61574209", "comment": "Malware payload (Mirai)", "value": "fd97715bbe85042e80cd9d43392293859899d083", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100445, "uuid": "1e98318d-011d-49a4-864e-b885f12b3dbc", "comment": "Malware payload (Mirai)", "value": "cfe518039a86290c87e5fc1e8433f1587cb490f3f9f42fa9e9034882c5109c91fdffbef32f131657847e64b92f025372", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100445, "uuid": "e5a4ce5d-5411-4e73-8bed-893f7ec76e46", "value": "T1E0F33C46EA418B13C1D71776FA9F414A33229794E3DB73068D286BF43F87A5E0E17A09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100445, "uuid": "ccd8411d-c34e-481f-b6d1-de3b2c6e85db", "value": "3072:1rESqsihvdhMp+JtKXaRGLKW3Sfz8azYEBPFsleM/9q+tM:1rZtihQwsXaRGLKWCfXDBPFsQM/9q+tM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709100445, "uuid": "a8ea43e8-c458-42b2-9951-6efc8d34dcb1", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709100445, "uuid": "22908333-e701-44d0-a28a-e408aa60b267", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100445, "uuid": "76e409b8-30e6-4739-835d-a28e7c3ca103", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac91261c-d635-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709123651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123651, "uuid": "8f0e4056-f315-4161-823e-e248cfc16520", "comment": "Malware payload", "value": "6c3805ee08951c0b99329868d6c4d354", "object_relation": "md5", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123651, "uuid": "a597e43b-ad05-4435-aee5-4c51379c5969", "comment": "Malware payload", "value": "4197865c9a6889e017a0dee2c7ba0023896a59a0bf769695d18afb9ee6fa25d6", "object_relation": "sha256", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123651, "uuid": "fa77069f-7745-4e26-92af-22b611459585", "comment": "Malware payload", "value": "3d4a671bb4e6a969da35484657b7e7339bb2032b", "object_relation": "sha1", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123651, "uuid": "0142b864-7d50-46c3-9595-500945451bfb", "comment": "Malware payload", "value": "20eb776d191de0db4dddcbeadf4f5b86d13d0c25df2b42804cb238fab325318c272861416c543ed6ad322de1824d0e0f", "object_relation": "sha3-384", "Tag": [ { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123651, "uuid": "d836178c-251d-4cf2-b8e9-eefc24b24889", "value": "T1AFD423EABE8F5DC5854EC35CE5098FAEB27A475E4C10CB459C7CC9831989F94328E0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123651, "uuid": "2733d764-1ec1-4174-b623-741d8dde8fd6", "value": "12288:p4C0QYPmOfgRhzWQ/otg/F61L/FTIn8B6ttC+gFc4iwxKDOS4xOcMFBXjTc86RX:pkffGzlSRF/M8GtBN4bxCB4pAFh69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709123651, "uuid": "3627fa03-ccf4-4d73-a4b6-f2691dee8b4f", "value": 627709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709123651, "uuid": "c883d63d-c32e-4306-af3f-125a3af5a205", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123651, "uuid": "d90ffcef-9a2f-496b-b23f-c36423004d59", "value": "nTTHSBC_Bank_280224_8845_PI.r01.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9995f9-d5df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1709086529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086529, "uuid": "f72f0661-45b0-49df-a0e0-77425de82eb0", "comment": "Malware payload (Meterpreter)", "value": "02e3f738f981a9e8de454f34a1057b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086529, "uuid": "70682f00-8858-416e-b6ac-25aa76913fef", "comment": "Malware payload (Meterpreter)", "value": "420b3ba7d6c60da9ca0eaf9222cf584434842640630740d82e32de86200ec5ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086529, "uuid": "1a8d530d-f877-49f6-bfca-e3ba9be215ad", "comment": "Malware payload (Meterpreter)", "value": "9018c53f7271a834b4b3faa847a055165fc30759", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086529, "uuid": "3e8e4f18-b60c-4ae2-bfb0-801aa5051e45", "comment": "Malware payload (Meterpreter)", "value": "c9a1ed22ff003aac45b4ed0b83e4d62356e500d3668c6a03473f26ada5b6778c356d38fb5f9dbcb75b61e7673e29a152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086529, "uuid": "7139ce25-5a63-4c17-8a74-79b137a74778", "value": "T1EDE1751337145EB6D87C057D57E3FD6761584E383B3B42B68D1C1317396212469F4A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086529, "uuid": "fbe21c32-cbd5-4fae-8b66-780250f7ad01", "value": "b4c6fff030479aa3b12625be67bf4914", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086529, "uuid": "c2a2d836-4d2c-4d26-8c51-51855d20d382", "value": "24:eFGStrJ9u0/6LfnZdkBQAVK3WYRwKtRqrzeNDMSCvOXpmB:is0u7kBQvBRwKSzSD9C2kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709086529, "uuid": "0ac2f7ed-f43a-4e84-908a-a931e5285ced", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709086529, "uuid": "b31b10e1-6eb8-48bf-95c4-bfdfaa97c513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086529, "uuid": "60b0cf76-f0ee-4526-9263-08096e26f9d2", "value": "02e3f738f981a9e8de454f34a1057b14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f0c21-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145013, "uuid": "6563a016-bfe3-43ef-8b2d-47dbaab71014", "comment": "Malware payload", "value": "2d5035cb5a3678f2c2f5a889bd384813", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145013, "uuid": "0e264bec-ed7c-4c14-8a1b-b35d225e9196", "comment": "Malware payload", "value": "424cbe8f24a62c330149dbe0b80e214a984950c3b79b067058671608229fc2ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145013, "uuid": "24b62ea5-a268-4e92-a836-3764282d8177", "comment": "Malware payload", "value": "9c4a669a30a4bf0e27d5b373919c3f6017c8ec4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145013, "uuid": "f220c9c6-dde9-4369-aea7-dcf30d6d08a5", "comment": "Malware payload", "value": "2d2c6df5ffe02509bec8be6ae0551e31cdb452cf663d778fd877fba3b7563fa283db8cc1fa6b61261392defe0b9e31e7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145013, "uuid": "e270288e-a8f5-421a-ae60-4d0294596ffe", "value": "T16104AE2873A48D1AC6DF8636F4E206268330F457E233DB4B2AD5A7FA98977551E403D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145013, "uuid": "427da11e-aa1c-47a8-9c0c-23125e4ba53b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145013, "uuid": "e3fdfb06-2b06-4c9c-9645-4381428ad002", "value": "3072:3E0E4PCRvy5/ixiBU33nC0bZqSSvKKy/f1SV666AjwbbHyH6engMHdFtp04M9Y8e:3E0E4Pyy5/ih3zbZqSGy/fk96e9Ftppn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145013, "uuid": "9ac171bb-cb0a-4586-8c10-5ac07f2e0d19", "value": 185752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145013, "uuid": "ec818047-e2bb-46e7-9c89-396c49b30f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145013, "uuid": "abcafe7e-0706-44d2-8b06-2fb4e875d431", "value": "SecuriteInfo.com.Program.Unwanted.5492.709.27003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22684346-d612-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709108387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108387, "uuid": "b4b3d9a5-602b-4db5-9c84-61591f686025", "comment": "Malware payload", "value": "f89690096a1321e931843585e88bf26f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108387, "uuid": "92ab33a4-4c9d-4e1d-abea-95ef3192ab09", "comment": "Malware payload", "value": "439c10e2373a42913e6304e64335475682cf728db6c9c00dc3c3d4d8ecdb6bd6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108387, "uuid": "87c6910a-980b-4a8c-84db-5638afd4343a", "comment": "Malware payload", "value": "f367d63b848b79ca7382cd35d73b8d02cd01bc09", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108387, "uuid": "ac22072b-53d5-46b2-88ea-eb0db6ec452d", "comment": "Malware payload", "value": "31785013fb02c9da30b67c1b2f2e3f9fe18020938c43f1bc337cccc9bec8c61e3ea7c0d0d51c3881c38d1659b7db522a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108387, "uuid": "811c7d15-db93-48e1-9a13-3712691e3e7b", "value": "T15037335A22128170EB154637B857B6AF553EFE60AD707C075368FB7A2BF10B31A36D80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108387, "uuid": "ec429031-c59c-4e93-85bc-ba13b5eb51b5", "value": "393216:+z0oBd3WbDBM6hzaBlRaSQIYFDxG+qKKUtxMZJmMjsRp0eiEQn:+zXf3Whfpo3v2Q+qQtGzmWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709108387, "uuid": "8ddf5fcb-725d-4033-9413-fbc2258d8454", "value": 23818240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709108387, "uuid": "12a63b8e-f0be-4e94-8c26-e05031c3db83", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108387, "uuid": "89995633-a55d-403a-95a5-44489e05bbfe", "value": "SecuriteInfo.com.Adware.WinDivert.4411.26187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14955cee-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153890, "uuid": "1e9e7017-6297-4c27-ac5a-5227ce6bb32f", "comment": "Malware payload (Mirai)", "value": "c782d8b5360c50f0e7ac83af41754de4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153890, "uuid": "f62f2581-f535-404c-bc91-cb81fec7f62c", "comment": "Malware payload (Mirai)", "value": "46036893c01c2bfdc14ce6ec4bda9c59e79306544e2713137e3a7fea8ef440d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153890, "uuid": "4b4acff0-2c8f-417b-9360-fcb004142df4", "comment": "Malware payload (Mirai)", "value": "ec6e158710b6b971d243d0dafd8963e5bbfc14f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153890, "uuid": "9358c71d-af95-478d-a80c-b8447b992002", "comment": "Malware payload (Mirai)", "value": "55b627a603e8cd968201276d9633c2741b794dbc4d83995555c3087a7f8f6c67fb3202fb638f45e7a5cab2a3b28b44df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153890, "uuid": "79992bfa-9806-4e20-a5a2-950616f2d43d", "value": "T1FFA32989BC91DA22C6C12177FB1E52CD331653A8D2EB32039E296B25778796F0F3B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153890, "uuid": "825c34d4-4f28-4d16-8906-adf1d48b21a8", "value": "1536:tL1ZE0gXbtwxG34oNxnk4HMoPfHqYL2526F0VSugXA37m6avbB/8rLbtOpLTtI:tdzG3rkmnq9526ASugZZvmnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153890, "uuid": "4bb15a62-69d1-4644-a1e1-5066d0e18001", "value": 99880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153890, "uuid": "14430b03-7864-4ce3-b619-137093a69dde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153890, "uuid": "c920d12c-b326-4cfa-955e-53f95d24299e", "value": "c782d8b5360c50f0e7ac83af41754de4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f49fe87-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709129561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129561, "uuid": "a8be09dd-0e4c-4ec2-a8f9-51296fa5737e", "comment": "Malware payload (AgentTesla)", "value": "834267cc0102f7535804c2a393fb2876", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129561, "uuid": "b985c269-ac07-41d3-8300-b1657adeef88", "comment": "Malware payload (AgentTesla)", "value": "46d8a62c1eb783055f088db45577025b48710ed5e69976ca8f6a055841c6b7a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129561, "uuid": "0951896b-68ef-4758-897f-641632240684", "comment": "Malware payload (AgentTesla)", "value": "fe4a59e8fcc84869df96fac53739b6c66e336a60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129561, "uuid": "ddddecc8-13af-411f-9ad7-56741156ec31", "comment": "Malware payload (AgentTesla)", "value": "d97b269087523b63e857d9d270a8e365223a91cd937089a35283a91aba6f232ac25fb30614ab948df49684427e7260cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129561, "uuid": "866dc726-c934-469b-8efc-976b3b25acc5", "value": "T1DF25BF1373DE8361C7B25273BA15B741AEBF782506A1F96B2FD4093DE920122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129561, "uuid": "0d9b412a-f6d7-4310-92cc-d902b937e00e", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129561, "uuid": "a1a342a6-048f-40ff-84d0-db3bf73b6846", "value": "24576:0tb20pkaCqT5TBWgNQ7aWfvk7e8MlNN6A:dVg5tQ7aWX/D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129561, "uuid": "e485819c-6ebd-46dc-b481-543ef79defa1", "value": 1035264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129561, "uuid": "3921bdc0-df0d-4877-90a2-ae7a230e9ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129561, "uuid": "8cf60f91-6cc4-44bd-85f3-fe90819b372f", "value": "PROJECT 893MTR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77da1e1c-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709128287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128287, "uuid": "62a156ef-78e4-47ae-84c3-73bd777a639c", "comment": "Malware payload", "value": "c4cd2f31e2af3c80d3c52b2295a0beeb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128287, "uuid": "e37606b0-85dd-47d2-a34b-5d0cc18963e8", "comment": "Malware payload", "value": "46de11a4c0a2a27fc7c748d0800a0f4f3841cbf3ebea564565eadcea4081c726", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128287, "uuid": "40fc20d8-2e4d-4cab-9b7a-1b4bef954195", "comment": "Malware payload", "value": "c9165e105041fd0f2b5992ffbb9e6210b87cb5d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128287, "uuid": "8c4ba3bf-f046-4657-9e47-9b7fa05e6b60", "comment": "Malware payload", "value": "8eee8d81ec2c852e91ea121fcb15b96524b7fdc613b18ee4054a090e6da4f31063bd500ca6eacf31df40ac13ad9e08b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128287, "uuid": "1f9f89fc-bb72-41d0-aa09-ab2a864b1aec", "value": "T16974D001BE818647E855473189F78FAA5325FC419FA24B0F365CF32D3DB43A45E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128287, "uuid": "1782eb09-a2a6-462d-986b-d43da4f32952", "value": "6144:cGun0YMY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbV1OMIn5cPwXuRl59mZPPK:c30A3bV1OMIn2wuRH9mZdIe6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128287, "uuid": "8c8df585-6989-4b49-8c6c-bd65a7a0dd79", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128287, "uuid": "a00c66f6-9530-4fce-926c-52ba77394a8a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128287, "uuid": "3eb196af-8ceb-417b-95c7-f5585ef0f6ea", "value": "facturas 000005111, 005112,, 005113, 005114,,, 00051153####.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495fcb9d-d623-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709115753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115753, "uuid": "0b0f4a75-7396-4d33-8cdf-f1127a400400", "comment": "Malware payload", "value": "3462e5905a1627fb9203326d5b059337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115753, "uuid": "c0c9de6e-cde0-475d-9284-a1cc5d80f15d", "comment": "Malware payload", "value": "47506422497eefbc000cddf5adc8c24b03686e4c5791ee8241e4998caede618d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115753, "uuid": "7abe4b65-054c-4da0-a453-514f19e0face", "comment": "Malware payload", "value": "736dffa4658440b9d2991628117b8534b1374b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115753, "uuid": "657524d2-c3bf-4508-bc82-ae2a3f632e29", "comment": "Malware payload", "value": "86c7c122d1a01af6738a1ce96ab526c236c6b5184f01dfaad10d10bd5936a77845b5d55d1cde05dcfa9b50c69726a2b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115753, "uuid": "ee6a82e0-0391-4e1d-b640-a8a9eb4a0016", "value": "T102B533A11B0FC354C6EE91F231AFFA412BB7C18453A016FC25715D96B6A25EA34D32F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115753, "uuid": "6e330f51-fd79-446c-b6b6-b246e0848101", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115753, "uuid": "d5e642b2-6d9c-410a-9795-b199a2696cc5", "value": "49152:WjYehOISUSrMl6ge5g+3CqVTegLFAmJNFEUnf9k17wUW:WUeJS0z+3C2eenJMUnf92wUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709115753, "uuid": "f448d98a-418b-4cbe-a33c-b096a1f485fc", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709115753, "uuid": "9a197889-524f-4c0e-8dd8-ccdcaf68547d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115753, "uuid": "e58581f3-c7c5-4236-a45c-9e29127b578a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.14798.11908", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df49e2f-d65d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140591, "uuid": "2bace6ad-ef7a-409b-960c-c57fc4c3fd0c", "comment": "Malware payload", "value": "8bdf793fe7bafe4e2c4eee93153377b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140591, "uuid": "8c20ae84-8393-4761-9e9d-ba76c29e4028", "comment": "Malware payload", "value": "490ed9458d66ffd10e359bc4d14fa737aac603074d76c74efed41d9af6f72a88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140591, "uuid": "6c042912-ad19-48df-a766-44f2243c24f6", "comment": "Malware payload", "value": "79bc4ed5b8c305f5644ae755eb2f02b856e806e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140591, "uuid": "39c99b1b-9501-4ea0-91b8-e52fecd1d834", "comment": "Malware payload", "value": "c40679ae16f831582cda96e29b9351cbc0d717f089daa05236729896fb4d706bdb29de850395fa1518f67751c2a99090", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140591, "uuid": "f4e100f3-c4ba-49b3-89af-c27ee420a755", "value": "T1A6357C8972E9876CD23A4A706075546083F5FE2219B1D77D3E44B4EF0BF2A824726F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140591, "uuid": "da1c2fce-720b-4100-99a8-a025233ca164", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140591, "uuid": "67775286-465a-4aa9-9fe0-e50d55569316", "value": "12288:M12bt/hT/zxsok88rjslCV3Li09zDTpes6jitISmUko6fz+GhNEJ9OxnZQknjqlb:M1wzTM33obivkpmJ9KZBjts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140591, "uuid": "4ba0dfde-e4dc-49d4-ac85-0892b4e1ee03", "value": 1107456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140591, "uuid": "5a2880cc-388a-4033-a32e-b8dda0898a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140591, "uuid": "ef9d36bb-8139-436c-a471-14700686ff93", "value": "DokiTablazatkezelo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59db8721-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709128236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128236, "uuid": "f058b6ed-9b53-4891-9173-fc0fcf618792", "comment": "Malware payload (Formbook)", "value": "eec85a3805bca7a05b1e669f3a043bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128236, "uuid": "2bd91f12-cfeb-4b4d-80a1-a6e2d5fa126e", "comment": "Malware payload (Formbook)", "value": "4a487c4228b0a8d316809fda3510b6153f392d4e80622293efa6c8f2c4f1cd83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128236, "uuid": "34fbccb3-741a-4d90-934e-7d1ca28f99ce", "comment": "Malware payload (Formbook)", "value": "b149921ff8b37ccc526a47f170eff93d4746faf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128236, "uuid": "33059765-2716-4eb9-8c62-c9af9bb117fd", "comment": "Malware payload (Formbook)", "value": "a6e484115035fa3efad173826ca2bb632bd212862f5845237555ed059bfc974c821c1c7838d6541a2b5bded88484abe4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128236, "uuid": "3d7c0568-65a7-44ec-81bf-416a334c8cfb", "value": "T180E4E059236CAF72E67A4BF854A098510BF1352FA13EE54A0DC224DB6E75F608F42F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128236, "uuid": "175ed285-3ea4-4bf5-a8b3-a017143dded8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128236, "uuid": "70155bb6-5346-4bfc-b372-432f8e7b30ac", "value": "12288:98S+oGOKc/hbL9bW9ezytPCcyINFbn6UjD2BjnCKJ0BMlWqU:tbL9iyQCps5nL5bMgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128236, "uuid": "f6ad5987-8171-47ec-82bd-d6a1ce7764ff", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128236, "uuid": "fedd9874-ef00-4a8c-ae6b-31c901b248e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128236, "uuid": "4424abdd-dbe8-42ce-94ec-b0b94e188f58", "value": "Solicitud de pedido Documento No 168646080.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3e5172-d612-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709108426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108426, "uuid": "a3fca96e-5829-4947-871d-09401f38896e", "comment": "Malware payload (Socks5Systemz)", "value": "0253e5647a3286d1df5a3d7d91d655e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108426, "uuid": "218fff75-d03b-4524-a044-d051c4edd68d", "comment": "Malware payload (Socks5Systemz)", "value": "4ac4a8a49e5c6fd0fbf62b71ecacd5bd6209758dc5162088d03bd194dd7d594a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108426, "uuid": "822e0093-bcd3-437c-86a4-a294e5e7b8cf", "comment": "Malware payload (Socks5Systemz)", "value": "39c9234e4ab658601c4644514afb6ddb461e7928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108426, "uuid": "6fe1a42e-c1a2-428b-b616-b5834b37b535", "comment": "Malware payload (Socks5Systemz)", "value": "fc34ef505ce034434420aba6d5803c8a4beae0bd7ccc15a578faba0d597b872473eb9396b485af704801255114d64b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108426, "uuid": "33f36fa4-3b05-4103-bcdf-d481c6f04fff", "value": "T108C533873752E479CD1AA338CADD62687342B745DCF94004FBDA375BFE7A6098802782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108426, "uuid": "71b59238-a843-4338-8099-dae814cf06c9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108426, "uuid": "49ca923c-90c7-49c9-b70d-8882c814aa07", "value": "49152:C9vj4D1Up7n6rkMn9/tQGfA5FSHw/qrGOxBsIkcviu1:Mvj45k7nsXQeQ/yGOxBsIZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709108426, "uuid": "0c83de28-b5ad-4c8d-ac5b-0eb929ccb50a", "value": 2507468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709108426, "uuid": "451a58fd-2c7a-4f26-8035-ce3cb737ac90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108426, "uuid": "27cf2474-527e-4fc8-94a4-fc870a2c3c7e", "value": "0253e5647a3286d1df5a3d7d91d655e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802e84d5-d5f8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709097377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097377, "uuid": "d7829081-020c-44b3-9a96-1be7e1d17f36", "comment": "Malware payload (PureLogStealer)", "value": "5bf2b0c12768773b74a2f9a59e738591", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097377, "uuid": "685cb89c-e5e0-4ab4-a173-31718ef1818f", "comment": "Malware payload (PureLogStealer)", "value": "4b4ca1dd5aeba2b42668b3b6fb98335f0a7d159d6db73da34f1060e0a917fee1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097377, "uuid": "bd0df783-2f82-4719-8a9b-1043f34a91c5", "comment": "Malware payload (PureLogStealer)", "value": "619114cc039a566db875f31969cd7d4dce55316a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097377, "uuid": "72d24825-9292-43e3-ad3b-c7d03ef426b2", "comment": "Malware payload (PureLogStealer)", "value": "46ae5b473b0affba4d306980b3e7bf829787d46988a766b4bd6ce79ab7da74916b6c9ca0acffbb6bcf3fe95ba70985fe", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097377, "uuid": "fb4704ea-fde1-4975-bbcf-be4494b6ab75", "value": "T1FF66F812F6CA4DA2C546237BC59B0D6103B5F589A323FF0E364F632A5C53BBA9E48153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097377, "uuid": "2fe3cdb3-2610-49d6-ab1d-74808431c75f", "value": "49152:t+IztrylrWY54hWt1BZDXShHpyhNYJOUwPWTtiVARI86069EL:tNztOMY5D1DvNYY5WTEiS7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709097377, "uuid": "e7fad6b7-0830-4ec3-bc3a-f133212592e6", "value": 6479928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709097377, "uuid": "805f0c05-d7a2-4828-ae6e-aa1ce69f788d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097377, "uuid": "091a9159-d592-4456-9831-abce058fd8e5", "value": "5bf2b0c12768773b74a2f9a59e738591", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd1013a9-d65b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140053, "uuid": "688c76d7-083f-4593-a223-c22c92578216", "comment": "Malware payload", "value": "7f98976a0609724a07e7e8950d8324f8", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140053, "uuid": "d3e6e358-36d8-4780-8fd6-2357564c0db5", "comment": "Malware payload", "value": "4bf13da116d8e09b83d47d6825d9e695b98f1ca577d33cf577ca0a8f5a45226d", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140053, "uuid": "e0983b17-08b0-432c-a2b9-ff11a6c6d74a", "comment": "Malware payload", "value": "f62600bc1ee2c4533c3eb339292127009f02e782", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140053, "uuid": "af84a222-9f5d-413b-861e-79c84c325518", "comment": "Malware payload", "value": "2e4a89f38d9b7c653125a4e89138eb8f6cc7365187ca6a66061cfa43e4f67486f3d356e544bb33015e53dca5208d76cf", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140053, "uuid": "31751931-b6d0-45f9-963a-f1f4f8c2f501", "value": "T13451F9BE0AAE39B4CE24D6F2C8534A415E6FC54D5497A1A2809918A73FE7331285C339", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140053, "uuid": "1a2c44a8-f3a2-4afc-a02d-10de0b9f0787", "value": "48:9HjUeteO3GcTt3RSDNB5p9UUUWbcDjpuA+5nJQ6v0zPzhhdocbMUL:1jnIKMH5p95UY2joAGnJNYPzhhdoUMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140053, "uuid": "dc3bd548-ebc0-491e-891d-83ef1a4376e5", "value": 3047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140053, "uuid": "1b67d2e4-4fc8-42b0-a74d-3ecb672cd447", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140053, "uuid": "0302f870-20a9-46a3-beca-2833e93efcb7", "value": "5418348934.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd146f6a-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709129745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129745, "uuid": "bebe77dd-4044-4b07-bc79-adebf75819c0", "comment": "Malware payload", "value": "908a6553c51a91638c85b091dbc6b2fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129745, "uuid": "d0271d1a-02f7-46c5-8d08-742387ba4a2f", "comment": "Malware payload", "value": "4cc13b3007321a1516710699489ef3e2b1cd9132118b9eb82b9830bcc2de7704", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129745, "uuid": "ab609e3d-605e-4d1e-a30f-091b44359564", "comment": "Malware payload", "value": "32cca05c220e758c77814b29d4801722f3ca97d3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129745, "uuid": "9a77f2a5-beef-4271-a289-e1f6bff143bb", "comment": "Malware payload", "value": "d94e9fa0d1ad063cd380434365ec594f7d94616aca394d954b7174ab23236c5c945c6628f8f43a9bf2326a8e7596b98d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129745, "uuid": "93385ed8-38df-49b6-b8d6-c0c17e9a4416", "value": "T1F003F176B4398C55D963A19731A8A01EC1D0093E66EC98DA372AFBD03613DEE06354F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129745, "uuid": "a696374d-4c74-41b9-8fae-9cb271f7a69d", "value": "768:lYaDFNBAia4pT4Q/XcJNERAeAhRKQaBxw4h11PSeNzwKAasVR:iaFI4p8Q/Xik0hRKQMFh11PnqW2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129745, "uuid": "2c313d85-f68c-42f2-869b-08d0eeeae617", "value": 41400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129745, "uuid": "3f59e1f2-528e-475b-8b25-0f0d1030d145", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129745, "uuid": "1a36605d-80fa-4244-b0da-c4aacfb5091f", "value": "H", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca31c0a-d60b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709105424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105424, "uuid": "a8695a38-f3cd-4070-a250-3b3881b47b41", "comment": "Malware payload (Stealc)", "value": "706afaee286c2e7055ec363a27482071", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105424, "uuid": "23c0ee78-7bcb-4344-b57d-c98692efe8d9", "comment": "Malware payload (Stealc)", "value": "4db6f4628dcd3a4ef8417290ad40c858047ceaed4daaff87a4a5f0d873745809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105424, "uuid": "639b7421-1524-454f-b61c-42ac4c890769", "comment": "Malware payload (Stealc)", "value": "042b0398957cfc9a5d639238ce817fdb557633d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105424, "uuid": "e50d123d-9b16-40d1-a837-dab6604193e8", "comment": "Malware payload (Stealc)", "value": "1b0b042e8478ce39e41b0c12902a26898d8070c56c3db50738b78ad818feb7a0cee86c3a060afeac65c16be9e0b02e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105424, "uuid": "81a48b99-740c-4370-8c06-89162d5f6766", "value": "T1C744D03276A2C0F2E46B04308971CAF16E7FBC7352B5865B37A42BAF5E707905726352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105424, "uuid": "dc681a6d-0c3f-4145-aecf-ba7cf2f5f3f9", "value": "49d84a51f28bda92ea8885bbc40b0c72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105424, "uuid": "19c5ed76-0f93-4a8d-bde9-d28b9de85f84", "value": "3072:EiA5GwRCB1L3IYq6Tec1tzO0YaGs0quD+s7XzHg5tzTFnx:9Bd3IYe6zO08w8+sT7czT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709105424, "uuid": "8037dc90-4f31-4457-89e2-d5bf80ab43b2", "value": 258560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709105424, "uuid": "f34c75fc-6f2b-4f15-bdfc-bc2d3660d476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105424, "uuid": "10645ba0-5d53-4eb2-b8c1-4c35defbccfd", "value": "706afaee286c2e7055ec363a27482071.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57ec2ed5-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709128233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128233, "uuid": "d91c5d02-d9ad-44af-90db-2bfe20fe1cbf", "comment": "Malware payload", "value": "e6f0f795f293ee5eaf852ff638e62f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128233, "uuid": "11b557dd-b5df-4b13-8666-32c17a5d2878", "comment": "Malware payload", "value": "4e516af048f556de1ceaed29a0695586b0c7ecc310e509ac9a839f6b15b174a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128233, "uuid": "c612f7a0-70c7-4462-a574-4d2768254ee3", "comment": "Malware payload", "value": "db4ee8e03a07a984a9cde535639993b2a9963479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128233, "uuid": "129654c8-e804-48f0-95fc-40eff7b7f0e8", "comment": "Malware payload", "value": "eb580993bcfaa9b7565304848eaa024f2820082a6577b6b22b89c0ecd0415640cf58f89e696eaa2c0cdaf2623bb00351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128233, "uuid": "cd521c81-7064-4c9b-9593-b82f0b1cb7a0", "value": "T1D5641269576B5174E41E9BBD3C269E0802F2B385C44B876F70BDA3A0895B7CFC743682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128233, "uuid": "9f548dae-c55b-4e05-bf07-14075f24a342", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128233, "uuid": "8fe9c557-5860-4154-b953-5c38d9c38c2f", "value": "6144:H4ML4uyHlh8ZDMs5jYOCbNWVxU7QfNwYDEu4gfBWpMNgiAV2WsMF0k919HD7oX5w:YMLYHrgDdjMgvUEfNwEX4gfBWxs20kdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128233, "uuid": "d7b23aec-a2f6-435f-827a-9adce256caee", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128233, "uuid": "3633009b-bca8-4293-bb38-f4cf62ab9aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128233, "uuid": "e723c54b-e36b-407d-b27b-ba82928e0c99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6baa1631-d644-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709129984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129984, "uuid": "a8dd4064-f423-4b38-81df-f7b48ea25783", "comment": "Malware payload", "value": "a3508267d7a36e0823f98f3b0c8be53e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129984, "uuid": "c2981682-e294-43aa-9ff3-6879050449b2", "comment": "Malware payload", "value": "4e5eeb3466f9ff1b02cf89480335e8d746ca6ecaeb658dd43f08eed3ea877c39", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129984, "uuid": "293a5ac0-119f-4a8f-882c-d39c0f807cd9", "comment": "Malware payload", "value": "ad616497393aa64cc82090ff565111531f54921c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129984, "uuid": "5545af40-4b65-4340-bb8a-640c33920915", "comment": "Malware payload", "value": "a4d3daae2efae82aa6026127da789f13afddf77149dc2614f268ba3d6c1dc741885e36cf31c2fef51a8001f2ebe8f6ce", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129984, "uuid": "23df091b-009a-4cc7-8bb0-c204582da534", "value": "T1D1665413E28F90C72B0833EF234756458DA7E23339AA6DD136C0156C8E62B5EFE54799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129984, "uuid": "f5ca8e1a-fcb4-45ea-8584-badbca4d2a7d", "value": "49152:90Gy6Q/liR7e23oSl2ZKxubTjJvrHEXzUP93pSVVNjrZD07DJZhNzU00UcBuoitX:O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129984, "uuid": "1fc6fd1f-ef9e-4bf0-b62a-ccbbcdde715b", "value": 7075334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129984, "uuid": "f1413b96-7f9c-4770-8253-7ff84888815b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129984, "uuid": "df5cac72-f9db-42b9-a81f-89fb8c53ab4c", "value": "BANK_LETTER.PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229af676-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709125567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125567, "uuid": "29953ab0-865d-449b-8456-648073f3c510", "comment": "Malware payload (Gafgyt)", "value": "9a9459432edfadd123ae1eafd2642bbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125567, "uuid": "a3977ab8-6690-4ec3-a894-43f26375bf8a", "comment": "Malware payload (Gafgyt)", "value": "4fe06ec5d2238d57ddb7d7f55e33b2f81105d0c799e2f997a68db35db6e85b02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125567, "uuid": "9448a18c-80b1-40c6-8c10-521f00021332", "comment": "Malware payload (Gafgyt)", "value": "30df9a0b1d6dd6afdfc291f60652a0d5f6d7cad1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125567, "uuid": "e0e59660-ef7d-4400-bd23-11766fb5ef04", "comment": "Malware payload (Gafgyt)", "value": "273161ee34a08d0701fa44d7e40ec259612d841fb038f5cf11b9e55c7090b74f3963ff4f8c6f8f64d0c25e9f1546461f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125567, "uuid": "d6b777e5-96ea-4862-b18f-4347c945d9dd", "value": "T1DB733B02FA43CAB3C4830BB6029FAB660D31F9AA1B2B9E45F31D7CF45B164C87116B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125567, "uuid": "8d812862-c2c8-4dc1-99c3-d0e8d3b06dbe", "value": "1536:9JMgD+pOW+6miDIrUnf1gTqjx6dWk6J8jmLI6VOz+jXUfWQS:AgD+hb/IrUnNg29pYjmU6VOz+bUfWQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125567, "uuid": "0350bf78-f265-4734-ae25-d0910447cd3c", "value": 77785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125567, "uuid": "1288fd09-05cd-4f2c-b26d-c5f78a80e90a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125567, "uuid": "be0a4f93-3488-414c-8eb9-27a1e6eefec6", "value": "9a9459432edfadd123ae1eafd2642bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb76bad5-d64f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709134843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "e7b5d2c4-0b16-4c74-a54a-ace8244f2314", "comment": "Malware payload (AgentTesla)", "value": "4e11ab4221b6dc01a22ee0a194ee3426", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "26479c1b-cf6d-4143-b33f-b63804399dc8", "comment": "Malware payload (AgentTesla)", "value": "50216d508a3b28f28751505cc488256c15516ccf18fc3d9e42ea3bbe09323006", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "191be43b-49a3-4b41-b650-46cfd6f8e10d", "comment": "Malware payload (AgentTesla)", "value": "2c7f999ad23313212b7a010f9605a474c530364e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "416c0ca3-349d-4bf8-8255-3cbdb1982486", "comment": "Malware payload (AgentTesla)", "value": "677503b599553fde9ab748234c0622bd388057fde237a4e90bbfc87d9816d242e3d814a0f865a49fc521ea585283a42c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "216f59b2-e2d6-4c5e-be34-87ec244a32d7", "value": "T1E9E4339A925F6F29714E5E9FCE28C9A5C221B3D785DAD63CD1DC18BB20FC4C8C961C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "72c0e0b4-6d12-4771-a83a-6f843b4154d9", "value": "12288:uDFyUcpGSOh5sLTNg+5hwvL8P4gWimDWKm34hoQN7PCIIoCV15oIzat/k:KFy1PUsLlwcUJdNWIIoC+KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709134843, "uuid": "b99a739c-335b-4afb-be9f-0fa5333ef4ae", "value": 679266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709134843, "uuid": "a52622e2-9700-4b44-b009-9c20f5dd36b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "db96bf55-92f5-4348-853f-949c8a56c1c0", "value": "Summary of DXB,CNE & NE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b220a177-d635-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709123660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123660, "uuid": "73954d6b-bf9d-4847-948c-029903e651d7", "comment": "Malware payload", "value": "a8dd8b937c3cbed7eced0d5d168f3c3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123660, "uuid": "68485dbb-76f4-47f8-9e96-bbeefa1e7bc3", "comment": "Malware payload", "value": "513a7cb263c8466f960334e79d271ec9de05cd700f2e48061f997d7500d0734a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123660, "uuid": "6533a0c8-6c89-4dae-88c6-44350740aa82", "comment": "Malware payload", "value": "be15b0cada1367e5be9616aa879936d8b14dc179", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123660, "uuid": "8f3d3357-6de6-47f8-b858-a0f5c3c82973", "comment": "Malware payload", "value": "2bb591b8bfa90699b0564d633b4f26b418dcc681e00164d144ec40b74db9753cc35d2c1cca81f54c43d5c3e33983eaa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123660, "uuid": "f62eae5f-4791-46ee-9ccb-ae28bf7feb98", "value": "T11FF4E055236CAF62E6BE8BF454A09C105BF1251FA57EE24D0DC264DB2AB1F608F52F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123660, "uuid": "0dddbdc3-b866-4468-b6aa-8c19b43b0bb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123660, "uuid": "5af9f0e5-b93a-4ff8-8507-f74e183d92cf", "value": "12288:28S+oGOKcfrvL9bW9ezkexVSLesZfTNGjSt1adzMVH/QTrl9HpjAF9/dLor0UZ6X:4vL9iykisZZf7tM5MA6bdHUUuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709123660, "uuid": "1c33a202-16f8-4acf-a6e9-e3bb75cfc29d", "value": 724488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709123660, "uuid": "00f2a458-175f-4934-9b02-64b15c426644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123660, "uuid": "d8470252-4352-4df1-90e2-1f3df3935b3e", "value": "rTTHSBC_Bank_280224_8845_PI..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736c9dc2-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145030, "uuid": "a6fdeaa2-db8c-4686-a464-de3591b07441", "comment": "Malware payload", "value": "18a46202a1636b985208e2183d756617", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145030, "uuid": "cdd6edb6-9dc7-45cb-8006-06405d027f71", "comment": "Malware payload", "value": "513d386fc084ad355d1a8668d8b4e43cc3b21f135ac3eabbc6b96adeb3ee9e84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145030, "uuid": "d21b17aa-da2a-41c4-ad6c-67d9801d4c34", "comment": "Malware payload", "value": "7f8d0ca687ac82067d7a79c011a2688336b71b82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145030, "uuid": "d6b6dd24-58d9-4d9b-8246-d9e5ccce7997", "comment": "Malware payload", "value": "7f2efbdd6de5edbba842e9370bc6204544fd7acc2550ca68d9bd1d3964ae6fc87184d6532b766344a46ced0a26e82494", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145030, "uuid": "29432370-7cb4-4f86-ade7-080e9cf3f186", "value": "T1BBC4183173A4421FC2DF9278E5B25725F970A302F222CFCE599452BD2F8638165639EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145030, "uuid": "9c4a62fe-b75b-4f1d-96bd-e7ac3d991f7f", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145030, "uuid": "18d723ff-70b3-489e-ad41-a90a6979cdcf", "value": "6144:vtIgLGv5WBfXkYlsL/Nz++R1yji08n3uzxRQKEPmBm9C5vEx3tcQ8Vub8xPtwZEH:nz81Dn3GQ/9C58x3tWXH9gvHYF9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145030, "uuid": "1694e091-4c45-48cf-95e8-82ad094c4c82", "value": 565480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145030, "uuid": "6959e10d-bb8b-402b-a42c-9064ca5c1266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145030, "uuid": "e05b17fc-7b7f-4c5b-a01e-aa628fcff97d", "value": "SecuriteInfo.com.Program.Unwanted.5492.21532.11334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e60b4f-d679-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709152736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152736, "uuid": "26ae5d00-a854-44f5-b474-9d59777079f4", "comment": "Malware payload (GuLoader)", "value": "934f76ec04a26038c3c359c057671b31", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152736, "uuid": "b4bf7112-7297-4551-bdf2-72ca5406174a", "comment": "Malware payload (GuLoader)", "value": "5150dccd33ffe212562d58167bb53c35e2e7a3e2be160f45ea51f6047c62f252", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152736, "uuid": "eb4ae2a3-7689-4631-bd5c-e556cf6e711c", "comment": "Malware payload (GuLoader)", "value": "7024b421d2ded2344e7689a65b91d8578a3ef615", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152736, "uuid": "eac32a55-bb89-4e62-a2a6-90d7033ddb61", "comment": "Malware payload (GuLoader)", "value": "0bf5fbca187449c8fd84cfc4f5718b59a88e824088bd87e1b399bc0615692acc9ae739ef6520cbd273ed4c8c46c1fa69", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709152736, "uuid": "75d4c4cb-3344-4b4f-b930-cd5971373523", "value": "T13E831BD3DAC522048A461AB7EC1B47738DA400AE3B031F359BBCE66D5453648A6BFBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709152736, "uuid": "8e28b81f-18b7-42bc-b1e6-dd2b004331dd", "value": "1536:iO+rAQgFXLEvvR6op8MiqKkjmyJ4BXwKkEtML+BDLoTDg:iNcQgdLEXR6Y8MiqKkjmyJyX7uK9LYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709152736, "uuid": "4e1c51d4-5155-4216-8461-f55af710d996", "value": 86560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709152736, "uuid": "81b70697-89ff-40ed-a833-14faa0ade9e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709152736, "uuid": "f228b839-6bb1-4416-8732-de2715a5e463", "value": "Payment Advice_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335552f2-d66c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709147070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709147070, "uuid": "f52f7e57-976d-451a-8d5c-43004b88184b", "comment": "Malware payload", "value": "9b111c3692d58a84f9f4359a0412b61a", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709147070, "uuid": "cb52a8fb-a33c-46b5-a399-52dfeab53bbd", "comment": "Malware payload", "value": "525b00fc379589a73ebd6471e440220c886b969332360e17fb44d5175b3d945e", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709147070, "uuid": "054150cf-242c-4c82-ae52-26331cc6ea59", "comment": "Malware payload", "value": "7e987c96ffb446f20d446618aca7baf9f59c7475", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709147070, "uuid": "87513997-5c08-48c3-9c0a-89b04f24f16f", "comment": "Malware payload", "value": "74fec74d46c4a93e4c446bea9240b8ddad483d952a369083ddc4b16cde06683d52988814754e37b2007a4cc95d218707", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "CVE-2023-38831", "colour": "#FF3A96", "exportable": true, "hide_tag": false }, { "name": "SideWinder", "colour": "#92FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709147070, "uuid": "25bd0271-fdc1-40c6-830f-ad8048f4481a", "value": "T1AFC2E0DB309EE236C78054E48583669FE2BF56015A3BB6C0A790C3CCA9131797665B3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709147070, "uuid": "1f896159-d325-403e-a1f4-6c3fd1de20b9", "value": "384:s2JaAMD8UZOVFMeRYpj2kXNL+6k4x8ynJL/l4i+2puGRKnx9G0Udn:Vd2ZmcpZdS6VxXnJL/uH24px9dUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709147070, "uuid": "7a0cb0f3-542c-4ee3-b770-e0abc7607629", "value": 26754, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709147070, "uuid": "f3fcba06-2233-40f2-b55f-58c552ad4fca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709147070, "uuid": "ffed4418-8543-4f4f-97fe-0c31bff8cee9", "value": "Special Envoy Speech at NCA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af35568-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156880, "uuid": "a7d635e5-669c-43eb-ac6a-6c1d0da721d2", "comment": "Malware payload (Mirai)", "value": "4b912f1018d5974615be78f4aae662cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156880, "uuid": "128ee999-a1db-4c85-9721-8dfe0202495b", "comment": "Malware payload (Mirai)", "value": "5320813bf98818f00c9118c9878b8151880eed752b22a26344c36be0628f8e69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156880, "uuid": "78b3e03b-1ec4-4d69-b054-821f50ba159e", "comment": "Malware payload (Mirai)", "value": "ab28c4b6a75cdee4b39ec560f030a7579517a356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156880, "uuid": "f10b024e-ca09-4460-a891-0d77f55ccd8b", "comment": "Malware payload (Mirai)", "value": "d130e8ce3650decee4abe9635bfb653d23bf439f81b3772837c83f05550c3ea65f5830b721927056d8f30a6a05fcd0af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156880, "uuid": "0b47baa6-d137-4850-8a0c-b6fb441aa797", "value": "T17463D506BF514FA7DCAFDD370AA9070134CD650B11B53B3A6934D92CB68B60B5AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156880, "uuid": "2d67bfa3-b7e5-465c-8991-17c427cda32c", "value": "1536:svYv3Y2UoUIaQ42hBpZ51EzBZsQcpj/TwY6nN:saY2UBIaQt12B+96", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156880, "uuid": "302e6323-5b1f-434e-a224-048e9028991b", "value": 69296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156880, "uuid": "8cea8630-4f88-456c-8420-31f7a97f0f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156880, "uuid": "757cdc84-39ba-4712-8a00-9cde0dca1913", "value": "4b912f1018d5974615be78f4aae662cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96d5aae-d65e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709141308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141308, "uuid": "96ca2bf7-2131-4f6a-ad98-9122bdf11c5c", "comment": "Malware payload", "value": "e84407f1eb9ce42cc293923821034a50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141308, "uuid": "4ea424f4-9cdc-4d80-ba85-e3196ae877d7", "comment": "Malware payload", "value": "546f76f18c32760bfe4350085bb6f2a637fd6e0fe9914b19b156b3525f7012d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141308, "uuid": "b5d85082-3ae5-44d7-8b87-3d29e113a155", "comment": "Malware payload", "value": "3e9c7b715ea0ce0555f0661864f48515fa6d8550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141308, "uuid": "7df9b0da-7430-43b1-9baa-2aed82876a16", "comment": "Malware payload", "value": "dad3ccc86bb6e7afa413932a79938588821875c0ec1b020f8d9ee73b7fded8c063c55c72d15c09a7d311045e05d1e67d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141308, "uuid": "e4bed4c9-622d-42ac-8ebb-2fd0f924870b", "value": "T1D545D5C1777FB1B2E70E21BD36822FC9193E6A8C316C53127139949090FB8AB77D8959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141308, "uuid": "5053503c-4091-4f12-b744-97467f69451f", "value": "24576:o5+8jBhdkG1/pLOyEqlebClPdhVwqL8gNvND/Bj4t1TLOGQL20f0YNrUoBkYq1+V:oM8jBhdk+/1OyEqlebClPzVww8gNvNDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709141308, "uuid": "654d8d86-c014-4227-9904-700523dfa903", "value": 1208320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709141308, "uuid": "2150a33b-045f-4f69-948f-2a68bdb8b391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141308, "uuid": "79b51317-c7da-4976-b0d8-f997fc574db9", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.10735.19008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e928bb-d646-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709130671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130671, "uuid": "d6e9ce07-9d13-4a1c-88f8-7ac9bd53c35d", "comment": "Malware payload", "value": "990fdb266e6a799f9c2954cd0887dbe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130671, "uuid": "36c11c76-4b4e-49fd-ac57-7e67d66f8fa0", "comment": "Malware payload", "value": "56608ce3c12c4502fcab65948d4e2bb6c49809d76901c05faea38ad75ef56f21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130671, "uuid": "4bd1c1a8-d087-4ef8-9a4a-757609661bf2", "comment": "Malware payload", "value": "f0e9e5c06e8af74c6987b47ece1f5cd19e7f0b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130671, "uuid": "448a6db6-28fa-484b-9f16-e2463f4876f0", "comment": "Malware payload", "value": "81812712e13bd39fb74fe154d4683989063b0429b1565fd3446eeaef61aae65ed4a081518615adf5f625adeab536ead5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130671, "uuid": "0fec739f-4d48-4948-93f3-a0e2aa81ecc3", "value": "T1E0837183B6885711E85494B185EF693103D26DCB1B33E3847F9CB39D0EA13A3DD82B99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130671, "uuid": "03c1afd3-fada-40df-94d6-8bd83a94b535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130671, "uuid": "f2fbc19d-9cd8-4bbd-a29a-819b470bb071", "value": "1536:z6qC8FeXpvgBn4x9FGuOwdYbQwYKF3LUzZyjv:z6qbeXqOEjw2bsKF3ANy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709130671, "uuid": "9a5919b3-26c6-449f-b4e7-0d8166752545", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709130671, "uuid": "b53518a4-3c70-405b-abff-7d2f37e313d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130671, "uuid": "c4be458e-b96d-47f9-8b80-29c5bd124d20", "value": "Bank Copy 022824001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e804803a-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156822, "uuid": "53f1626f-f448-4583-bbd4-4e53aecd222b", "comment": "Malware payload (Mirai)", "value": "104cce9de5a0430e087e234c3a4a5659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156822, "uuid": "a133a7df-ca61-49a7-bcb1-5df1add7fac3", "comment": "Malware payload (Mirai)", "value": "57469005b976b22ad7301effc778ff7edb90283f5feccb15a1c9b06c8f344d38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156822, "uuid": "f3c65992-7efc-4964-ba0b-8389401d92e0", "comment": "Malware payload (Mirai)", "value": "a8e6c6b12ed2bcb560bea60b02521551bc9bbb52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156822, "uuid": "5c69c852-957f-4ffe-a515-142a7d55f885", "comment": "Malware payload (Mirai)", "value": "3e412aacf0d8db3e5fce59224199c1fc87f3fd81c87bf702c1257d0213eccb64a814f461fe5b1b3940993b970a942e98", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156822, "uuid": "7b23d5d7-2427-4c24-be2c-092ff4f4e392", "value": "T1EE433ADAF801DDBDF81FE77B8423080AB170A75501830F37676BB997EC721A44966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156822, "uuid": "54216a7d-6885-4240-9c2c-aa1f48c6ea8f", "value": "1536:vaBm+yXSWgTKb8aH7yeDtqIsKtL0gS6TAu0d:vR+yXS7TK9xtq7KFcfd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156822, "uuid": "78598a62-98de-4a1a-8b55-d3cf918095bf", "value": 59144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156822, "uuid": "6c4c13bc-0652-4ac5-ae95-d45bbe93253c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156822, "uuid": "fe663c71-5baa-4b39-ad28-2de715a1e699", "value": "104cce9de5a0430e087e234c3a4a5659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dec365f-d604-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709102366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102366, "uuid": "99066021-efc8-4562-bc2a-b3832a30c12d", "comment": "Malware payload (AgentTesla)", "value": "cd8c86ad3730b12ad62aa8efd35128eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102366, "uuid": "bc227a36-9528-4558-bf9d-5b41c0fd3310", "comment": "Malware payload (AgentTesla)", "value": "5746f44f3a3bca690d30ee45e179bcf003c7759b20a0394563cb30e3d2b4e6ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102366, "uuid": "0d8ff6df-3ca3-4ab5-a753-556005e66874", "comment": "Malware payload (AgentTesla)", "value": "f5ccdad58a67f313f755fa44df410a4818a765f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102366, "uuid": "0145dd59-2231-458e-a5bb-32e079f4477e", "comment": "Malware payload (AgentTesla)", "value": "5ea904fd4f368e954c202a073a94a28dc29b80a4084dc0c3a528b5d91e1fd00d92ba47f4ae9c1482c50244e6fc85701e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102366, "uuid": "bfd53c03-5fce-4134-af59-4dc83f98c28c", "value": "T1EDE4231B63281271D5F7DEF14CBDE520A3F3B3D26865C106CB8641D64A82B51EA6BC2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102366, "uuid": "c33d6cff-58e0-4c4c-a164-ac727a766de4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102366, "uuid": "d296a964-3da3-4f30-a876-0e0fef3476f3", "value": "12288:qzNwnqs3y44sAG9IfTE0GjlFdDCJYvHn82JoqBenNAAxaCGJ+ZKu0BBvwcMRHgCz:fnPAG9IfRclXJvH3mqBuNAOaJxuGmcq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102366, "uuid": "fa0aeeee-311f-4135-b60a-c8348f38ad14", "value": 692744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102366, "uuid": "87ed434e-a1b2-4593-8a86-ea74627894bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102366, "uuid": "73a7743e-e072-499f-9c0c-33d84b6f4a70", "value": "NEW PURCHASE ORDER.png.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8097dd5a-d5e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1709089647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709089647, "uuid": "b148d51c-ad44-4ace-9938-aad48d7c410c", "comment": "Malware payload (njrat)", "value": "7179bf027be44fadde85ec011e11ce7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709089647, "uuid": "3467e766-568b-4f53-a91c-78cb545f9c74", "comment": "Malware payload (njrat)", "value": "59a15e2c0a04e3dfaa3817f01cc6aba53c58b34b48437bef7005ff3bbb936e56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709089647, "uuid": "3941e115-22ec-43ee-a5b2-7e15c35d7a57", "comment": "Malware payload (njrat)", "value": "a676e347f43c0fddc515997ade5b02509bdd1fc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709089647, "uuid": "4ae3353c-276c-4661-bb68-51fe1e0ab400", "comment": "Malware payload (njrat)", "value": "7f46f270bdcfe4b1248e9cc69a56e76d0694a8b38b7c642c7e0cb3a39d9da387213bc8e6bca5366fbc5fc10069b41cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709089647, "uuid": "e6e61693-02de-43da-ab8f-93bb4e4e1a2c", "value": "T13CE207067BA54225D6BC1AFC8CB313210B72E3478532EB6F5CDC88CA5B676D04251EFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709089647, "uuid": "a7b4d27d-0d30-4025-9ca0-f1fcd8b4bfbe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709089647, "uuid": "dd0a3fa7-d538-4ab1-b24b-4932c7695fa3", "value": "384:k0bUe5XB4e0XOOPV4GeyWTctTUFQqz9zObbfG:hT9BuNWDaxb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709089647, "uuid": "17d6bcc2-ed8b-4e3a-929c-58f8eb0f8355", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709089647, "uuid": "1089cee3-c115-4cdf-9547-5ebb0b5c4005", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709089647, "uuid": "70befff0-4e2e-408f-a42b-61f7d89e85c6", "value": "bTOz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed21487-d634-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709123144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123144, "uuid": "d3648d80-f9f0-426d-9123-fbc6438e7a24", "comment": "Malware payload", "value": "7b0100c1ecf96b4a13f5cbccd8829117", "object_relation": "md5", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123144, "uuid": "88dadca8-0097-4f16-900b-ca6940e08732", "comment": "Malware payload", "value": "5aa317d3682ff127e1e92d2016c08f94be60937a1b8a210876d931d072386336", "object_relation": "sha256", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123144, "uuid": "fe79fa9e-9175-4ab3-96c5-ceaa8c7a7045", "comment": "Malware payload", "value": "882f6bb80d2a3aeb721614748ece69745c6e4810", "object_relation": "sha1", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123144, "uuid": "7e738ab4-11e0-4736-8848-d16139afef6b", "comment": "Malware payload", "value": "9afaff4a7a85da4d2e8cd170959fa43aef85bc48b01f4fef941f865832fe26770c4c623d891d4e6df811ade211f3eee1", "object_relation": "sha3-384", "Tag": [ { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123144, "uuid": "0f08743f-b9bb-4615-9987-a907aa6859fb", "value": "T16D2633E6E1ED90E737714AF87486CC40C99A2ACF5ED548FC10C3EAD6494FA34C84676A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123144, "uuid": "1af1dac7-3032-4958-9b73-42fcea3b56ed", "value": "98304:80LUwkpKdk09peb1mH9ckhoXZ+fVYkHnps:86qp6Pebg9BhoIVYkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709123144, "uuid": "7e621c47-2baf-4919-af6d-f4280525e933", "value": 4682320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709123144, "uuid": "e0c0973a-2df7-4419-8b2e-7b87c0ef624f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123144, "uuid": "ecd7f09b-0392-49a1-a4da-b626538cc9e2", "value": "jobinterview.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c00aff-d655-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709137294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137294, "uuid": "349e18ee-259b-4ee1-8309-d8ec54ae5477", "comment": "Malware payload", "value": "7fbec356556106209d637059bc551604", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137294, "uuid": "83983ad6-0ceb-4f5c-93a0-6bbecbf3b6a2", "comment": "Malware payload", "value": "5d558cf0327726b279e1d2d4d7eee130ef6fe0d25e237738228a09a3fb879f46", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137294, "uuid": "3d5fc7a2-a624-44de-82f7-121e6821c8cd", "comment": "Malware payload", "value": "fa74d3e9503aa07a57f53bf471d5753001a722df", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137294, "uuid": "510d5486-feb6-4718-ba8c-29e0ce1aeb5c", "comment": "Malware payload", "value": "4093703229f036211193cce009381db2da0573cae54345f91e919dbaa5ef3e1e9e7c0dfc6629438dbab08461d79b0a51", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137294, "uuid": "e3e740e5-bff3-424a-b9fc-f67385523be5", "value": "T1B543F168056F6935E6C29479088E02FD5370585D87B1B2DE35AC33BE7982CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137294, "uuid": "c1cb15e1-0fe6-4ee0-8217-e3cd76da9b0f", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYweh0:BoOAcw7nXDUsOjm3jTxh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709137294, "uuid": "01a43251-3eb3-498b-a8e5-191673122507", "value": 56841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709137294, "uuid": "fe40e3f9-0ebf-416a-9551-b00838ba3efd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137294, "uuid": "6a98e142-5469-44c1-baae-1fd3d28c78d3", "value": "scanned_doc#2024-27-2_7808.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec837ea-d679-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709152726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152726, "uuid": "251d2df3-c60b-4f1c-8b16-e30e353eaf75", "comment": "Malware payload (GuLoader)", "value": "78a3f243f86c704061840fa19c97e680", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152726, "uuid": "560d883c-00f1-4e12-9184-05d014d0ba02", "comment": "Malware payload (GuLoader)", "value": "5e53f33ac64e81cd29a6a6e5ccf38eddeed853b351f5887fc0c79b4ec8915312", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152726, "uuid": "e6a11ed0-d25f-472f-a815-29e660a53be8", "comment": "Malware payload (GuLoader)", "value": "600b76a6925fbd2f69bd4a22d2509322e5a4474f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709152726, "uuid": "f638d445-e71b-46c2-a278-a0c28bfd9968", "comment": "Malware payload (GuLoader)", "value": "a0d58a7b31acbfff59b22b0022c296aea55189a6e8e086b5e17a611417649e17336764ef614aee694c7dfedea2905d50", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709152726, "uuid": "41d66f61-c12d-4192-8841-083956ba7e6c", "value": "T11103F148C647ED8C101ACA3B5A7B03D60517A6CE46D9F42072DFB6296FD6280CD7BD36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709152726, "uuid": "25cf0ce3-f7ea-4bbb-964c-ef424ebe267e", "value": "768:EcTrjNw0r7IbsirA2tLRKZeS0grnO2e0OirLA6y0LMJ89efhkEfy:EcRlg3vKZyd2nOiHfAJ89efhkEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709152726, "uuid": "4466d541-0128-41ab-adb8-141f46330d38", "value": 39824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709152726, "uuid": "8f6bd268-687f-48c2-9d53-327d677582bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709152726, "uuid": "0a90aaee-dd9a-48c1-a35e-5075f6496fad", "value": "Payment Advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8ae214-d61f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709114042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114042, "uuid": "02fa5f3d-b6a2-4807-95a7-bf8419a61d58", "comment": "Malware payload (Mirai)", "value": "9d91d84b9ccde1fdc4b9f69e3179264d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114042, "uuid": "17414557-f7ff-4de1-a263-9f2148b33bb8", "comment": "Malware payload (Mirai)", "value": "5f093a77c32c8058258a25aaf77cd95b8d29c456a00e8fa65ac51ce9e70cae51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114042, "uuid": "159d7a09-7abe-4237-9d17-c0a8053fca10", "comment": "Malware payload (Mirai)", "value": "4e18c2d60e60462df6f43193c7988c11a5305a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114042, "uuid": "dc9b0587-b402-436b-a6bd-ed5f02b57ae2", "comment": "Malware payload (Mirai)", "value": "e65e1d94f7327b4b46c01ce356ad4b7da1a0e50e1651d589c6188f82ada901f49b61501e44092fde7d32e27531526a6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114042, "uuid": "216ebc97-f275-481d-9605-45a67d052caa", "value": "T114833881FC41A622C7C11677FE5F018E371553C8E2EA32079C295FA03ADF95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114042, "uuid": "fb77f507-0ef4-4d8a-ab5c-7940aa7003b8", "value": "1536:ROEdOGfs3JoOCICa33eZt3p3KwSH3KsUHcbvn:ROEdOG9d63wGwS6J4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709114042, "uuid": "43925e2d-a561-4efd-b1c8-43124ab64201", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709114042, "uuid": "ebab3461-74ad-4b27-a568-0ffbcb9b8315", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114042, "uuid": "32b68674-580b-469b-b18f-eed72f8bc6f1", "value": "9d91d84b9ccde1fdc4b9f69e3179264d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb608225-d644-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709130225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130225, "uuid": "1f930093-ab3e-46fc-b046-e49328c7bd10", "comment": "Malware payload (AgentTesla)", "value": "e5d7d8c1340a76589cb26d0d5aa64575", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130225, "uuid": "aaade748-785c-46a6-803c-a83638e1fb94", "comment": "Malware payload (AgentTesla)", "value": "60fdeda779dcdb89493442339ce5ee674a18ab5ff7aae58c8213389df81d81dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130225, "uuid": "00a1faa7-dfc8-4c85-bc39-4964bccc3999", "comment": "Malware payload (AgentTesla)", "value": "730aff3b734828670d55942ca8edd4c764e6a541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130225, "uuid": "580b842b-2e4d-4888-b07b-35ad4f13d53d", "comment": "Malware payload (AgentTesla)", "value": "6cd488289ff1597af0c1aced33333f7bcb72341fe10b8d5f107803f0d3ca7a8028bf0d61a201b0fb2da6f1ed24549af9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130225, "uuid": "b59ec6c9-5033-4a0b-84fd-b3905f6a6072", "value": "T171D423228CF6B33DEFEC5099D55A0107A2F3517AC0049CE9B7393202E672917AA7BD53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130225, "uuid": "93d40ae8-873e-4581-a858-af547be2ccdf", "value": "12288:A5PudmiUx0FZ/iO654KZYI5y4XZ3S51/mQi0DIoWDydF7W9/35bteNPij:A5Puoh0//i7ZYI5yOZ36Bmd0DIoWDyTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709130225, "uuid": "c94c9a2c-2184-44ed-b81d-e2d78ad46106", "value": 620857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709130225, "uuid": "281733c5-a8c3-4813-9ba1-7610a71ebdc4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130225, "uuid": "60473535-1b8e-4774-aa10-4233a65a5ebb", "value": "nSC_68899267099268_46889090000_____.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007a9737-d645-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709130234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130234, "uuid": "43148281-2836-46fa-97d0-b23475fa2db9", "comment": "Malware payload (AgentTesla)", "value": "15352355072eeca0c4daebfc81873b12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130234, "uuid": "52d0075c-2d10-46d2-a039-314890ff5825", "comment": "Malware payload (AgentTesla)", "value": "611cb5bb898a10fd2ec7afc07b1f45eca785e427b28bb683fb4d181bcf056baf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130234, "uuid": "6d3cde7f-4306-47b7-bf05-88be8b7670f2", "comment": "Malware payload (AgentTesla)", "value": "671fa8d5f44b373f4eada3200199c78e3a99ac9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130234, "uuid": "c6ed30e4-c9a2-4475-b9bb-eef3b6a8203e", "comment": "Malware payload (AgentTesla)", "value": "90d9ffc341b10fb2523b5ff309f7402d3b642f15a5724c7107461a46b6f19b00ce16754321f351896c7a22c2185349a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130234, "uuid": "1f3ba860-123d-43cd-b313-64d84669de83", "value": "T13335BF1363DEC365C3B25273BA267701BEBF782506A1F56B2FD4093DE920122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130234, "uuid": "b2e3bfde-b2a7-4d05-b444-eb230b8217a6", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130234, "uuid": "130c8702-b278-429e-9657-75b09247454c", "value": "24576:ltb20pkaCqT5TBWgNQ7aiS0D6oWDyF7M35btwCgk6A:WVg5tQ7ai7D6tM7Mphw65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709130234, "uuid": "9780a2a4-50e6-4dd7-85e4-b703f6db461f", "value": 1059328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709130234, "uuid": "203f1022-a71f-43b7-92e2-9b7b3ad9213d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130234, "uuid": "6b56382b-b94e-4456-b0ac-0b08e6e0027c", "value": "z60SC_68899267099268_46889090000_____.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64dbd03c-d61c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1709112793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112793, "uuid": "7aee0301-f977-42d3-aa15-f0b1c85ee7d2", "comment": "Malware payload (CoinMiner)", "value": "b8e2ec7d64fe3156c5f684b3a2757301", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112793, "uuid": "0d336519-207a-42db-b842-7b8411d547db", "comment": "Malware payload (CoinMiner)", "value": "61b322051908949b1fe40f5ab5995cec4c2f1abb6628e5f798cab8a91f42d0e3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112793, "uuid": "50029536-d2bb-463c-84d9-29af0785c8b9", "comment": "Malware payload (CoinMiner)", "value": "565db0f626a875be0ba5234963727e45c01f3ca9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112793, "uuid": "228bdf12-0ef5-4a99-beaa-94d726d243e6", "comment": "Malware payload (CoinMiner)", "value": "6c1999de2d5e26d562e4a70d1f2a0b9db3aea027fbe1ebd5e4303cc0001857f00547e49504b1d6d99ddb4282499f802c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112793, "uuid": "1f9867cd-699f-4a2d-8813-0188fe514a41", "value": "T1F8F63312B391C131FFAA91739F69FA0296BD38354263852F13A82E7DB8711711B7E613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112793, "uuid": "979a6e40-969f-4b08-a093-9a3ec060160f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112793, "uuid": "52501f5a-2edc-400a-8985-d7e8e11ad210", "value": "393216:OccUL96juOB/a7LOupqeRbz9rmGuXrERtpyw7c+AiT:FZJkazpqeRbrdZyAc+Ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709112793, "uuid": "f9ee0e07-7465-4855-8b91-f061ae167483", "value": 16772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709112793, "uuid": "574d7bfc-0bfa-4acc-b80c-89e7f47442cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112793, "uuid": "087839ff-9926-4ac4-8044-67411838100c", "value": "SecuriteInfo.com.AutoIt.Injector-JY.190.10007", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc53593-d67b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153855, "uuid": "474e6fae-b695-40c6-8750-bf2edb6b678b", "comment": "Malware payload (Mirai)", "value": "a7470dfeaf2e8c720abbbe6983137442", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153855, "uuid": "0ac5a223-663d-46fe-b640-ce1f5db101ee", "comment": "Malware payload (Mirai)", "value": "653d289411503095351af9ddf7594a69f5b1d3564dc02e1e62b58b17e32f9ae5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153855, "uuid": "a35287bd-cb61-4da2-a7b9-b885b87b8a51", "comment": "Malware payload (Mirai)", "value": "3cad11a201df0ab0ec36634c1cdac8af12665241", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153855, "uuid": "d6a9046c-7e88-42d9-8ed6-183cd3495adc", "comment": "Malware payload (Mirai)", "value": "642b1eeda704294df1ea919fadd0590b0cedbaf691023748831597681fda655d9d3429e8ca1a471832ba23c22a6f4434", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153855, "uuid": "23cd97fe-6e6f-481a-a0ee-efe2b78bc7ae", "value": "T1F0A35C06BB1C0987E0531FF2393F1BE193ABFE8021B59584694EDF0A91729362547FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153855, "uuid": "b2985666-c05a-4246-9291-e22b206b65e4", "value": "1536:hY52cYR4SRptzG+Njtcn8BOIT9TA4yYn9qPKLFdssGv:qRY3RBjtcKN04J99Qv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153855, "uuid": "a64136d6-da31-404e-9795-73e5b3498585", "value": 99812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153855, "uuid": "ef4b35c5-a2bb-4b53-9a62-231167a7c8b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153855, "uuid": "d46ad061-f74e-40db-8dd1-b99efc737c39", "value": "a7470dfeaf2e8c720abbbe6983137442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b776cdca-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1709145144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145144, "uuid": "4dfb6245-b9fc-454d-befc-5d5f433b5d7a", "comment": "Malware payload (Glupteba)", "value": "79d4dff9174adc484693a231b3bd7af2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145144, "uuid": "50cb030a-0453-4baf-b96e-478333e9a49d", "comment": "Malware payload (Glupteba)", "value": "6667e1ab4f79b6ed3869ccfa9cce86551d54cbfa4661a2350eee40e6a7a8faf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145144, "uuid": "fbec61d3-8a9b-4fb0-9784-eff1ef865a79", "comment": "Malware payload (Glupteba)", "value": "63d80f54a2b560ef4227d6aca4934ae606f8b4a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145144, "uuid": "7e3b60c4-6558-4911-bf0f-c1926dcb7ca6", "comment": "Malware payload (Glupteba)", "value": "8e70c2940c2d4e4d0eee855fb04fd245e74cd9709b25b46e631249a96856128ff962a011ddff4bd1a0b2f4d5801161a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145144, "uuid": "32c169d6-77cf-45f2-b6a3-56bb5788a79e", "value": "T18716332079B0D134E7BF1436552AED109A7BB8382E169EA776347F5F3F30266AB41321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145144, "uuid": "8d859f58-1b77-4af5-be58-9ccaf0400ebd", "value": "095ad42ae522f1afa7e24afbb4c74732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145144, "uuid": "b0615348-f0d2-4d3d-a178-8d5127338879", "value": "98304:xMzAMLpWeVBMfi1O79l3dk/dJxFamkHdK:xMzA2W8BMCq9RuxFAHY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145144, "uuid": "9c870a2d-30d1-40e7-8d8c-1a5eb4b2977d", "value": 4346256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145144, "uuid": "4767378f-fb6c-4c65-aa3e-e9f067d7056e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145144, "uuid": "79cc3a75-0ba9-4d4f-b5aa-1068c956e15c", "value": "79d4dff9174adc484693a231b3bd7af2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996124d2-d63f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1709127913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709127913, "uuid": "2986f035-fd13-421c-94ed-9373eb81d50d", "comment": "Malware payload (Adwind)", "value": "efd645a5c1c5a8ebfee8f1cb2a139920", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709127913, "uuid": "283aa9a0-0cda-43f3-9fd5-f5a49e9f6d2a", "comment": "Malware payload (Adwind)", "value": "669a95f4fb366c02950b52b86f5d906dc150bca3fa710453a49eddef3471a333", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709127913, "uuid": "3c652961-f2fa-48dc-8754-5bb571bf52d1", "comment": "Malware payload (Adwind)", "value": "58e80fdbabec6c26ba09d7c34ee075b0be6017c2", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709127913, "uuid": "0a2b5a4a-b2aa-4685-8bce-a380eeaf5338", "comment": "Malware payload (Adwind)", "value": "6fd6bb01aafb2ef3b0b113fac2fd7c03abd716756019c3b145f161e6c98bb574b9a932b48405536af7535902a8550ffe", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709127913, "uuid": "adb93c7f-d034-4759-9f5e-b75ce32cc842", "value": "T18AD423CE450A20A9C4F0691CA08899FA189E7D30717B74ED3A5CFF2DD75DEE6E226470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709127913, "uuid": "6fdfc77f-9ff1-4e0b-84c3-a856bd21fee1", "value": "12288:y2/TdQOo5CKAGqMJIBKGUuR8PALJj28/VSVjMkbdMY02C+HLzqE:yo5MJ/GhRrLJj28NSVjjbA2hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709127913, "uuid": "6bc2e1a4-892f-473f-bd48-fca416e2ef80", "value": 637528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709127913, "uuid": "9ebf7e13-7560-4bb3-80a7-50478d689489", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709127913, "uuid": "05fc1b0c-2867-4f9a-925f-59c31f5175eb", "value": "27 payment swift copy of the remaining paymen.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d412aec3-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709129730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129730, "uuid": "9a2bca7f-1db1-4764-bfb3-aa742ad5175e", "comment": "Malware payload", "value": "00a43889967feddf18c364641ad900b5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129730, "uuid": "590803f3-493d-4c56-a18d-b0350d2ee415", "comment": "Malware payload", "value": "674703f364fdbdd1d1a762eff7b4a75090b9c235abd89b374196d709900b3d87", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129730, "uuid": "f4d981a0-0264-4fbb-94ed-de05697caa4d", "comment": "Malware payload", "value": "195cd6f83d64b4be282d42bafd9124c59980ef8a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129730, "uuid": "63b32b5c-e1fa-4ed3-8786-19643726f132", "comment": "Malware payload", "value": "6bf557abde61a216fd7d9c72c874ceb6233a09bc94dde8b4161ae7aac4cb4ff8acba07692ea2d5fa2f16b481e38facab", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129730, "uuid": "171ac731-ba12-40cb-b98c-4441f5eb9c41", "value": "T1FB130176F8398C15DA53A1A731A8911981E40D3E26AC98CA372AFBD07603DEB16354F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129730, "uuid": "8dd81776-70ae-4b69-83d9-67fea35870d8", "value": "768:L8YaDFNBAia4pT4Q/XcJNERAeAhRKQaBxw4h11PSeNzhKAasVk:RaFI4p8Q/Xik0hRKQMFh11Pn3W2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129730, "uuid": "9c078962-b7db-4682-9027-97c6d2fea898", "value": 42016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129730, "uuid": "0a43662c-b2fb-4c9b-b287-18de447a6d42", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129730, "uuid": "40b76f38-36d3-4e2f-8d48-da76400d4993", "value": "EUMRU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a678d8f-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709159510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159510, "uuid": "de281717-44d3-448d-975f-da80054e6a27", "comment": "Malware payload (Gafgyt)", "value": "18911893e250176a83f0d6a71d1c94a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159510, "uuid": "a94e253c-407c-45db-b265-0e70111de871", "comment": "Malware payload (Gafgyt)", "value": "67b53cf9971068804e3687f544b1624eb227e904983e62b087d0005fd0451a16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159510, "uuid": "0ff4d184-d5b5-4c7d-a708-45aa2d66f9c6", "comment": "Malware payload (Gafgyt)", "value": "cf0b814b4fc49dcdbe2a7f64a59b1195a6611b90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159510, "uuid": "1993c0c1-cc85-4a6a-a6a2-46e159b781ac", "comment": "Malware payload (Gafgyt)", "value": "0328ae0cb8188f77151d4e986d6037075e64c996fd635ae2e7ad44ebbebd8f8f1061cfc9ae72240a6b8494ef2403b1a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159510, "uuid": "1fd95f8c-7ce9-4839-8931-437a8e84d751", "value": "T1E8449513D6150866E2554CF232673284BA56437FCAEB32C3F91A1EE0BFA095B0577ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159510, "uuid": "e9843dfe-f361-4e64-9f3e-38c26a649295", "value": "3072:MSLyRnJfPMRUZuf0hzmcbgqLvumPwLXZHlpH+tjIv7jaYLzFR3hrXF9Uvbyr/4dr:YUvvb59UvbM/4d1C53Iwy7rmxQNdXqs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159510, "uuid": "29e25e75-6913-4ee3-bcf7-3b5176fac9b9", "value": 262537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159510, "uuid": "dcf229a9-50b2-49d5-a98f-e603c6386098", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159510, "uuid": "97ea4fc9-927b-425b-a18d-b44382bef991", "value": "18911893e250176a83f0d6a71d1c94a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a4ae3d-d5ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709100424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100424, "uuid": "b460db86-c5ad-40ea-8725-2766d3437878", "comment": "Malware payload (Mirai)", "value": "d457f574d2aaba647c38249303573d09", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100424, "uuid": "1fd3583f-8571-42d2-b7a2-da84f35cefa0", "comment": "Malware payload (Mirai)", "value": "6a327a4c8e75b9b4180730ee54f72f608a62c67c2797f1d37200a6921794b7f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100424, "uuid": "778ec16b-ba2b-40cf-b317-aeca099498fb", "comment": "Malware payload (Mirai)", "value": "aac08d5dc79bb4c50a8abcb3086af4db66e88c1f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100424, "uuid": "47540429-d63a-48b6-a82c-f419f0179865", "comment": "Malware payload (Mirai)", "value": "bb0dce2c832e0b07361f65fa8d81d29d51605b6ba8d356e65f41759d704575788798ace0d46611262d0ed8c0fdf1ff71", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100424, "uuid": "582fdecd-5ece-428c-a5c3-bb227b2abdd0", "value": "T1C673B70A7E329FACFBA9523447F78E11AA5833D527E1C685D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100424, "uuid": "897c45d3-1518-4c10-a254-69fc3fef0c49", "value": "1536:3IHb8FMv77EKQHly4R1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyuFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709100424, "uuid": "8ccaae17-c56f-4676-bfa3-8781a1f4ccd8", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709100424, "uuid": "89927d8e-f553-4326-8fa8-e3787678d602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100424, "uuid": "bbb5a3ce-ef8b-440c-8959-fc3f72af3154", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc8135a-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709159465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159465, "uuid": "815794f6-8f99-4009-b4b9-d843d9be65fc", "comment": "Malware payload (Gafgyt)", "value": "d30dc84826305e0588faa237fb19ff24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159465, "uuid": "d449f811-c1ba-4617-9fe4-4323b8bb8392", "comment": "Malware payload (Gafgyt)", "value": "6a6131d0a817d22649f70c13fdbe36f3ea727045647b5f0410a8209f37539d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159465, "uuid": "5a5f2202-5cdc-48ea-9bc2-71a57dbd16cb", "comment": "Malware payload (Gafgyt)", "value": "ed17bf7cab1ff80d8e712284658869cb37255af6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159465, "uuid": "73ff8bc0-c812-4568-8acd-c70d6e3d7341", "comment": "Malware payload (Gafgyt)", "value": "2182bb7e42eb10e1effd111a0095b0944d89feaf801ff075c1a32e04c944cd88427b3384d8683a26a98efde5cd4aafdf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159465, "uuid": "3cb8492b-76d5-499b-a35b-4206c563991a", "value": "T1C154D617C2110866E29519F272673280BA57437FCBEB3283F9191EE0BFA4A5B0577ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159465, "uuid": "df99bdbc-e1cd-45f2-a9d2-5665bfa26a6c", "value": "6144:AYYcatHJ2y2+z4RZedkAM/LBHM/9zm6wxTIe+5:AYYcatHJ2y2O2LAMds/Nm6WTIe+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159465, "uuid": "4fa092bb-2912-41fc-a900-5ac462dda79f", "value": 304714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159465, "uuid": "e85c5d2a-4d91-4aec-8656-978aae2d455a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159465, "uuid": "110bcef5-4bd2-4cd7-988c-4c536abf51d9", "value": "d30dc84826305e0588faa237fb19ff24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7292c9-d60a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709105075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105075, "uuid": "822f3948-538c-4a7e-b7f5-658dc303acc0", "comment": "Malware payload (RiseProStealer)", "value": "30155e7f4a969469743292812f646ebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105075, "uuid": "8947e9c9-5abb-4b77-b5dc-360b69e2bd61", "comment": "Malware payload (RiseProStealer)", "value": "6b42538bcce4e24e1fea634e9857991a6a98bdb89c3d6c7ae502b478960e276f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105075, "uuid": "ee72eba0-aba0-45e0-9e89-737dc62df70e", "comment": "Malware payload (RiseProStealer)", "value": "bad98dcc01bbe63cf42dff6356461cc21c002e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105075, "uuid": "6562f46f-0a8a-4e70-99e8-f79782c93b76", "comment": "Malware payload (RiseProStealer)", "value": "9ed44d8f7c2a553497e3f3f10d7a42c865d4b89a58723b28b0096d0ab5c4740eb33cc3453df826e9ad857ddd09a08256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105075, "uuid": "0568e742-6b14-4121-b0c2-9c3f1865d937", "value": "T1A2B533A571B14832CA2C49B4227D9BF8075ED5D2010985E165B33CF97AF2A72D32AC7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105075, "uuid": "445febb0-2e4c-4f66-be62-a5e8fffa94cf", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105075, "uuid": "a20d4cc6-cb86-4aae-a456-e549a0fa4e3a", "value": "49152:7qfDlk8JxfoxVxDR4i+z590CWACMmfvXku3ne5dO5/7eyq6:2ltJ4P+190CtU0u3nePOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709105075, "uuid": "09c7d7ff-484e-4296-81a9-99426e54893c", "value": 2317824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709105075, "uuid": "8c0635b5-ecb9-479a-9be8-27488c849b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105075, "uuid": "a78e29c7-c5bf-4f1d-8771-e9c81ee61271", "value": "SecuriteInfo.com.Win32.TrojanX-gen.25507.9615", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138f2361-d65c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140144, "uuid": "c6c7f65c-092e-4cc1-b989-67b2e112adfd", "comment": "Malware payload", "value": "0228c0ac47993cfffbfd73e7dc6ed04c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140144, "uuid": "11a1e502-93b8-4a5a-8fe2-c04a7f5e4ca3", "comment": "Malware payload", "value": "6b759087a354bdfb16839cd0a7934b35707e44764d0a1107771264f0e00c855f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140144, "uuid": "0b7d4988-37e4-4816-a504-8d2af3f1a17d", "comment": "Malware payload", "value": "a1688149bca54c0b005a30765705bf7a2703094e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140144, "uuid": "97f86de2-0f00-43ee-b81d-a78db7ebaedb", "comment": "Malware payload", "value": "ca67d38f3c426d6272f8c431ca4cccd18f37cb2d4c103bc2f6d1fc8892ff3c8b12546fba8a54329cdb4117ef1d17cb36", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140144, "uuid": "6dcaa929-c7a0-4f9a-b3ca-3d541f131f22", "value": "T18A4302784157A816DB82C83E0DCD02F963506C9E87E2F7EB35EC62BD6482CE641D87D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140144, "uuid": "77b2e591-642c-405f-83a4-60b983d152c0", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdzoC:EoOAcw7nXDUsOjm3jTX6otf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140144, "uuid": "88212ec6-9fa6-4d01-b759-8708df8827ac", "value": 59513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140144, "uuid": "629cafd9-5577-41af-8734-f0b996ef54e7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140144, "uuid": "d392ebd7-6094-4606-b75c-d1c4b0917415", "value": "scanned_doc#2024-27-2_2499.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08811da9-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153870, "uuid": "64f5963f-d285-49e3-b8e1-16f5a20d525f", "comment": "Malware payload (Mirai)", "value": "bae0c9d003927c8a3d45bc9c037375f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153870, "uuid": "7a1c2f04-e967-454c-9ace-ca77a4c69a4c", "comment": "Malware payload (Mirai)", "value": "6c7e5641ef487524708c94c585d8575bee343c25e1fabcb2b49e9ae26849e5f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153870, "uuid": "4651e9e6-e7f8-467b-8de6-b80b073acad9", "comment": "Malware payload (Mirai)", "value": "8eeb9e9c7adbab720d41a9f9be11b36a60a6e43d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153870, "uuid": "6255cc66-972b-4e9a-802e-e8aad30fb337", "comment": "Malware payload (Mirai)", "value": "73c65ffd660ba76a9e5f47e9023b1ecb226c204bca0fea88a51254a0c29d6ee3d0d92d7f472e362fc57586e3fbe32078", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153870, "uuid": "4d906bd7-98c8-4c26-b94e-3cad077f510d", "value": "T17EC3C60E6E319FBDF268863547B34F20A79833D623E1D688D2BCE5155E7024E241FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153870, "uuid": "b079ef36-dabd-4f82-b364-0655cac9fe2b", "value": "3072:0rG6r/Jvx96mBPYEHL7Tg1UjBEEGUBGxIr7M+jQ199n:qGw/Fx9ZBPtL756Gkf99n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153870, "uuid": "89e2ddcf-3644-4d67-91b8-2037489a3f39", "value": 126704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153870, "uuid": "4ff0c24d-e5ae-43ae-b735-3bb3dec265a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153870, "uuid": "8d2fc6e6-dec9-4fee-a570-1abcf91b23c2", "value": "bae0c9d003927c8a3d45bc9c037375f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11624cb-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139550, "uuid": "3a04090b-e579-4893-ab1a-0f2b71a0c58b", "comment": "Malware payload", "value": "34a8b9df46f5c5f4932ee6795f73ca46", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139550, "uuid": "caef8a6b-fd3a-428a-a572-e30a09cda6ce", "comment": "Malware payload", "value": "6eb32e06855c07560bfb676e62a024be2b5842dbd5c23df14c56e329cc58fc53", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139550, "uuid": "f17f9ad9-ccf1-45df-a1c1-39560d662239", "comment": "Malware payload", "value": "451e212b96980cb0295c27bfa99a3b552073efaf", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139550, "uuid": "0c6d3699-d834-4f53-8c04-f0022a5d59d6", "comment": "Malware payload", "value": "7947a262b2664099e337c6ef37ec096a3cfd3052aaf3ebd1d230ce5727408ea6a55a9150ad46d78320f6b5bcd942654b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139550, "uuid": "3665c8ff-b0b5-48f7-bf82-83e78526a8c9", "value": "T1C843F168056F6935E6C2D479088E02FD5770589E87B1B2DE31AC32BE7982CD512E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139550, "uuid": "2a1e5a4a-dd82-45f3-ab34-9bfa5457710a", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehT:BoOAcw7nXDUsOjm3jTxhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139550, "uuid": "6af463ac-a988-4c0b-ba1a-26cd0d2c50bf", "value": 56839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139550, "uuid": "b005f85f-9f46-49ec-bf05-67c6efd1f890", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139550, "uuid": "cca3a7ca-d5d9-45cc-824b-d94ea31c5e32", "value": "scanned_doc#2024-27-2_9336.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68eb8b73-d605-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709102921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102921, "uuid": "999c2d3b-8949-4033-a312-a40f9a2c0335", "comment": "Malware payload (Mirai)", "value": "97056cf394ef5a52b91e15ca6ab3eb21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102921, "uuid": "4d1f9911-cc22-44d6-86ca-ea486f17742c", "comment": "Malware payload (Mirai)", "value": "6ee637c94312c719dd30b5ab57b9e259955229faaaf1a77970943415b5475106", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102921, "uuid": "035bbe09-2d4b-4654-a64c-c5e7dd7746ba", "comment": "Malware payload (Mirai)", "value": "4b329debecd266818d20b325c78ca165c3f63573", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102921, "uuid": "41b104a8-5610-4c43-9346-5164377fb916", "comment": "Malware payload (Mirai)", "value": "345ea349f46e000204c2f1f6f2a6bd84deb11cbc8190faeb7fe8c0d452320851c19d102c7e8895375dc9fa12a7a4a904", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102921, "uuid": "620f815b-0799-464a-8312-09d43611041e", "value": "T18973AD33D1686DA8D0668B75B9988E309B23A28416933EF6D794CB784013EECF505FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102921, "uuid": "eaa015a6-3775-4b50-af73-6c1e82715206", "value": "1536:9aD/MEGvbwt+i7EhHlJn8C/0rrnmFElrKkNGIkFgCJl2c:9OkdzeEhFJ0rjxlOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102921, "uuid": "684a8cd6-6bfd-4b31-855c-1788a9dd5842", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102921, "uuid": "4889c040-7655-422f-8c31-456add9b1d15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102921, "uuid": "0c2baad1-2217-4a3e-8c9a-150a98d5e1b4", "value": "97056cf394ef5a52b91e15ca6ab3eb21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "040eeff7-d628-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1709117785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117785, "uuid": "ea90c4bd-3946-4f7c-b779-0ab62b6c4353", "comment": "Malware payload (GCleaner)", "value": "cdbe5940e879412657ff487987a2b5c4", "object_relation": "md5", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117785, "uuid": "e76b9421-3183-4eb5-a97f-e8c73b8d0176", "comment": "Malware payload (GCleaner)", "value": "7140ced2ed7a8b9c78747664295c547bb00379a1ef92cb4b389cf74065bd02fe", "object_relation": "sha256", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117785, "uuid": "416002ac-c420-41c5-a354-86d82a30838e", "comment": "Malware payload (GCleaner)", "value": "91f17898b60087fd93ece48325685f4cdd425b8e", "object_relation": "sha1", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117785, "uuid": "7a5e32cf-e89e-4235-ab58-50176346fc1f", "comment": "Malware payload (GCleaner)", "value": "b4e0bae20b000bc38521ead9ad8740b25b54893ee0c53d818d1266393658d10f4ce04bc7d5618213527c562023ad1cb0", "object_relation": "sha3-384", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117785, "uuid": "b8b3a707-d84c-4d5d-a198-2910f542279b", "value": "T14F942311600283C737FA55C21FD6ED16D751AA7C523AB6D2E60B109A4CFFB851E6FB20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117785, "uuid": "15edb9c3-16e6-4487-a417-ee471128771a", "value": "12288:oouOR0Pi74Uv310EjiwF8zmAkpmQk67le5PEXFn:FuOQoRN0wEhyk6Be58XFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709117785, "uuid": "61cd6bb5-7809-43ed-a163-3a869d9f58e3", "value": 423073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709117785, "uuid": "798376bd-ce4c-40c0-aedb-a559d8192d97", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117785, "uuid": "600aa57b-5508-440e-a4ef-1e8aed60380a", "value": "Payment_Advice.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e885d4-d65e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709141304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141304, "uuid": "7cd4c623-07ce-46b9-b4b9-e2d542cfa73c", "comment": "Malware payload", "value": "05fcace605b525f1bece1813bb18a56c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141304, "uuid": "4fa1afc9-f738-448e-bc13-b93beeff0ff1", "comment": "Malware payload", "value": "720afa3e1216a9eb68b66858d50de0326f52afa279ef9ee0521aee98b312382f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141304, "uuid": "ea4ff722-d9ec-47ba-8b6d-0ca4a2f38454", "comment": "Malware payload", "value": "a3218432f34aaeabe253d07efab27bb7fff2061c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141304, "uuid": "b1545145-ad44-4244-9e04-ee2a5df79679", "comment": "Malware payload", "value": "58db2692b39d66d6771505a96843ca70ebe409356f52539485b04516cf3748d468bc8ba4516b7edfe411ede4712b2079", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141304, "uuid": "6be21954-138a-48e6-841d-eab1913e7e03", "value": "T1B2E32B333319C075D59E22B56839ABBBC36AAC24DF7541DBB7C45E2A8C600C36E71A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141304, "uuid": "599c9e0f-aabe-4597-86bc-3a9214b3105a", "value": "b2f39d39d5cfb3df2afa8e86204f4dc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141304, "uuid": "06734c26-d72b-4e57-8680-d77945246ea3", "value": "3072:bDqLoXus3liGvU99QPCrpgZFAVpBAq9Ttne/3m48:bGLye99Qarp4+rmqNk/36", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709141304, "uuid": "cb9fa924-5884-4b86-b772-1d0bd29c5765", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709141304, "uuid": "d2587ed3-7048-4896-93fb-255c911e62e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141304, "uuid": "f08bbd00-8897-43bd-b183-9282577fdc66", "value": "SecuriteInfo.com.Win32.MalwareX-gen.26023.25717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bba9760-d605-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709102899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102899, "uuid": "83b6818d-7561-4615-b969-2a3b34a2a732", "comment": "Malware payload (Mirai)", "value": "d82b8aed6d880b82d1ba40a88abf9b99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102899, "uuid": "9309e1d0-6330-4496-92a6-cb1d33509ab9", "comment": "Malware payload (Mirai)", "value": "7219da0b6a1e0e280b91e012f492961df51fdaa05479ad304f85689d33b40084", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102899, "uuid": "17753791-4fc6-4d52-925f-60d59405e2fc", "comment": "Malware payload (Mirai)", "value": "d91ce5dec90dc29f906aca8d5ba57825f80a8049", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102899, "uuid": "e05d3428-39a1-4690-8697-14f8ab1ca750", "comment": "Malware payload (Mirai)", "value": "6c86b7e3321baf92f8037cb5e29494d7c4a3eec610ebcbeef50196e39714e2e30d3be410097deb1a268dcb970e493769", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102899, "uuid": "28894feb-e7b4-49b8-bd69-53d79d18fc15", "value": "T11D832A9AF400DEBCF88BD6BA40664D0EB930A39016920F367767FE933C23095DD56D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102899, "uuid": "52c5d5a9-26ef-45cc-b382-bd75fa071e46", "value": "1536:qLf0+QM5PHyVwi7f26UiEy+DlOo7HL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fH+DMkSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102899, "uuid": "a755a9b9-de00-441e-a14c-f4b5d4d1b31a", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102899, "uuid": "e1986bf3-a3a9-424c-98cf-c2c3279fc89f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102899, "uuid": "9aa035fc-6515-4c22-9920-26d6656ab365", "value": "d82b8aed6d880b82d1ba40a88abf9b99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c43af0b-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709125583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125583, "uuid": "4bea1dc1-1e1d-42c3-abd8-d33d711e9844", "comment": "Malware payload", "value": "27acb8e17993015bf48ca1e771af2c1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125583, "uuid": "c08f61af-157e-4240-b66d-06510573eb7f", "comment": "Malware payload", "value": "7254be918aa1883d6d3c19372c863b057b81cb6854d102c00885f7a0a9f69761", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125583, "uuid": "dcdbd39c-e7d5-4a8a-97dc-3cff7b430194", "comment": "Malware payload", "value": "0c406632ac521296233d2a6c35267e87368f3ced", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125583, "uuid": "96106994-f31e-4522-9901-1bc234aba34b", "comment": "Malware payload", "value": "07e1de7765f3c044b69e62bd36d80af568056d57e54d3b5ed72c93a8332f6c852f0b5af9b9cda7168232cbc3743b88c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125583, "uuid": "389f8af0-2be5-4a49-b011-b2737b0b4262", "value": "T1489307A7F801DFB7F44A977604D74B217A30BBE24A531622731739A6AE722C53823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125583, "uuid": "7cb6a7ab-5db8-4f1b-9532-81b93fa3198a", "value": "1536:rlfuecdk80LHcGdRTWQm00ZGkll9U/n5nAy4xgYkkTmQBVqDrjewfz6Q:hadmLpd8TN4f5nAy4xRkYmQBVqDrywfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125583, "uuid": "2ebb1ba7-f42d-4dc2-9eab-70e7c9f29d64", "value": 94649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125583, "uuid": "0770edb1-e55e-45dc-a10d-e98c437cb87e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125583, "uuid": "ade5c359-dd9c-4b6c-a695-4d6ae2ceec60", "value": "27acb8e17993015bf48ca1e771af2c1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4641ff-d604-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709102717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102717, "uuid": "7b503f21-3129-4503-aac1-d6b645d671b1", "comment": "Malware payload (AgentTesla)", "value": "eec9920c7f8ec7c4c1b869c0c58e9475", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102717, "uuid": "ab80b604-85a1-46d3-9042-2e28e4a4c58e", "comment": "Malware payload (AgentTesla)", "value": "73e0732124b786a80d0cf5723d7946267338cb2cd92a547dd7f2bb1d77d1d366", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102717, "uuid": "04ccf8e0-bb0a-4f1e-96e7-e7da491f8c6b", "comment": "Malware payload (AgentTesla)", "value": "1ef6bd5093d3e3f4b742d0ff30cfa5c0f4b7dc2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102717, "uuid": "23371c04-5073-4ea6-9e29-84f88794b5cd", "comment": "Malware payload (AgentTesla)", "value": "61786884ce8f35522bb76d1d48260f3d631021feb02ce983d2d883fc41bd15dc95f72ce24e7253f921fd110a6bd30794", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102717, "uuid": "f2c3f092-04fa-4761-8906-bf96d6144213", "value": "T1DEE42269239C9607DCAF4EB4167294404B75F4A73E24EBDE2DC824CF6AD6BC09341B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102717, "uuid": "20545dd8-9c04-447b-835f-99885f173635", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102717, "uuid": "f68575cd-3ce3-4ffa-ad07-ef6ef4552ea3", "value": "12288:/4oL9bW9ez7dWceoN6xcHFpsDavL6ZsN593GwNHVl/Zd4xurX1lyz2kR:/tL9iy5XSaQDavL6mN593TN1f/3Qt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102717, "uuid": "eaa0f9da-045e-45d5-829a-9602efa06ade", "value": 722440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102717, "uuid": "825c916a-77cf-429b-bb75-2ce56fcb9f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102717, "uuid": "957e4e19-2f0a-43be-bbda-52c890aa21d3", "value": "consignment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb917f6d-d64f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709134843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "472bf5e4-69a4-43f0-b4e9-e3f813917e39", "comment": "Malware payload", "value": "150aa35188f0854db82db6dd9a49e5c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "b48853e7-ace9-41ac-81ac-75dcde69636b", "comment": "Malware payload", "value": "74c513cfcefe956a1ebe5c7196d31319580523c277333b59816ed48456ed75b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "a2603df3-c769-43b2-b51a-e06df08bfb72", "comment": "Malware payload", "value": "06fa7dd5a6fa96a89c81347aec55ee450e6547c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709134843, "uuid": "cb601101-e918-4dc3-a012-348230415361", "comment": "Malware payload", "value": "7f6be20bff32e454a85061a66cbfb801196b85e02eddc8e9f7b6016cd70fbea7dd17d28341074c9a10fea919742a30d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "86440c85-e0b1-4c04-98ea-4a3fea881d25", "value": "T12334DF2172A0C877C48A153005B5C6F5A63EFC12267D829BF7647B2E2E703F09579F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "a933e007-2365-48a5-afad-d350a628c6b8", "value": "fa9d771b11e0f02db434815b765f591e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "48ba1e8b-f481-4217-a041-d2a2fa76a210", "value": "3072:Qh7Q4Q0XvbjssSymTTDvfHNzj5edGiG401KQSeJJxwSNhwlXyRl8Y7:QFHQATAsS3DvBdedGqdQSmxN6hy8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709134843, "uuid": "81246363-6085-4dfe-89e2-ffbf88332b0f", "value": 237568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709134843, "uuid": "d8bdebb5-355e-4d4d-b9bb-450866827d7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709134843, "uuid": "14a09684-8c06-4035-83c1-1d53bef76c6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f080b6b-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709159518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159518, "uuid": "451a135b-89d6-437d-8a08-6f49f5bdbdf6", "comment": "Malware payload (Gafgyt)", "value": "b38d0ef3a66e4bd4b6775e13d72bea70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159518, "uuid": "0597d368-eebb-4c09-b937-b94ef64901f3", "comment": "Malware payload (Gafgyt)", "value": "75a1f310b1585477adcb213e281891c820f40366c7705c4367f1463faf0e9795", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159518, "uuid": "605b2ae9-072f-49f8-93b0-7074a968abb7", "comment": "Malware payload (Gafgyt)", "value": "94809c937f4a3e36ef3df70ab94607c0ed61e4d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159518, "uuid": "35ba9145-c79c-4dd2-a814-a69b76c2885d", "comment": "Malware payload (Gafgyt)", "value": "8fdf19210626ef7e077e777870deab13c5ff0ce2877d4650dcdc2c69a93426271ed776faa3f8b0c829934304b45ee636", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159518, "uuid": "79926419-6c09-4979-a332-77f92ffe2679", "value": "T11954D713C2110866E29519F272673280BA57437FDBEB3283F9191EE0BFA4A5B0577ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159518, "uuid": "2fd49ac0-907f-48d0-aadc-338c8248b166", "value": "6144:AYYcatHJ2y2+z4RZedkAM/LvGZxVzm6wxTIe+5:AYYcatHJ2y2O2LAM6fVm6WTIe+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159518, "uuid": "73120289-3353-460d-baac-38e37a1aa9e3", "value": 304714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159518, "uuid": "b0c4dabe-8776-494f-9821-927967adf319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159518, "uuid": "87b0d806-2ec1-4e5f-a3d2-c47ffd288b4c", "value": "b38d0ef3a66e4bd4b6775e13d72bea70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43649e5e-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709125622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125622, "uuid": "051e876b-ecaa-48a9-89cf-c6458fd7b2e8", "comment": "Malware payload", "value": "1998f8110ffd0956331f66b1d36bb362", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125622, "uuid": "927eda6a-a5e8-4dd2-96bb-3635b3c04799", "comment": "Malware payload", "value": "782039b72c9d9af27e71788a1c29355ba91a656fb964f636b1547e5368916364", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125622, "uuid": "6df747f1-edbb-4086-abb7-1fbb2983a425", "comment": "Malware payload", "value": "d5707332da953620a3896b8a61c9e845bbbf43d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125622, "uuid": "f48a4174-8acd-4419-b6d0-1cf5240995da", "comment": "Malware payload", "value": "5fef7989b523ee95950d19379dc0bde55e27e35ef34610f2e0c09d888898bc684b25d7bcc0858c1f1132e64fe968a591", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125622, "uuid": "74a75ac1-bd51-4cbd-930d-5a0f8e55905c", "value": "T1EAE31905E6408B57C1E2277AFACF824A33339B94A3D733055938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125622, "uuid": "a4c1f812-7c03-486e-ab38-05a6543948c5", "value": "3072:VuKa9pFonY9O+tQG6ht2ndlRM/9FOqcfASmtwfBxRQAUN:MKa9pFoY9qG6P2ndrM/9FOqc5mtwfBxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125622, "uuid": "add6c593-9f53-4e38-a8df-8117647420b8", "value": 154202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125622, "uuid": "08ee0eba-cea9-4206-bd33-cb8216f7aaca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125622, "uuid": "36eee9e5-94d5-4d9b-a384-92ec1dfeefb6", "value": "1998f8110ffd0956331f66b1d36bb362", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a39eba-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156814, "uuid": "85404f0b-8a61-4fae-836e-8c5a85574158", "comment": "Malware payload (Mirai)", "value": "9f78bffd4bcb4eb91fa4d53b45fa7d1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156814, "uuid": "b4860bfe-371a-4bbd-8a2f-bba753cac938", "comment": "Malware payload (Mirai)", "value": "78b9d954f81756d5193f5ac5ea325aa6d088a6f4bb58ea4dcb4dae63ced3d88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156814, "uuid": "4dc21b65-aeac-4be9-8675-75fe199d914e", "comment": "Malware payload (Mirai)", "value": "e3cd6d46d359e535a231faa31d2a89d823ddc1c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156814, "uuid": "c3e646fe-ca9d-48c3-877c-390acf758ec7", "comment": "Malware payload (Mirai)", "value": "30a45c22daefd5d082faef648ecdbb41ff116b30cb4540501febb0ffa2c33d271fc15f5b7448db70ec60956f5abccedb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156814, "uuid": "4ec9574b-ea03-4bed-82cd-f96d64bdaadf", "value": "T120434C21BA761D27C4D0A47A61F34715F2F1479E24A88A1B3D720E8EFF21A8066477F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156814, "uuid": "ca748847-45f5-478c-8d66-a2d5f3fcd148", "value": "1536:fMemUZsSQO9uELl5pik/Fe9rLYM5K/EHCDtyZ:Uem0JfM9rLY8NVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156814, "uuid": "2678db9f-e4b4-4f78-ad37-da6d4af6a29f", "value": 58768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156814, "uuid": "6320e0ae-e973-4871-a175-9f55a22d8f5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156814, "uuid": "08520e01-3008-4237-811d-361dc191d8e2", "value": "9f78bffd4bcb4eb91fa4d53b45fa7d1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db712c0a-d5e9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709091088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709091088, "uuid": "e7a68451-1d1a-4577-ace1-d71830188668", "comment": "Malware payload (RiseProStealer)", "value": "0d3ef129f1743cd0504a584f7cc44e19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709091088, "uuid": "bc11f88e-bf84-4d2b-9f1f-b3bd322a6639", "comment": "Malware payload (RiseProStealer)", "value": "7bc333604e72b08b856d87e57fc315f3d80e087f1aeeeddf2ca405b6278e40f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709091088, "uuid": "c0eedea7-eaba-463e-8415-c3aff4ea5f0a", "comment": "Malware payload (RiseProStealer)", "value": "9543357faf17f62099bf4d9fc2c2e11c5279c601", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709091088, "uuid": "d8c5d53d-76ef-4bec-8391-3401a1752769", "comment": "Malware payload (RiseProStealer)", "value": "c85325aee939cd37d6a1073f0a9643a106335c1aeeb9ac053c994215f3884d7b77a46f8b3d97122bb23d25ce20c43afb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709091088, "uuid": "c006eb19-d1a1-46f4-b651-526d6b6e2d02", "value": "T1C7B533E7AF779B30CB3663B222CEC74308379B6095B016BE7634B8D57993712120E586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709091088, "uuid": "e94c82df-3da0-4318-84ae-f6dbb41ef0e3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709091088, "uuid": "1fff606d-2754-4fef-b834-0e61c50feb65", "value": "49152:tD92lFJZ/0OO+VEaS4KwL0NF+PQsncTeyIJpOvyOP27xX23:6nOEEbDsn2cTOvlPg23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709091088, "uuid": "bc3fdaef-7551-4e55-a153-893ae48c1e25", "value": 2305024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709091088, "uuid": "dd72a8cf-e15e-4179-8ec7-abb16a3db2e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709091088, "uuid": "7dcc548a-ad5e-458f-a640-f6deec59eec9", "value": "0d3ef129f1743cd0504a584f7cc44e19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a3aef3-d68f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709162346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162346, "uuid": "698e14d1-a090-4181-a70b-afb60c420936", "comment": "Malware payload", "value": "a91e03ad9ab8013830296daa9ac203c7", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162346, "uuid": "d61cf5da-1a9e-4364-bb4a-08cf43bbb673", "comment": "Malware payload", "value": "7d240a704184e81da7679f5ce4a2c06129fa994d601af0cf594919c204c0a1c1", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162346, "uuid": "683709b5-670b-4b69-b167-add6cdab707a", "comment": "Malware payload", "value": "81b3f06fa6e08037d59e8abbed948b2e28cf2b76", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162346, "uuid": "6fce1105-f066-4225-8647-f9b11725f338", "comment": "Malware payload", "value": "ef0ed38fbed77dfa7773a308bba93f2461423551fcd32a0be97bb03e56075dcb680a27c4cb01df765c012af44cc834e9", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709162346, "uuid": "0268c9f8-fb76-465e-b201-104449afd219", "value": "T137052ACAD6081623ECE835056E38D0BB4F14CDE534A482D6DF6AA7DEC529D973CE740A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709162346, "uuid": "f1b46baf-0742-4dee-a7e0-b80bbcbe7ed4", "value": "6144:aSrPGb6pFz+J6dCcfOMcXLtEGYKM29+9oPyv1LIpc1JRqSYs:0EGd79UoPyOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709162346, "uuid": "e7ed0823-fd8c-4486-90cd-00a6aa3abb26", "value": 838802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709162346, "uuid": "9aa12a84-0304-4e3d-b03d-27e216ec3b4d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709162346, "uuid": "173e007c-4e67-4214-9c26-46d0b915ea26", "value": "3ff3_message.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34985b67-d65c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709140200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140200, "uuid": "9107e15f-caa8-4392-bab0-51cb669f87ad", "comment": "Malware payload (Formbook)", "value": "9b058252907481b3b6a453a5271f4b61", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140200, "uuid": "dbbe0fd4-3ffa-4e7a-ba2a-a095fdbf58b6", "comment": "Malware payload (Formbook)", "value": "7d4354a64db7e3825e598906bfb96fe9fcae4f632e6cb5a21b77465605f2dcf2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140200, "uuid": "38c3f2fa-7d85-4813-95b1-f87013fcc424", "comment": "Malware payload (Formbook)", "value": "534abbfa1f22f457b10fdc24b29ea58a4428d608", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140200, "uuid": "468bc113-368a-4e99-bda5-522a65464906", "comment": "Malware payload (Formbook)", "value": "ae9d028eaf15b635053e01201a73e8ac681e772bc568081b559e48cc8f000f37a1106d16c17d9ad5b6f8e898c4f4ee66", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140200, "uuid": "df149620-4eca-4e3e-8022-405aeeb2532f", "value": "T1AEE423F4ABFC34692CA9B47D8E0542D6FDA51E38958EC36B4EAC638773915160CDF0A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140200, "uuid": "e8712d2c-e403-4aa8-b0b0-cc0fae48ef88", "value": "12288:dsIZrmNOApWaq2V5ZpY6ZhDBqtK/SnRlB5YFwHbqgYlScYff5:dqo0WT2VDdhDw06hRcMf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140200, "uuid": "bd4c2df8-f802-4ef5-8761-3089e0513f95", "value": 681889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140200, "uuid": "08113d23-a3c9-4ded-9833-12287593ee3c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140200, "uuid": "f83fec27-d91a-43cb-8773-4a3ef6fb9fe8", "value": "SST Statement- FEB 2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702bd44f-d60a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709105081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105081, "uuid": "1dc73ba7-925a-4172-a017-1f325382c1a5", "comment": "Malware payload (RemcosRAT)", "value": "02ce4e91e2d84af4f71f84ed27765356", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105081, "uuid": "8fe5b542-1bf6-4dfa-8de6-1351fd3ab0a8", "comment": "Malware payload (RemcosRAT)", "value": "7d9bee4647aad795531feb6eb3dabe03a3244493c489759bbccedfecb2d11f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105081, "uuid": "380aeb22-b49d-42cf-82e5-eb1889f8f258", "comment": "Malware payload (RemcosRAT)", "value": "9c3abaac7a7adc7bdcfa8c89aa5c742824fdf48d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105081, "uuid": "bfb3ad66-236f-4bad-bc03-fec73a0ed67f", "comment": "Malware payload (RemcosRAT)", "value": "f2ad94d2eaa0c20b9a0fffd69f9e786045990181b4e0eaf5cf0ab008be2578d09ce6af9b85c595f5c17bc00aa5e7ef6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105081, "uuid": "af7ad3c9-4634-4e04-aa1c-b7fc71a8245f", "value": "T15B65AD2153A2E936F0F75A78648D430BEBE67D51FE8AB9402BD53E1C69F0692F930113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105081, "uuid": "03f1a544-22a4-4de7-840b-ece324d4dcfc", "value": "7c5a4bab06926700ad6797c5d4d8c6a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105081, "uuid": "0ba1d8ab-9922-47d8-9d6b-8b95c3886cad", "value": "24576:r+L1gVG0tnercn/0B6qsArOLEgvNmVM+q6JqKLWWW6eswifa:r+LX8cVAEiCZqy5WrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709105081, "uuid": "23172b50-2b1f-4feb-a39f-7a67b895da00", "value": 1461248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709105081, "uuid": "8f134971-ad52-433b-ba9a-c1422c04c46f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105081, "uuid": "c0abb2e1-fec1-4d38-b36d-0050fd65d5f1", "value": "SecuriteInfo.com.Win32.DropperX-gen.10565.11333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c8fac2-d64d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709133897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709133897, "uuid": "30e09e82-e11f-4e1d-abfd-8634c7f509f8", "comment": "Malware payload", "value": "2c816bef3cd7f3f367e6b94761c2bab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709133897, "uuid": "9fb864bd-2788-4e01-9460-4954a3099fd9", "comment": "Malware payload", "value": "81325d0c1a73cad7402d2020c15304cba466ecc7919061cd16762f655019c038", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709133897, "uuid": "926678d4-8f3c-4d40-adbb-7168c7ebc567", "comment": "Malware payload", "value": "791c10407dd5df2abee9b87afa09306bd5d7d93c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709133897, "uuid": "01c9ef08-5842-4f7a-9677-412c86e11fe5", "comment": "Malware payload", "value": "5e5106465b85bf06a7debe01661d9dd892b08160418ab940165f7e798252938a5aaa9dad7d8ff35d25a8d5842cc480a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709133897, "uuid": "3a55badc-d61c-462b-9b4d-1536bc5d8e73", "value": "T16834E1217781C832C4DB153858B0D6F05BBEBC222671868F73A47B3E6E717D149787AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709133897, "uuid": "c0002bae-e39c-47ee-ab71-aeffae609364", "value": "fa9d771b11e0f02db434815b765f591e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709133897, "uuid": "24d789c7-39e9-408a-a4c7-c51561a3fc8b", "value": "6144:FA3Qqn4PxoQMZIlkEPTodF8vtH5ofRaG:FaQqG6lgkWM/StH5ofR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709133897, "uuid": "3df9dd4c-d173-4e6e-ac8f-4a84822a8030", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709133897, "uuid": "946fe060-3cb5-4ce6-a29d-69a3173217ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709133897, "uuid": "67cb9109-8973-4900-9be9-7cfa6e240563", "value": "2c816bef3cd7f3f367e6b94761c2bab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48986457-d623-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709115752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115752, "uuid": "0a2add14-d873-42d2-ae29-45c102e6b4dd", "comment": "Malware payload", "value": "c58c1846fa7e64b14d7de0690d5f0296", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115752, "uuid": "beacdbd7-7264-4a2b-8de7-492df70af481", "comment": "Malware payload", "value": "81bdedb1e5b2c9183559fe921c5e708992eb6939c1529708d112f599ac24476d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115752, "uuid": "c5b9d92d-c7b5-45c0-ac41-95996fa90ce5", "comment": "Malware payload", "value": "f10788dd72d677d68657ab834dddf99d1ab3ab88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115752, "uuid": "83ea9b44-140d-4ca3-a5f9-77c58570cf31", "comment": "Malware payload", "value": "758e4aca29f2c386bc5d718b885a140baa5d20a1a8cb0224eac83b6b83fd6aa097227c4715815ce667f27039c1cb7a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115752, "uuid": "a2c1e8d8-9d68-47fb-8b52-d04a52cc9d70", "value": "T150559D0733A6C0E8DF6791F6CA295223E772741507389BDB24E0592EDF93EA11B3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115752, "uuid": "0498c5a9-34ed-48fa-9861-09ccc619f932", "value": "2004a5f6f543f8c26e144c1ceb66f943", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115752, "uuid": "0244d3ab-1894-4dc1-ad06-007954f7f834", "value": "24576:GjdvkUZ0pDZe+Bczu3+ZO0IRR3wTkgr9BNpiUU11Wsp1Igj20wqEiGK8xyw:GjdvkY0pDZe+Bczu3+ZO0IRR3eFr9B/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709115752, "uuid": "8c6e8188-ae09-476e-a8b7-cdf8e8003427", "value": 1318400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709115752, "uuid": "25c9ae76-e0c8-4c73-8df3-8ffeea11bebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115752, "uuid": "a5841797-20d0-49a1-a81e-7794eb130443", "value": "SecuriteInfo.com.FileRepMalware.29389.28556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d78c41-d61c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709112790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112790, "uuid": "f20e10b8-23fe-4c0e-ae71-4183dc6ed74b", "comment": "Malware payload", "value": "6020906ad6408fef253f61aab74905cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112790, "uuid": "047fe1a7-467d-4710-bd4a-d4e3c76ff591", "comment": "Malware payload", "value": "81eef8e03d9e5bcfcbb20113c49e642e725d0da9bfd57ac352a8160d044d5b02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112790, "uuid": "040a2b3f-c0a4-4076-8bc4-db841dc6e2f8", "comment": "Malware payload", "value": "955a943cf0d9ed7744bc05cb8751656e0ddfe69a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112790, "uuid": "0ed5d534-4ab3-4f54-9349-27ab97b98263", "comment": "Malware payload", "value": "87ecdade92fbaa90bf440eabd61f43ad1d385db8e1e9082395eef5c52de79b12259723e515e62ab3f5c521954ed010d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112790, "uuid": "d3841c3d-95ac-48a2-8d11-4ab18e553403", "value": "T184B5339ECE3A7094C5F68E365A9303DD2A38FBA800C5CE7DB6812C6D0E1BA654547D3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112790, "uuid": "4e3b2f9f-2737-420c-af56-6472a34f06a4", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112790, "uuid": "88bca31e-ed56-4972-b441-0d5bf0aa512d", "value": "49152:dX0JE5Ubt/2A4fHtyVjQLn0XcFi226vN1ElY9orZVbpTGcSv461yqnWj3M:dXF0olHtGjQLn0y26sbpCXJwqUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709112790, "uuid": "da953db9-6752-4779-b7c4-196a9ffba82e", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709112790, "uuid": "45a67bd8-812a-44d4-bc9c-ddd396a92537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112790, "uuid": "8c56e9bf-a486-434a-992d-52d6d9bcc430", "value": "SecuriteInfo.com.Win32.TrojanX-gen.6034.21204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0c6b41-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709159488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159488, "uuid": "e4794043-b593-4b7c-9901-746793bf1f63", "comment": "Malware payload", "value": "f397c330209eaff88a73bb7d62b8c8fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159488, "uuid": "1b359cf0-54ad-4b24-b4ca-dbf4b2a9bde6", "comment": "Malware payload", "value": "83026aadb6e24d98a05a695af9ce7bb83fbcbe4cdc82a69c812d1b6fc7fe5cb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159488, "uuid": "3d5606f4-0563-4fc7-80e5-29f705ca334e", "comment": "Malware payload", "value": "fc39bdc3d3883837f1dcfda555c9b4e195f66dd4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159488, "uuid": "2eff22f3-36bd-4bbd-8c79-06f493850041", "comment": "Malware payload", "value": "9dac735945b4be2a91d4d0c6cf9d7034956d78a99e72bf4f72b511f7c8d584f0b67b382a3fb7a25e21f5a03f1a8f0a9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159488, "uuid": "0d4c7e42-5ea9-4524-ade0-25030612db1e", "value": "T1D044A523D3260865E15848F121A73250EE9B837BA8FA21C3F9561D94FF64C5B22B7FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159488, "uuid": "62df2664-5723-4684-b87a-425d7591a170", "value": "3072:bw7lYC+lo3CIeqQKZPF8KQfgmyt92gm4wA6GYm5:bGlYj12ZPF8Lyt92gm4wA6Fm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159488, "uuid": "0400283c-730a-4f4a-a7e6-e8f04d30e8a6", "value": 277302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159488, "uuid": "55d0cca2-b85a-4ab6-aba7-12cedc724c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159488, "uuid": "1f24de52-d5d5-4b5e-b12b-979263525d6c", "value": "f397c330209eaff88a73bb7d62b8c8fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19c508a-d659-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139202, "uuid": "09047859-3330-47f4-9295-3e603372ea4b", "comment": "Malware payload", "value": "f211626bad8f9e3e9ea50a7ecf856672", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139202, "uuid": "4897cb90-5983-4b6b-907d-31d5b1b00da9", "comment": "Malware payload", "value": "836b1dc10f650b64e9a8f4b716c12e2b64ff3fd9e1b7c06b7f7c9f7c8b18b071", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139202, "uuid": "8006c1ed-e848-431d-9fd4-5771fbdce80f", "comment": "Malware payload", "value": "dee3b69aacb8a4c172ab77ab0f339d0d0a086e01", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139202, "uuid": "a55c83b2-4d32-4fa6-bf79-a34f9f8ab2aa", "comment": "Malware payload", "value": "4c348cc155369a3929a06ef33c63a44988651e4b4025e6c3d4016ad3809633281b3abfc4443d0acb98dfa35b09d5474f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139202, "uuid": "118cc285-a06f-4c03-a487-8fa08be580b7", "value": "T13EF4F24679C66F3AC34E0D74C0F6420DE73EBD529E42AA8B25517A5B3AF222167D1F0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139202, "uuid": "60cb2800-ae4f-4885-923b-0881e30bfdad", "value": "12288:Aa8tp4gqWcuRi/Oh3+KZwIJ4GImU0ct41rbt3oqrb3A9iBUg8utyo++1Ciww:AZn90us2hOKHJ4G771hhb3UiBI4C6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139202, "uuid": "1ffe441a-4abd-4025-92a5-a613247bb910", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139202, "uuid": "8783e0eb-92ed-4e6a-80b0-8d37e30ab009", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139202, "uuid": "858a2efb-6d1d-4290-a910-f153d6f0e02a", "value": "Offre Commerciale Geocoyote 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24f540d9-d664-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709143610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143610, "uuid": "54bb8ade-b442-4ea1-b2af-75e385e0bb3b", "comment": "Malware payload (AgentTesla)", "value": "b59fdfa1bc3fab9682efe169673b860b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143610, "uuid": "322b0310-6869-4e15-8e99-58d8d1ec8aa8", "comment": "Malware payload (AgentTesla)", "value": "84225e449f93fe49be50ad0b5233f1666ac856db99b201d1625a0cefbf07b2e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143610, "uuid": "9eefe697-dbf6-4d51-8b1b-b7981836145c", "comment": "Malware payload (AgentTesla)", "value": "9029a816e934ad5e5545171c0bb4b4594e9dd7aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709143610, "uuid": "cdf35b08-f47f-41c4-86fd-4ff60087e9d9", "comment": "Malware payload (AgentTesla)", "value": "c049159316e4f7127d0ac31da8e9350c1ae67f3ddcc9cd63a5e6438051c9503261c7c4ca8b75aca0c6062a4ae990a4d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143610, "uuid": "4e1e8757-1d00-4b08-96c1-96eec1425619", "value": "T194E423F5639D0A24E3FF92BB053A52051B723613D951EFA60491E98726F3F01FA0398B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143610, "uuid": "17069dc9-8291-4c12-b316-34599535a0ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143610, "uuid": "e0b30fcb-52d0-4eba-b4ec-0e16cfeca58c", "value": "12288:wzNwnqs3y44sAGBqD6iGj1EPoGtaUvNbKMYecJvk5CYxZsFzdZGdrLNhN3b:VnPAGBqD6mbYwtKMWxk5bxZmq3NhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709143610, "uuid": "68c1bd23-d15a-4a31-b154-fa18be24d999", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709143610, "uuid": "4a361e50-33c0-4bbb-bb00-32c7f2cf0119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709143610, "uuid": "63815a13-b73a-45e2-b600-c0a5b1baa0ad", "value": "LPO_QUOTATION PG2024-02-0170.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b4188c-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709159480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159480, "uuid": "edf30be4-888c-48ab-8592-1b3349af805d", "comment": "Malware payload", "value": "67bc5265087a881b87590d2610feca04", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159480, "uuid": "1a99adbf-6361-48ec-9b3d-2a80471560b5", "comment": "Malware payload", "value": "854803dcde596b7cc7dd17d7ed80a1e54e74556a7f28075e629bd37936c57809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159480, "uuid": "89468bc5-6b9f-4775-9faa-c31a9394d931", "comment": "Malware payload", "value": "15f983b5cc777d5815299d924bc18bde7b0de1db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159480, "uuid": "dcf7c482-d4c9-4a5b-9cdd-eda38f2aa808", "comment": "Malware payload", "value": "64b205f23f8a629db3131915e3199537e73a53a39f1e7bb1107f74fa7a5ebc936d221b9601d11517d1da34f39fede9d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159480, "uuid": "8129a850-f488-471a-b99e-c9f7063ec8ea", "value": "T1BA449427D3150499E6194CF1256733D09F9A927B88EB20C3F91A5E90FEB182B11B7FD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159480, "uuid": "234fa042-281f-4452-b297-0406a1264785", "value": "3072:rJukIg85bOflDv9dhQvgNMu2cvmxqfPRO5:r8F+d9df5mxqfPRO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159480, "uuid": "3263d3de-079b-424f-ad3a-e8f79f8546e6", "value": 256578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159480, "uuid": "123003a3-09d2-47b0-b006-037ed8581f6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159480, "uuid": "3bcf2395-a097-4f81-a9a1-5f5073c9e6c4", "value": "67bc5265087a881b87590d2610feca04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd90260-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709128246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128246, "uuid": "c89dca2d-ca83-4bf3-adbd-29637c65ee88", "comment": "Malware payload (Formbook)", "value": "daeeb64bc3b2ca69d5062b932d9f5486", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128246, "uuid": "8d8e8cec-9a0f-468c-9606-1133980c7a09", "comment": "Malware payload (Formbook)", "value": "8634a3db542e996337729ffab3913e48633f6422d1cde9a6f743a42a3bf75679", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128246, "uuid": "3fe4234a-5c7a-446d-8554-533fa7ddbeda", "comment": "Malware payload (Formbook)", "value": "d958e304dbd45b11f414034799e005510ff2d94d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128246, "uuid": "0a2f4952-671c-41ac-b92f-2cd3accc4243", "comment": "Malware payload (Formbook)", "value": "fc23537c7af302e616df53b60b5042ec07e59f34d2629591f6203f9eb52b3072ce2d7994e182883d562e067230bee70d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128246, "uuid": "b7172a05-5c02-4104-850a-52f6c71135bb", "value": "T1230512475A95DC17C69352744DE1E37B933CCEC01E2A8B436FC0394ABCB6F9A3986098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128246, "uuid": "aa6adc13-582f-4245-9166-7b7936b25d7f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128246, "uuid": "06aceb03-9897-4716-938d-da6e554f5f0f", "value": "12288:6JTQdb6aT/+OkC2WOPASrfuhheB0IyXUJW+QiAukU30+9Ir/CSQC:mTQdb6aTfkC2WOIOI4qIwUk+T/G/CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128246, "uuid": "f803a5b0-19ad-4886-9385-72eeac2c0e1e", "value": 833872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128246, "uuid": "fdd5abc8-aa0f-4e33-bd7d-74d0dbec1c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128246, "uuid": "d997877d-e766-429e-9019-67065be69dfc", "value": "cuenta iban-ES65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1c1ece-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145021, "uuid": "71caf258-5dad-4885-9cd5-4dcaec56dd75", "comment": "Malware payload", "value": "64eb5832cbdbc22f6fb677d42641291d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145021, "uuid": "de221feb-559a-48d1-810d-49eb26c7d070", "comment": "Malware payload", "value": "884ba88f80bde206896f5ed9ecd452f2ca7a885a5064bcb5d7df4eb0f6269c24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145021, "uuid": "81297cd6-66d6-4aaa-a07f-757b970475ce", "comment": "Malware payload", "value": "c29e096f0005a162632c75884bf2047dd13ce361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145021, "uuid": "518332db-86a7-466a-96f1-1c3f247d14c4", "comment": "Malware payload", "value": "3b1d14f164eada8a2a107aaed02f32f1b85e01417c0627e5a092af3ae8e2685be31c2a28365e72022a5124bb70551952", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145021, "uuid": "811140b3-925b-4471-aa33-bdac6f939041", "value": "T16715C01172D2C832E17502708A676F52AB75AD614D215A1B33DCBF0F2F74F82ED2B266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145021, "uuid": "40d5e47d-4b63-4ab8-9d43-16994f8a0f3c", "value": "f18e0f0c20cc5de7ef64f7db8b2926be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145021, "uuid": "7edec9e4-892f-4018-870f-d05cffc850f7", "value": "12288:9hQWpjqjhO0l8IuoJvzIv9Xmquu9P5hZCzG6O9aGDy0nUR9Bp:9hHjqN3lw1vuIzEGD2V9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145021, "uuid": "727306c4-15eb-4d96-9fc7-d3e468149a88", "value": 895288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145021, "uuid": "7af016bb-e0c2-443d-a1d3-9a53c51e0575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145021, "uuid": "73b6f480-7ac7-47fd-b2c4-0a3da7933169", "value": "SecuriteInfo.com.Heur.24014.97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bee54e-d627-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709117677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117677, "uuid": "d3fb780d-04c6-45be-b355-69b23e3fe810", "comment": "Malware payload (AgentTesla)", "value": "3e5c905416ba4f0c85a9156eb29bc32e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117677, "uuid": "ea58fa8c-0563-4b25-ae87-35beee981656", "comment": "Malware payload (AgentTesla)", "value": "88844a7569de556d31dfdd8cd8f9ec7cc2e8547148c24bcf841e728d61fb9ef1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117677, "uuid": "6468f88b-0f59-490b-ba5f-b84fe68b49af", "comment": "Malware payload (AgentTesla)", "value": "596be8b0ba91e4c23615d690c859c4e42d00d191", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117677, "uuid": "5ea2d2c4-ebde-4070-9498-94ae6f038f10", "comment": "Malware payload (AgentTesla)", "value": "1fe5f0c07aba456cac12f90bd67ea8ed7ff4fbbcc71990035b1a1e9360279429e916da1a303df64ee340fdcb1e8ce6b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117677, "uuid": "91d227e6-860b-4fcc-bd30-d0636cd54056", "value": "T13EF412502EA84A2FDDAB0ABAE135791003F3AC627421D3DD9D96B08D1BF77CC9790617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117677, "uuid": "780c9b69-aaad-4bb1-baf9-ea9d3d5ac45f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117677, "uuid": "c0b1c449-da8e-437f-9de8-d457f469ea4c", "value": "12288:zkCL9bW9ezVAS11I0FaJ/TOp6ZDJREnlKourz8x+WiXKr9bSUhwUPcng83YZpkR:z5L9iy3OJ/3REYouH8xZ9IUhwUPam0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709117677, "uuid": "1ef9d935-826d-49d4-8caa-732a315d5f46", "value": 736776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709117677, "uuid": "74ffbb89-1eda-48e7-a98b-5a4e4b205774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117677, "uuid": "ca80c452-84c8-44d5-afa8-fa5898783f00", "value": "Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1736f0e7-d66f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1709148311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709148311, "uuid": "2ae37336-aaed-4672-85ea-f5d8660dd95c", "comment": "Malware payload (NanoCore)", "value": "a371163105160672ef74269b3ab49e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709148311, "uuid": "043e099f-0929-46a2-a25f-b73fe245250f", "comment": "Malware payload (NanoCore)", "value": "89a1c02dfeab17d26c8a9664588550de3cf2ab3e91cc6c41a89b27daded1ae28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709148311, "uuid": "72abb08c-8e39-4855-b277-a20c486fa5e2", "comment": "Malware payload (NanoCore)", "value": "8caf3d644d69f9c3060f3108df1a9828a7a8be50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709148311, "uuid": "a169dc30-94fa-4cca-9b2c-91c1118187ee", "comment": "Malware payload (NanoCore)", "value": "4e7a4b539d0f2b3a2fe368b23b398017f05dbf017360938d3a3ca9c61da0d34fb38d5eb3666c46b0711349c134d788e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709148311, "uuid": "b726eb9b-0917-437f-8631-4da1f6f8f162", "value": "T16D44BE697B479D29C69E4676D0C220114BB2C397A5F3E3CF2D8C12E11F427E5BA0F19A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709148311, "uuid": "b5a18c92-bc08-475e-bbf3-d28f092f02cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709148311, "uuid": "c254b69b-539e-4b5a-bb77-aec6a018b089", "value": "3072:4biIrvhmFN5sb8SxxTJLIOjj2qULLWbAJcWDqObIifMqtee87oJaUaXCmaJ9JyRK:qiIaMHlnqLL+M9bNMeaNTKIjy37Umo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709148311, "uuid": "bf7858c5-361a-4c19-a13a-1c6886ffc881", "value": 270848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709148311, "uuid": "4555d0ce-7adf-464e-bcf4-a55bd3a1566d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709148311, "uuid": "34a95138-7c17-420e-9335-bf76e1b39a3f", "value": "a371163105160672ef74269b3ab49e7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0529f236-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1709128094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128094, "uuid": "e14d6aea-33af-419f-bc6d-994c436442d4", "comment": "Malware payload (Stealc)", "value": "2c7078b90caee9d791dd338c2441ca32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128094, "uuid": "0637247c-099a-47e6-ab36-c1418d84492c", "comment": "Malware payload (Stealc)", "value": "8ad20c4b4c312feb468a58d1748c0d7abba3dd2d0fb8e6bfbee837c47a0e8c5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128094, "uuid": "ad5504ed-46d9-4c21-8762-43f59c0f5c51", "comment": "Malware payload (Stealc)", "value": "56901d99127fd701353ab7c68e66c94c49eb507c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128094, "uuid": "24aa43f2-917f-43c0-8a4b-9f7131bbaeb0", "comment": "Malware payload (Stealc)", "value": "0fc7d5601e073f84f0807a1e16a7f056ef32ab0e6c2a769c1fc6226d16d504e9001c81448da19433019f191d205b03af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128094, "uuid": "803877c2-e66c-4fe6-aa7c-e929e87a0f4c", "value": "T12B26F0532DD7842EFFF22FACA6F209C3ADAEFA6C0D048D7D81161219854F945D1B6CA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128094, "uuid": "7bcd3c6c-f764-4443-8696-5609b3896255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128094, "uuid": "c65982fc-d2bf-41f9-a5c0-0c89528e239b", "value": "98304:5LGSrOpzjhc9lEoupup/jJ1hPE73PGV6F8bnYFc+x69kDP83i:kdjK9lZuEprhEjC7Y69+Pmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128094, "uuid": "f636119d-e7aa-430d-8168-42d010289f36", "value": 4738048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128094, "uuid": "8baa4d5e-2a9c-40d9-b1d1-0212bf917295", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128094, "uuid": "d14caa14-573e-41ed-b778-bddeeb1a1ab3", "value": "2c7078b90caee9d791dd338c2441ca32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751d00a1-d63b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1709126135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709126135, "uuid": "4a829789-7052-40ec-a913-d6bcbc1c74fb", "comment": "Malware payload (zgRAT)", "value": "04474486e533db51f7f1ff0f8719a062", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709126135, "uuid": "5e7c9591-322c-4e21-8d20-64bbb896b1a0", "comment": "Malware payload (zgRAT)", "value": "901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709126135, "uuid": "85f882ee-8529-4663-8934-4496832a66c6", "comment": "Malware payload (zgRAT)", "value": "0ff77213cc09ff09381980bc9df5dd3f0ca96131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709126135, "uuid": "b9c159d2-76a5-4168-8a32-7fade44228c8", "comment": "Malware payload (zgRAT)", "value": "f118254cfee6aabe99e5167f61e67b97ca849c15ad17edc9a502cf016e7673ceef1568c49a64ddb7b68dde2e7807c3b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709126135, "uuid": "fa199fc4-58fb-49af-b8d1-329051e92571", "value": "T19166294BB644CA10D1186933D6FA7911C3BD67C2632BE24F77D627994E833BF458E08A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709126135, "uuid": "9bebe28b-99cf-4189-a3ae-4835cb08fd39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709126135, "uuid": "fbd90e4d-1e67-4955-b9db-b08038eb4a36", "value": "98304:x6hItKsKxu0hQCmgKec8oLsLS7gf07eA7LUC/yY6:whItKrw0hRcN4kgRCaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709126135, "uuid": "65052007-6a64-4075-9ec9-3153d1cdc80a", "value": 7062576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709126135, "uuid": "5c52a7e7-f370-4bff-ace2-71ee7628fd18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709126135, "uuid": "41cedf88-1891-435a-8839-719ee3f071c6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740e9067-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145031, "uuid": "1cda8c44-cb42-4089-adf2-3e9c38e6b83b", "comment": "Malware payload", "value": "ace419174e1e0c792d028f25f60d6e5f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145031, "uuid": "920f1402-50c9-477e-8360-318026f317f0", "comment": "Malware payload", "value": "90d56b0a1c7e631e5a12985f9b7cc943a1ebc31e40ec53d56dc9149bba74ba24", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145031, "uuid": "f4df8556-6816-40ce-bbe8-6754a7e994f4", "comment": "Malware payload", "value": "5325579a4d960fc09c359c2ec7f2b03a27a9a698", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145031, "uuid": "9f3a7059-aca5-4e02-863f-be50b9c21930", "comment": "Malware payload", "value": "c7c2cbb8eaded2132516ab6753f727bf4051434b4948e60d4f30273681ada3f75d1ecb359133b8c001653ed7409e2738", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145031, "uuid": "d88d20dd-6208-4eab-8964-7c2833634fb9", "value": "T1ACC37D3173BC8A2EDEFB0F78F4694520CB72F9812A42DB8F1D49956D489274059743BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145031, "uuid": "d99d64b7-249e-4c85-8f08-69c2425136d2", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145031, "uuid": "e89dd108-be16-43d8-be2b-6cb95dcc92d4", "value": "3072:QfBa6TWUNuRhicznzcSZRazyDG43vjyMcnFlizejgxKmjkx7:VUNuZjAI+mvuMOj9mjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145031, "uuid": "68bd0034-9029-4f8e-bc8e-266a9939c64c", "value": 128744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145031, "uuid": "9c9b3fed-4ffa-4690-8478-ad0eec057f34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145031, "uuid": "de1354f2-ec0f-41ae-8f84-ba9b0f5b5a11", "value": "SecuriteInfo.com.Program.Unwanted.5492.3683.10648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c78978af-d65e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709141305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141305, "uuid": "235f29d6-60d8-41ce-8201-7c529e8cc998", "comment": "Malware payload", "value": "f58e0dfb8f915fa5ce1b7ca50c46b51b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141305, "uuid": "43293ef4-9f2e-42da-9ad5-31845f018b9b", "comment": "Malware payload", "value": "90fa29cc98be1d715df26d22079bdb8ce1d1fd3ce6a4efb39a4c192134e01020", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141305, "uuid": "d9da8a7a-57c9-4aa6-8863-b958b38098b9", "comment": "Malware payload", "value": "9acb977f13fce7ec38275887ddbbc0f42532e907", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141305, "uuid": "9be85d91-c350-4b6b-bab3-530edac61713", "comment": "Malware payload", "value": "05f2b20ebe430f71846e0dca728b6214d8efe04e1145adf15e31c73cde3a8b1a795aa4b97c094c60d0d90d6b023cc55e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141305, "uuid": "4d74cbae-2266-437e-98a6-abbebd238dff", "value": "T18F431A62365440B1D66809707D69D7BFCBACFC20ABE546CF73891A2AD8D00DB7E719C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141305, "uuid": "5b60a019-829f-4c1e-addb-139df54cc847", "value": "580b32aebb5f47963867d746773cf6a1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141305, "uuid": "2d59e273-2559-468e-85e6-53aa42cc63d0", "value": "768:rC8sPHjgxRIO5h7Ji10Ed4WKn84n2ZePq+RTdFvnM+cmVqDj64Bj:ri/Mf7oiEdXKn84n2ad/vbcmVWjXBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709141305, "uuid": "53dd040c-428c-4c5f-9b2a-bdaa9b0a51dc", "value": 55296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709141305, "uuid": "8a8cbbec-5d1b-4e47-9900-d44d211bd121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141305, "uuid": "2d7dcd05-f073-452c-8513-d50a3586f573", "value": "SecuriteInfo.com.Win32.MalwareX-gen.17353.8144", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23147cae-d633-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709122561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122561, "uuid": "64e91fab-f7f4-4ea0-a60d-a029cba2e602", "comment": "Malware payload (Formbook)", "value": "b64f1f87fdc7e8bd3d053d058fc08f4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122561, "uuid": "e056f408-2522-45c7-9e60-5e03c14c0bcf", "comment": "Malware payload (Formbook)", "value": "92437485dda44372ed6d0baa2e1ff1593e0d43e5c6ef20918a393d83153a1a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122561, "uuid": "2e2fc26f-c3b9-4c4c-b7dc-15af354dc2bf", "comment": "Malware payload (Formbook)", "value": "c3ef7dfe21793f4c98a0b98fa0d8e9b4a00a884c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122561, "uuid": "ff5887c4-3db3-4c87-91f0-28038c6cd92d", "comment": "Malware payload (Formbook)", "value": "17bf1d109113269ef88193f8e2a8cbd87de4a02e67d5a8a5dc7f70921795e3e1394e3d01cedce32837e113dbf461d73e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122561, "uuid": "00f5cd48-9e91-4b18-87ef-06b678013b68", "value": "T1DA1512476B95DD57C2A3127489E1E37BA738CEC00D2986435BC02D99BCB2F9E3D8619C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122561, "uuid": "b7821f2b-edc2-4e38-9a2c-06bd87386f3e", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122561, "uuid": "59a589e5-a6be-4ef8-a3f3-87f226d1551f", "value": "12288:uJTQf8fr0Lblkgj88AXVLzmmbj01qfuhheB0GKc2XUJW+QiAukU30+9Ir/CSQf:CTQfgWkk8RRg1qI4qs0Uk+T/G/CJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709122561, "uuid": "ae0d4ca2-a610-49f2-99a8-6d2381672a78", "value": 883592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709122561, "uuid": "0ae3084d-6e4e-4b3f-b123-8b0029f738a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122561, "uuid": "b7472019-cbc6-4d6f-84e5-2b2290416dbb", "value": "rResegregation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c1b6ff-d680-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709155692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155692, "uuid": "0c48f6e8-5117-4b01-85a2-583a79911cba", "comment": "Malware payload (VenomRAT)", "value": "131c882c85e39c5a7725faf5e4dd9b76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155692, "uuid": "3a1b32c6-0d0d-40df-84fa-690b10f6d713", "comment": "Malware payload (VenomRAT)", "value": "94719056109fa3a6ef4bbb4830c9ba4046689dfad6ee285b8eead02b372fee1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155692, "uuid": "7785c06f-a7b1-42cf-8fe2-43973372761d", "comment": "Malware payload (VenomRAT)", "value": "4f9dc9c53a54bd636e07bce1a9a224513fd40304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155692, "uuid": "93dba1a7-ad6c-4804-90f8-2cb4434f5a13", "comment": "Malware payload (VenomRAT)", "value": "3dbc7883f80d6ca70371b4a6ffdfaa45a7c2bed8fd73ffb30da0b7d983143fc6135dc2e704e360d08d6a7c32969556cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155692, "uuid": "4def2af5-77a5-4ae1-b3fd-d6817cb84069", "value": "T1E1735A013BE88D26F2AE47B9ACF255074EF8D5576512CE5E3CC400CE5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155692, "uuid": "ca4fc14d-84fa-46af-8b34-e0d89b878616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155692, "uuid": "5565db80-def8-4151-b0b4-6c4de3098c62", "value": "1536:jUk0cxVGlCBiPMVeNqien8I8h1bq/SoZnnQzcmLVclN:jURcxVMWiPMV8qzah1bqhRnQ/BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155692, "uuid": "95f4c585-ec6d-4df5-acd9-0e8ba9c46a67", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155692, "uuid": "b8cd3ab8-b39c-4ce6-94eb-5a828a02fdbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155692, "uuid": "4073dbc9-b5ca-41a5-980c-7ae3786734c0", "value": "xXeDBxD9PYDR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e700408e-d68f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709162403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162403, "uuid": "f8a5a646-662f-42d3-a642-647569d52bde", "comment": "Malware payload", "value": "81916a83d2358ca7119052827ab9b1c9", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162403, "uuid": "ef66061a-4ea4-4e77-b9ff-6ca663950664", "comment": "Malware payload", "value": "96cc908d13b98653917f0aa6c84166a2c166c341ad3ac1a9d5a9f599ea5a74ae", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162403, "uuid": "19f9f9d7-cad6-45b9-9c64-e2f6c7015be6", "comment": "Malware payload", "value": "7002224429e73cf07770fdcc5ef300cf7a6975a2", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709162403, "uuid": "a95a5248-d900-43f9-8f15-e3e212e6cbfd", "comment": "Malware payload", "value": "4b789d47f9e04759ae0d01c31d4f4f19eea9352896387c75cb5cecfd02ad5aeefb14814eaff4d41e6bf7eb5df51cf2d1", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HTMLPHISHER", "colour": "#0882C4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709162403, "uuid": "887d9d83-f690-487d-9f5a-2416a01496b9", "value": "T1BC153BDED5481663ECE83505AF39D0BA0F18CDE9346482D7DB2A96EF8518C973CE740A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709162403, "uuid": "9562892c-1184-4ad5-ba8e-241692b34d13", "value": "6144:H3+Lkuz6kuIOgK4mcBbBb+nSreZFGsYgiQHL1lDtLF7wjAO95Ii3fdLGmSkiV8Kd:1oeZFGsYgiQHL6nSkiVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709162403, "uuid": "0bd270f2-f408-47a4-81d7-bae3305f2d12", "value": 948782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709162403, "uuid": "86d926e7-3993-4dca-b2c3-6bec2b3f73b9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709162403, "uuid": "acc92b8c-a7f9-4451-b0b7-81695efa3d86", "value": "sharepoint-docusign009_message.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "516f2c54-d632-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709122209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122209, "uuid": "05e9fe9e-25fd-4073-9e9a-516ed356a8de", "comment": "Malware payload (DCRat)", "value": "648635ee494501409670f2e3b41d6e76", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122209, "uuid": "a60505b6-7c3a-4f72-a70c-ab9e4022b7d7", "comment": "Malware payload (DCRat)", "value": "972fe91915011242e2bf02b1ff007c381b09cdeb5fde90837c53ffe0464bd2bb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122209, "uuid": "acd5fbdc-2a2a-457e-ab9a-8bd402a16e43", "comment": "Malware payload (DCRat)", "value": "1c5cc68a2d36c1ffedd884a94daa0279b98af236", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709122209, "uuid": "1808c202-8f44-4dda-b269-2eb7973d3449", "comment": "Malware payload (DCRat)", "value": "2788cbc6958f4ee2db46012e433a62fb17a64ebf03d25d1d108aaaa992272254e040bf69a169dc3ad049e868efa3da7d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122209, "uuid": "fbf2561c-09dc-4769-9320-21f65f161735", "value": "T10616F016A9624E73E2697F3594E7042D92B4EB357912EF4F370F14A5A8023B1CF126F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122209, "uuid": "6f7489b4-fb4c-43a5-85f9-8b1b35aff731", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122209, "uuid": "e5b6851e-9ced-459d-a511-2ed58c70b419", "value": "49152:IBJslhExTgcA/Zo4GJO3K4Pe+KLdopASsetvh3Fh5/Z5zap+ENin:yG5cADm4PpRsetZ1rZ5s/Nin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709122209, "uuid": "e9a8ac2c-cd4a-4fff-b773-527308d79fd2", "value": 4048796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709122209, "uuid": "4b812afc-46ab-43bc-b461-2f643c823c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709122209, "uuid": "03b15108-b03c-46cf-b079-b5d3abb29e10", "value": "648635ee494501409670f2e3b41d6e76.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4529d55-d5f0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709094082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709094082, "uuid": "ed837399-efd6-4f9c-8dd7-986cdc0ae707", "comment": "Malware payload (RiseProStealer)", "value": "63ac1bc9309f92985fe1ca46214b5c85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709094082, "uuid": "bde5b538-5d54-4e11-842f-f2853715bd70", "comment": "Malware payload (RiseProStealer)", "value": "98cce54e7cc22e1698525f650a77742015f1d7437b5acf0520f8aa99277def1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709094082, "uuid": "2253824b-8d29-4999-bdea-62852508974f", "comment": "Malware payload (RiseProStealer)", "value": "129cfd69830100515d57d0c03e8c4bab3f36bc20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709094082, "uuid": "cdee1cc1-f3bf-41c8-b2d7-4fa62b70e2cf", "comment": "Malware payload (RiseProStealer)", "value": "5044842011941ea511af41b0c881bba8b7779417519a730db83d16f9548ea6a590e96555d6e20d808ccb6af26688a0c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709094082, "uuid": "7f5c1e15-700f-4b3f-ad8d-fb34ef6ccb06", "value": "T116B533E4EE939088D4598078C48DDFA3E71F8014696712F59B9CEFC16D82392D7A6F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709094082, "uuid": "12a4f1d1-a35b-4618-85bc-8d07844f45e5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709094082, "uuid": "fd1d9c59-3800-4d8d-b460-a50f0574a4b7", "value": "49152:1tgQOiFNOXOkghKuGj1fAuatib/XtbuhHetgLrMSkoTgtb7:1tgiFsVvu61usr9bcetQ5kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709094082, "uuid": "269d24f4-5180-4efa-9d9f-dc4e61140e02", "value": 2301440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709094082, "uuid": "f0c79c22-8111-42d0-823d-eb4362a54760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709094082, "uuid": "79022493-be8f-4c00-896f-86d3ee4514f5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22335.4138", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec25a1c-d681-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709156216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156216, "uuid": "7d9beadd-98c5-41b9-b974-1fdcca748676", "comment": "Malware payload", "value": "0365118a92333b6faa474aded6b3a6f2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156216, "uuid": "888f4082-ba6d-4ce1-8dd3-22bac5f68b72", "comment": "Malware payload", "value": "98e44c818340bc1657402ed6b463ae52247f6d52d45d4a5aa0e6fad5b4935b1e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156216, "uuid": "fe8bc4b6-513a-4071-badc-8479614c6d2d", "comment": "Malware payload", "value": "0bcac8b38e4e338508606c897eb7e36ad9d8a68e", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156216, "uuid": "01689243-0675-4566-9e60-28e102d84149", "comment": "Malware payload", "value": "257e3fbd3d605ec89fb279f9ea23f0b6dc2d39c33ef7ecee34d88c02ca0b0fdd2e55a4f90a30702437e730e9a1e3a4da", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156216, "uuid": "aa1f032c-2e0d-4b2b-bd4d-92cbbdccfdfe", "value": "T15F316E0466F51315F6B3DB79ADBA6212883A7C69DE31CF9D0250824D1871701E965F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156216, "uuid": "4fcb1d61-238e-4d55-ac06-36117087ac3e", "value": "24:85/BHYVKVWX2P+/CW31cI1tMwZmm1MrDABOWp2/YjarabQ:8B5aGe1zMrIMfABOWYQj4a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156216, "uuid": "2532a4aa-c9d8-4097-b1fe-6e8c451a6619", "value": 1862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156216, "uuid": "d34a487d-d8bc-4d72-9abc-cc091f17ae73", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156216, "uuid": "149e6d53-1782-4cb1-aeea-95d9e2253a93", "value": "WhatsApp G\u00f6rsel 2024-02-28 saat 14.52.35_809ff0ec.jpg.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e113e68-d640-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709128297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128297, "uuid": "79031792-fe9f-4852-bbab-8a48c0d7171e", "comment": "Malware payload", "value": "cd31d0c3ea63c8f3cb797f30250162ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128297, "uuid": "3492bc12-8fe9-4131-b0a6-1fbc7e4a2e8c", "comment": "Malware payload", "value": "9924730590b95f043ea6b021c806eb9f3135dc9f7e9150ae4eee0ba8b9308d46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128297, "uuid": "a4aa35a9-a62d-4ef9-a3a3-14a359eadf06", "comment": "Malware payload", "value": "ca00c8e4cb09165da43d9501d7a28d7c31077eaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128297, "uuid": "5fe6e0bc-9b64-4ca5-ac6a-8749d1258e8f", "comment": "Malware payload", "value": "c503eb7f5d45e4b617c364138e96f3c943a8074f10a50ee675e84b8e9be0a1fd38e9381800946542b589127d337de945", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128297, "uuid": "da1eb766-0f79-4e4a-aa61-2cec69013f91", "value": "T1B574D051BE808657E455533589F74B8B1325FC819FA24A0F365CF71E3DB03A46E2BB22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128297, "uuid": "f5c87325-1ad7-4182-ba7d-38a456f4fed5", "value": "6144:mgun0HY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVmLMIrkLUHal2nKrr1Vazt:m50q3bVmLMIiUH7KPuzRzZil+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128297, "uuid": "a3f3e44b-00f3-4631-b109-ca6d8be73ac6", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128297, "uuid": "5c07558f-b8c0-457f-9ea2-7ce59b253301", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128297, "uuid": "3a0f429d-0a34-4bac-9d15-6766568baedf", "value": "comprobante factura 11-369013..xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efc4c37-d621-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1709115011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115011, "uuid": "77ec78dc-52ba-4fe9-8667-444830d3295d", "comment": "Malware payload (CobaltStrike)", "value": "2180f16799081e11de96946a14c849d6", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115011, "uuid": "3ec96c06-800b-481f-b3b0-4aae2042a7eb", "comment": "Malware payload (CobaltStrike)", "value": "9acbc2da766ef9efa63d55dd9f64f928a997449decc1dbc112dc3fb2ffb43aad", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115011, "uuid": "5e937090-44ad-48af-9dc2-0c582cd7aba3", "comment": "Malware payload (CobaltStrike)", "value": "8e2717be559d5aabad85513cde3dd6c43f307e4e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709115011, "uuid": "af841e4d-4095-4db0-bc5b-f15cd6a68642", "comment": "Malware payload (CobaltStrike)", "value": "f39a57231954279e9835d266dbcfc2dec614b1d29aa84bef950a07fcec1b82f5658049d0d41e0eef1bfff09ec784d178", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115011, "uuid": "d01f0040-1b5e-4d50-bfc2-078dd91cccf0", "value": "T114657C4ABCE144BAE4AAA3338CB251C17B71F8181B3223D72E50B27C3F766D16A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115011, "uuid": "4952c666-b188-4ae7-a39d-e6551ea449de", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115011, "uuid": "bc05c0f9-0908-42c2-98f6-9a1c1044d605", "value": "24576:GfCnpVQpzp/ite331+iZI82caPRkRHadObf7DPgmU2dU491:zbQpzO1WbHadWfHP1h1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709115011, "uuid": "00a80dba-fc0a-4bf7-8ed3-a47fa7db920e", "value": 1410560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709115011, "uuid": "aff0202a-e3e6-4d02-b327-ea963efc901e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709115011, "uuid": "7ceb2690-9ae9-4ada-aa3c-bd04b8ced1c5", "value": "2180f16799081e11de96946a14c849d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d5baa4-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709159502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159502, "uuid": "f4148276-e24a-4582-bc32-a59b10941540", "comment": "Malware payload", "value": "5496ec57e7c0a1f5db2a1b0058f902b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159502, "uuid": "960f34da-3fb1-442c-b5b5-76fcc6ed8baa", "comment": "Malware payload", "value": "9b23b84fa60d23d619f3a154bfc7d1f43ed4a71bfe2932b6b6b2f2d8df1591f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159502, "uuid": "77f7eb4f-823a-4de9-9636-1086df3c01f5", "comment": "Malware payload", "value": "794ac5bfb94f3ffaa95f65a15c81fae007006807", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159502, "uuid": "060ef3ac-2b56-4c06-9c9c-71d6f4645f14", "comment": "Malware payload", "value": "9b210993e9633fdf5d976cee9d05d04217d942474da6c66f40ddab9656560e7ddd5db17327fab0b40147e32ef0cb14de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159502, "uuid": "b76ed841-a3a1-4d31-a4c2-a739c46a11f9", "value": "T1F444B563D31688A4F1185CF221A73250AD92A37B8DA730D3FA1B1E51FE7555B207BEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159502, "uuid": "76c11544-0c41-4ead-b003-8a08a9273f3d", "value": "6144:YlTHR/PQeqacWucW0JcWcBEj6nGcs8NQq+tmmGekhNlWN5:2THsDeq+tmmGekhNlWN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159502, "uuid": "7ee7898e-4f39-4299-b276-d717f1bb311b", "value": 258510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159502, "uuid": "9c6e78e0-cf8d-4de7-a98f-82b7a369903e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159502, "uuid": "503cf091-da8f-404d-947e-9d4bc7fb28dc", "value": "5496ec57e7c0a1f5db2a1b0058f902b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ecca8a2-d5e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709086932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086932, "uuid": "12da6e53-7752-46db-9f02-b2ba737859e3", "comment": "Malware payload", "value": "d3681df7e74f865a3eb4f594c1fee8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086932, "uuid": "409f0a5f-a36e-46f5-bf95-4808621d084d", "comment": "Malware payload", "value": "9ce48a3057b631bc94a3427174401ff8a0555708e2735df032c33b93d1f0cbb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086932, "uuid": "40b8540e-a186-44e3-b84e-67c6bc48bc1e", "comment": "Malware payload", "value": "ef72e59c5e735f90e77cecfb6dbf450c91e154e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086932, "uuid": "e85f58f1-486a-4731-9928-2fc009f59930", "comment": "Malware payload", "value": "4d5468aceef072debbd6afce608a363369995b39f8b7f958ee6316a53d5830ee16c16eec4c9fbc8710d973ad1bcdb36c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086932, "uuid": "9ea36cc9-8080-4855-a96c-1e1628248e7c", "value": "T1165633A1CD297B37C08D157A73E9A3E38271B64E53971C423A3E2E210786E4BF5D3694", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086932, "uuid": "267f7b9f-eec6-4a10-a3a6-f6a2da30f097", "value": "81638d02019c0bfcaaf23a9c69f2f12c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086932, "uuid": "df6b6185-afb6-4b64-aa19-f1ac9bfb9661", "value": "98304:MNf+YzkXYfhiUQzSXJUk9xHGeFuJymIsxxK1+jd2wMPAkdsSLcuI3Af9nNTT0BVX:MN2eKSyky9Isx0w2wMoWFA2Ps7hK3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709086932, "uuid": "c314e970-8c21-41eb-869d-2392a1a87f37", "value": 6151440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709086932, "uuid": "2ddd851c-6122-4464-90ec-4e7d5625ee45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086932, "uuid": "b842e601-0aba-4d44-8e30-3aa610c4f216", "value": "SecuriteInfo.com.Backdoor.Win32.Zegost.1122.12800", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478c5816-d641-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1709128635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128635, "uuid": "fbba4ffa-946b-4ae0-87f7-73ef73598d9d", "comment": "Malware payload (GCleaner)", "value": "0ee2238385dace7f1e829911d1dc6ace", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128635, "uuid": "ad5ffffd-7d54-4c6e-8569-ef320c5118b6", "comment": "Malware payload (GCleaner)", "value": "9d11715b5fe2c2885f90432ebefa0ccf1cc564e0600d4fbab7b866d6bd7d1b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128635, "uuid": "455d467b-5b28-402e-8087-d0c629518403", "comment": "Malware payload (GCleaner)", "value": "ebc771427600614169fa9780a4b39d5feb44c889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709128635, "uuid": "fcc8c1b0-0157-4c2f-8684-bca5f551158c", "comment": "Malware payload (GCleaner)", "value": "51bd36fbaa017feac03264ab3cff25885bd126262200548967bbcf981223c3b122d156caf9385d28681199e800869322", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128635, "uuid": "9a803175-d9da-4e9c-8856-e9858188475d", "value": "T19544E112B7A0E831C4A6263184B885B40B7AFC216A7597D7B7943B3F2EB07D15E34397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128635, "uuid": "4af59ccc-a284-43f0-b574-0fc29e722e5e", "value": "fa9d771b11e0f02db434815b765f591e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128635, "uuid": "387b404f-9294-4a11-84d8-c3ad59aecfc6", "value": "6144:UO11VeBOmc/gKwMFJnpoaoP7S5Av+UaGZm:U4VeEmc/gKwMF5p2DS5os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709128635, "uuid": "2c57acef-e807-4253-a05b-8f948ab8a9b9", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709128635, "uuid": "6f8ad715-c771-4609-bea9-7dfbee10fea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709128635, "uuid": "209260e3-aa5e-4faf-894e-b5dd2c964ccd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106ba237-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156889, "uuid": "92ff78c2-7e99-4c7a-9fac-950bb2723177", "comment": "Malware payload (Mirai)", "value": "62c12ca499e5fdf7a129a1ebbe039b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156889, "uuid": "244e4a76-36e6-457c-ae08-29e9a8adb6af", "comment": "Malware payload (Mirai)", "value": "9ea6d491cfe85623a249b5b2703534c0474a9dd7f912d7534a85d0f1411cff00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156889, "uuid": "e10b2fbd-5fe4-4cba-8c1f-45a91840d61e", "comment": "Malware payload (Mirai)", "value": "2a295e8d41f260d45d684beba8e0f809d8867c85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156889, "uuid": "97ef894f-d033-4387-8e6e-81c0c27bcb3a", "comment": "Malware payload (Mirai)", "value": "50415f66064205c096bcdaa5381a564c7f3712327524f141137e944400a9d1f32e3fcf486bd94e95bc7a34eb472ad4d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156889, "uuid": "c5203730-815c-4210-ba22-592fbb8cf46f", "value": "T1A863D9062E219FEDFB6C863447B78A31A75833D627E1C685D29CDA011F7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156889, "uuid": "2256c985-18f6-440f-bc88-adc17d11d7d0", "value": "768:srWWo3PowevaxmBaqrMUCTg7Q2rPNGwDjKYFLW73uB/ylWReJO6UIt2:T3QwevKqFQ2rPD7YS3ek6Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156889, "uuid": "8e9a6602-1cf8-4691-887a-2334130a837f", "value": 68192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156889, "uuid": "8d1cfb5c-90de-4fa6-8361-28db684dd399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156889, "uuid": "8a9afb8a-ed70-45fe-b49b-4c8fa709d05b", "value": "62c12ca499e5fdf7a129a1ebbe039b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec194f10-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156829, "uuid": "9c724538-afaf-47dd-9a98-2a3daeb32044", "comment": "Malware payload (Mirai)", "value": "7cd4680b034607e8a1ef1f9952a58205", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156829, "uuid": "b73fe2e4-57f8-4dbe-b33e-1855937251d5", "comment": "Malware payload (Mirai)", "value": "9f0e78d7d071e625dd8069634987d81bee9181b00081ccddca23ddb15f91b754", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156829, "uuid": "de18a626-2372-4947-85b6-2f4f7e848756", "comment": "Malware payload (Mirai)", "value": "3e5cba6fd90cccf5a92408ab981352f38f002f4b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156829, "uuid": "374ddeab-a188-451b-9b74-93935b3aaebc", "comment": "Malware payload (Mirai)", "value": "c3d83cb6b7805f17117fd2b105fb8f4f2db8d8fe14ec7ba480c605a8717c5bc0cf7c0fc31d969c645dfaf2ff1e1e9665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156829, "uuid": "adcae668-f09e-404c-9dd0-97b6309ecf5f", "value": "T13DB35B22AE62182BC1D9A13F11F74331F1F3674A35BC8F1A7EA30D4DAB647182167769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156829, "uuid": "1306fd5c-fad1-4119-a822-97bde0bdf0a9", "value": "1536:t7IwdbAo+9pETy+tftRXNM5FugnytILlHaZ2:2uTFFjXN85nnQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156829, "uuid": "7d039803-702c-4c71-8d3f-db722447a50f", "value": 110524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156829, "uuid": "44a66b54-bb06-479e-9f6e-a7e1825e3a29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156829, "uuid": "24fd91ac-7f1c-4454-8e67-9e99497255a5", "value": "7cd4680b034607e8a1ef1f9952a58205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7aa90e9-d5fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709099725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099725, "uuid": "c3f2c858-24ea-44b9-99dc-f017cc377b3a", "comment": "Malware payload (Socks5Systemz)", "value": "47966d552ef2b5d1cfc6cbd8d39669fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099725, "uuid": "502cf023-b7d0-46aa-bf63-c1b013bb17e3", "comment": "Malware payload (Socks5Systemz)", "value": "a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099725, "uuid": "8727c72a-6ff3-4648-8b11-4470b7a1cfa1", "comment": "Malware payload (Socks5Systemz)", "value": "19f55c91e934fa122793c6cd6e63ca2600585ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099725, "uuid": "8fd4ad33-7c4f-4bd4-a1eb-916d0bdc5ea0", "comment": "Malware payload (Socks5Systemz)", "value": "2dd8cee7f4fd84723be3bb7ac822e81a770038d07f8741a22f12dd3d764161856f0982df0858c946776a06bdc1d70f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099725, "uuid": "2bd25f0c-7a49-4677-981f-276eaade4537", "value": "T1A0B5332BE965D071E44055FC89A9E8023A5E39067D3910ED32DD8BDA2F3BEE147173E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099725, "uuid": "2d9d451f-8837-46ad-b2cf-dbc967f2ab6d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099725, "uuid": "6af67d93-9431-425e-b6f9-1aa300bd8cdd", "value": "49152:C9dRiEpctuTm5P5743ExgJj+S5qYMyx6kH2QLcZiG0L7eIMF4EtB:MdRiHwCx747Lz7x6kH9gcmIMF4MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709099725, "uuid": "684ae5c2-78d5-4b34-9857-b9a91f265f5b", "value": 2490314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709099725, "uuid": "29ae8d22-7c32-4c19-88fa-0340603fae64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099725, "uuid": "c3168ba9-289a-482e-afb1-055ec39d6efa", "value": "47966d552ef2b5d1cfc6cbd8d39669fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3900bedf-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139348, "uuid": "f6db767c-b604-4ed6-9595-d87e08611ec6", "comment": "Malware payload", "value": "db505d74193b9dc96c77e26f2049d445", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139348, "uuid": "84b81679-bb4d-4277-973b-e27eed3fedfa", "comment": "Malware payload", "value": "a10accc16491dc60ad84e0fe2bd401dc9de51505d26330db1bc10309ed13d5ec", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139348, "uuid": "f7ba74c3-4835-4be7-b677-fee888749b51", "comment": "Malware payload", "value": "792b9ec59f47ca19ac3b049b1c8d999d22f49ee4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139348, "uuid": "601ae773-4921-4a58-ba19-8e10fe61ef90", "comment": "Malware payload", "value": "90ae131e877ead80ed057aaa40109933274a8c10a9f71d99b5686122fc089fc3e4617f57553a2346bcaa7e168e61a469", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139348, "uuid": "aceddffd-f739-43b1-a03b-ba8efe6d781a", "value": "T16043F168056F6935E6C29479088E02B85770585E87A1B2DE36A833BE79C2CD512E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139348, "uuid": "e055fee6-64b2-4cb4-a135-86a9ecb13e4c", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehT:BoOAcw7nXDUsOjm3jTxhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139348, "uuid": "94c0083f-4add-4cca-91d6-c466261d5cb1", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139348, "uuid": "4f518cb2-1824-4a4c-8ebf-aa7ecdba2f56", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139348, "uuid": "5daab9eb-c0a4-4c86-86d9-1f0ae721d5c4", "value": "scanned_doc#2024-27-2_5979.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16751099-d654-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709136713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136713, "uuid": "49183566-9a4f-4a84-8b1c-299b12bcc606", "comment": "Malware payload", "value": "1f6e6715e14d47f4ce831fc3ec152cf3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136713, "uuid": "6b54d11e-4eda-4b12-8e90-44b74c69259c", "comment": "Malware payload", "value": "a2d704900df0d8fb40ee81a3111119bcc6a2733d2953c9ff87afc18f5064591d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136713, "uuid": "797ad0aa-56db-4527-9209-6a600254a1b1", "comment": "Malware payload", "value": "0c8795343f9d772d278cabf81c70d81789ebf6b5", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709136713, "uuid": "e4e0da1b-5ac7-477b-85e1-79e4115114d5", "comment": "Malware payload", "value": "65ac1424628da7ccdbd26c2e3e582d21cdaeccc653e09f1821cddc53596623ec91b2ee413132246ecb574d678b81cb20", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136713, "uuid": "b7c906c6-d2de-4466-8cfb-4e4b7d9562d0", "value": "T16943F268056F6935E6C2D479088E02FC5770585E47A1B2DE36AC33BE7982CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136713, "uuid": "92aa9247-2af4-4f48-b2ac-6227e2b59340", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehZ:BoOAcw7nXDUsOjm3jTxhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709136713, "uuid": "9c0f0d71-ffc5-43bf-bffe-1c91c43096b9", "value": 56841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709136713, "uuid": "719c715f-b58a-4a81-9a62-f50053cf3bd3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709136713, "uuid": "036d3d68-1be4-47bb-b80b-44ed79c7ea90", "value": "scanned_doc#2024-27-2_4801.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132d32f2-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156894, "uuid": "c013dfd0-2414-4f89-9fa8-a9c6d9f9cbf2", "comment": "Malware payload (Mirai)", "value": "09ca6234b32312ccc8a14321a97cef3a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156894, "uuid": "ddceaa0e-6b70-40dd-ae30-5e65b6bcaf38", "comment": "Malware payload (Mirai)", "value": "a433d18a4ac671bdf78c9bb5ea2bff0e75b8ace8ab8cc2cd0142802f2454cf8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156894, "uuid": "92acbcaf-ca16-4613-8a9b-60fb4cceb9eb", "comment": "Malware payload (Mirai)", "value": "07d52439d52d772b2c01fa13ed239b93ba1b0f81", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156894, "uuid": "c2bf1f0f-3704-432b-9608-727e654f37d0", "comment": "Malware payload (Mirai)", "value": "8a81134344a1f66dc332dd7012c6b908c9faf5f11070e0890b905090d1f91b40d7fdbaf26a5f9dcbcaf5a18634848af4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156894, "uuid": "02fbaadd-5b9f-4087-a181-4dee3ed07214", "value": "T185432B91F8819A13CAD0527BFA6E028D372613E8D1EE3317DE266F1137C692F0D6B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156894, "uuid": "57c44099-58e5-4e10-bae5-ab744934398e", "value": "1536:qOE/ly0SOcAtzvI9ePaNGnDVC3kyjN08pZvf:qOA77zQ9ePNnAUyJ00f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156894, "uuid": "f26780ec-4e23-4784-b97b-a8d3acbf7ce9", "value": 56112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156894, "uuid": "6a6b6cd1-851e-420d-bc95-9137e42e7214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156894, "uuid": "87c19c0b-c76d-4cd6-b57e-135befa134c9", "value": "09ca6234b32312ccc8a14321a97cef3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc30324-d639-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709125503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125503, "uuid": "948d0026-99df-4c8b-99ed-8d2a6a158d5d", "comment": "Malware payload", "value": "59bfd011d67fb0902819a1743b38b07d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125503, "uuid": "6feaaffe-81a3-4655-877d-3cc5ce06c224", "comment": "Malware payload", "value": "a58491c13d6e36d899645186892de308b66d7a7c873208279c18b9a4458ae1ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125503, "uuid": "04838ed0-53b4-4e74-915f-0d4507432f55", "comment": "Malware payload", "value": "e771c159f9b38c17a222c40828c88d319bf642b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125503, "uuid": "7c1f203e-2cb1-47b0-ac54-8e0388662b25", "comment": "Malware payload", "value": "d83f1c1fcb69bf9eb56ea70bcef7670c5cfaa38844898f7b70a241206bcc8abfecc0788e37c30d458c60aee3ad0938e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125503, "uuid": "c29293fd-5102-45a9-9232-4bbadce08d84", "value": "T143B3943A7E22AFFEE168823107F35F70979521D237919385E26CD6181E7128D1C8FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125503, "uuid": "33e2b76e-fba2-4dc4-bf50-d96b9ef94933", "value": "1536:y7j+1TsKvqunvyoa2rKzoGhGRGpGQHnZdMUseEfi8mru4RiUmkiCFx1DC7xmgQ:1+KU7nZdMUQhmrJiUmkiCFx1DKxmgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125503, "uuid": "14e73e04-7637-46b9-8ea8-9a1ded0c54e3", "value": 117624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125503, "uuid": "8887f52b-35e2-4f2b-acbb-5af990b77f6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125503, "uuid": "f0d0f57f-060c-41f0-8b67-26dc94dfa48c", "value": "59bfd011d67fb0902819a1743b38b07d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5da433d-d651-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709135665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709135665, "uuid": "5a624cad-a362-4737-930f-563dd6f8dea8", "comment": "Malware payload", "value": "31f58bd0c77a8255bb3a7874297cba06", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709135665, "uuid": "e15e3d55-15ff-441a-b6f7-8e5f1d26a0fa", "comment": "Malware payload", "value": "a74829366aceca5ebbfece6a3ee3d0be413a0f1466426d6b66f579a01b765766", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709135665, "uuid": "344e95e4-ef44-4688-8d8e-087989b3e639", "comment": "Malware payload", "value": "27f8d5ff8eddd4de95a9b3f9a1393397bd6204bf", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709135665, "uuid": "7f3d6c6b-50a6-4006-b82a-b5e0ae61fd11", "comment": "Malware payload", "value": "5d96b8ec178f498bde24cca7538383a9e820976d6c630dd161fca0e570053441cc343cd0add143a37efea3597531cec3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709135665, "uuid": "dcb6e924-5bcf-48f7-8c61-cbbdeb0d7f65", "value": "T13833015D03916AF6FC6AE5E9184B27995FAD34728450FEC32C391E842B17A235C603FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709135665, "uuid": "4fd3771f-1810-4b44-afa5-a6f287297f34", "value": "1536:MgH1FFi3hS0DHdYIt2w/zZIpN8VFkwjz+Stdnbkq+ZK:MgVFg3xLt2A6pEdltKZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709135665, "uuid": "ee50d408-4c4e-47a3-bf5d-d64d5b9c2ab7", "value": 55034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709135665, "uuid": "627442ee-7397-44c3-9d48-058bce2ae0cb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709135665, "uuid": "77f8e2ff-b153-4ca4-83f7-736db127eab0", "value": "air_way_bill_dhl_doc_track_no_27022024_61299995644458423517.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bbe8a0-d600-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709101017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709101017, "uuid": "cbd80295-426e-4150-ac35-37e3442c3101", "comment": "Malware payload (AgentTesla)", "value": "9a5bd40dcf2e6ac81bbe2ec3dd5f2a58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709101017, "uuid": "2492998b-8d4a-4527-92c0-9597d699ff94", "comment": "Malware payload (AgentTesla)", "value": "a85fd479d4d8655f30a83ecb0a53cc937f900ecd6bba52e0e568543711f287aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709101017, "uuid": "c65f8291-90a8-4dc2-91f9-43323933cb33", "comment": "Malware payload (AgentTesla)", "value": "25feb80ed54992fcdb2fc92f3fe90f1730bbecaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709101017, "uuid": "692c536c-091a-4c9b-b01e-ef6065290150", "comment": "Malware payload (AgentTesla)", "value": "174269b93f724ca6a70b86ecfbee2f12a8491de9965808bfbc5f406275e71f42e560d8c6f4f7bb79e30b2f5a65b39fc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709101017, "uuid": "3499a5ec-e88e-4c88-973a-364585d3ddfb", "value": "T1EDE4236B254987BEEBBF2BF508C9444403F33981D646DF5C88EA18E52B73791DB1062B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709101017, "uuid": "e58ee769-5226-47c7-811d-37b90cf4d486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709101017, "uuid": "cda6a627-7114-4ab1-906b-09880f53543f", "value": "12288:/zNwnqs3y44sAGeIpSmE13dyAJcp+a8QmP8/q1ScR9UiufLzj2t055Otz:2nPAGnSmE1tNJtRQBvcR9WfLmt05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709101017, "uuid": "4d1d9d91-de29-4457-8b0b-ab84d726354e", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709101017, "uuid": "dea8dfe0-10d6-4cf5-a4f2-0d9e221168a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709101017, "uuid": "fb845d26-8f11-4b82-adfd-7613646db8dc", "value": "remittance copy $58,670.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b90f5a2-d646-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709130763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130763, "uuid": "0c71dfb9-2d37-40b9-87b9-0445d0f59154", "comment": "Malware payload (AgentTesla)", "value": "faaf284c22c3407cf96318ded239d2be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130763, "uuid": "f95d0a02-ef86-4831-856c-510785921818", "comment": "Malware payload (AgentTesla)", "value": "a90ffb3f85b478d28ed7af356c5260ff06b3d68936a118b3021da687a2767c33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130763, "uuid": "90865d46-949e-4ebb-851a-96444b06590f", "comment": "Malware payload (AgentTesla)", "value": "38b2eca22e2518cd1d880a55f274cec7980aa6ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130763, "uuid": "63ccabe0-8ea1-4626-a682-5a77bd0c37b7", "comment": "Malware payload (AgentTesla)", "value": "e39d10472a5b747f1328a0b55a1f0f0de5c3ede85e621bedee3a3da486927f831ba08142039a891ef04ac00a67cc06f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130763, "uuid": "80138a35-1dd4-4c6e-b902-9aac367de7a5", "value": "T112F4F159232CAF62E6BA47F814A099110BF5351FA53DEA490DC230DB2EB1F609F42F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130763, "uuid": "e69e022c-d8ca-45b1-adfd-623699f1de52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130763, "uuid": "7c98fcec-20ab-47c6-9a9d-85fb1f6c5dff", "value": "12288:58S+oGOKcHz0L9bW9ezrGwjO771PeK1hck+gwR3GthurA3NO6U9RsStfGL1kFALj:T0L9iyywww0hckAihur2DU9aStey6a/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709130763, "uuid": "112dcefc-8ccc-4ef5-8286-2242693586c9", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709130763, "uuid": "6b638d9f-012e-4048-a163-e922a1e2e44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130763, "uuid": "00df8e6b-87a3-4abb-a8b7-449dcd07a9f8", "value": "z5pVrgimKmlQoCD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad66fe9-d628-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709117850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117850, "uuid": "be416809-22f0-49f1-b8c4-7d6acfcc163f", "comment": "Malware payload (AgentTesla)", "value": "2806045c46304fc981167ad6fc001abe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117850, "uuid": "8a69d63d-5249-4076-be53-51c818a6c336", "comment": "Malware payload (AgentTesla)", "value": "a91b7c840c36ad52a797e2d57285a488098d840ef2a4817b2367e0bba9cb8514", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117850, "uuid": "2153f94b-8732-410f-a84e-8e0021e0e365", "comment": "Malware payload (AgentTesla)", "value": "4e9b89ac9bb206a9dcbc475c7eab763df551847e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709117850, "uuid": "df03a29f-22fa-4b24-915a-d4855630b7ec", "comment": "Malware payload (AgentTesla)", "value": "f5b6f8979b3fdcd7c2eb73f0d32f5df4b397750b6065f69c43fbfec6de427d1be7f4f2494dc079b3cbb8e25555c0a09e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117850, "uuid": "7f84fd16-9880-41dc-8546-2b7bc1c93428", "value": "T1FA0567352719C617D3A746B8D91629F436256D16DA038137CBB43EBAF230E3F4E93A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117850, "uuid": "2f624aed-ae39-4b5e-82f5-1863e7528eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117850, "uuid": "550793fa-7337-48cf-aa1c-599183d01f0e", "value": "12288:3KvjpkDaBs/rGJgizMR3Ncds3AxmVNmr5eSVPRE5bzM7a8nurQ9:38FTazzizc3PWmXOeyRE5zM7v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709117850, "uuid": "1f2e6cac-a9a5-492d-b24c-3f3ad7b531ed", "value": 846848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709117850, "uuid": "948f433f-a2c3-43cf-9d77-12bf8fb345d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709117850, "uuid": "dc457d76-069c-44e3-b044-cf14047a1e67", "value": "Consignment Notification-\u00a0 6183111.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10743a2f-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153883, "uuid": "77af60ff-e99e-4a65-b7c4-c3af5001646c", "comment": "Malware payload (Mirai)", "value": "6e66c00674de576ca8f0ab7c59cc0fe0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153883, "uuid": "726a8445-3c21-4355-a885-56c3a1a48ae4", "comment": "Malware payload (Mirai)", "value": "a954d75fe8e6087d34877ce4a30d35532f9f601a17abf314646996ae3882e332", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153883, "uuid": "3e40a148-a6ee-42e9-aeb9-eaaa83539d49", "comment": "Malware payload (Mirai)", "value": "bf579a8e1516be6efec527471926b7c9cc0f03d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153883, "uuid": "65249076-54fb-4672-8508-042ff8282c38", "comment": "Malware payload (Mirai)", "value": "c16d89283eda2edafaab390ce91585876074a7da7a03f1a6fd307911e9f775b608f0d496cd7e66ee025d74db5184ef78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153883, "uuid": "8b779861-09e2-4b64-98dc-9a86c85b0b5b", "value": "T1B0A32A89BC91DA12C6C12177FB2E52CD371613A8D3EB32039E296B25378B56F0B3B545", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153883, "uuid": "caeacf15-4dd9-4907-8f02-fcd48ef2e274", "value": "1536:zImvo5E8/p553vVTM1+Do9e3Coph+29bG2IOinLpDAca7vRf5uPsP52g5O/CvhTW:zCxRVgj9/x2IVLpDWRBr2mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153883, "uuid": "7e53b514-a8c0-49de-9d8c-11ff7db8ec40", "value": 103808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153883, "uuid": "1ba26313-6b02-46df-a44c-cc4ab7e0bd2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153883, "uuid": "6d02cc7c-b13f-4da5-8049-090b79ec6146", "value": "6e66c00674de576ca8f0ab7c59cc0fe0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d18511-d61f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709114058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114058, "uuid": "e4b218ea-20d3-43f2-b8e1-6f2a761b481e", "comment": "Malware payload (Mirai)", "value": "63e3b06d697f894eca451145ff938c3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114058, "uuid": "dcad4a43-b667-4857-bf61-74268a6b875d", "comment": "Malware payload (Mirai)", "value": "aa4d2c400711f36828600dda655854bb4d70c4324047fdd50890925e3c6d57bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114058, "uuid": "2942509b-e90e-40e5-b9f0-5199d4bc30b6", "comment": "Malware payload (Mirai)", "value": "c24d9dfa207f7156a494bcc179fe2455e42c2402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114058, "uuid": "57224fb7-107d-4a8e-8a9a-4229fa5bf461", "comment": "Malware payload (Mirai)", "value": "52f8d1a61ad926f815638cda1f83d3b8e973b4577b664ea2d156b42a73d1dfac18461f59f103cf3d5681c1fae01a6c0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114058, "uuid": "b49f317c-9232-440d-9e84-c57eac39bd1e", "value": "T1BC931986B841AA11C6C61677FE2F108E331257ECE2DD73138D245B707BCB91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114058, "uuid": "056c3714-d0d3-4839-a0ff-4b8d10bb2abb", "value": "1536:XhnOIrV41TKXiiREM0QhuZGYsy5zVMpWKi/at+rbNMKiq+Vu8KRY95cYG:brCkZRE2uvhM0KWaM+Vu8KRY9y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709114058, "uuid": "85d63202-a53c-4d9c-bcf2-77b8ed68577c", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709114058, "uuid": "73a45bde-c85b-42ed-8ce8-4da00314f79b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114058, "uuid": "7da6f4f9-7c13-44fb-a1bd-437c0b04ee24", "value": "63e3b06d697f894eca451145ff938c3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c466471-d606-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709103330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709103330, "uuid": "3324894d-cd13-4a31-bcd8-f5f482a1585e", "comment": "Malware payload (Socks5Systemz)", "value": "4a97e493cb878e52710d31852c6a4189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709103330, "uuid": "4bd20a1a-accd-4434-844c-e920e5b52ca3", "comment": "Malware payload (Socks5Systemz)", "value": "ab177abdea42cb6f55d52a690430d2f4c3bd8b29d3f2a480d7c8125d340afa11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709103330, "uuid": "7418c960-6892-4454-bfb8-074fbbf85fe2", "comment": "Malware payload (Socks5Systemz)", "value": "6bc2b0e5dac72df9f88662dfc268d5eeffbf5bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709103330, "uuid": "e1e4b93c-8d44-49ca-a4a0-b5eb2681f397", "comment": "Malware payload (Socks5Systemz)", "value": "75b3b084f23a48b0efc01ad2a3545fb37f59a53634926e1840481b01e49ff2caa5e44cfdf94eb136bd18b032a0b1845f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709103330, "uuid": "94f650d1-a1e4-4d4e-9941-639d3fd7fa48", "value": "T120C533D6FA22C172C042EF384CFED1AE98A772156CB0A76073AE4DEF4B316D1CA15615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709103330, "uuid": "ca59fbfb-251c-44e1-9d4e-ced2ca1e7369", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709103330, "uuid": "9f77717d-1e01-42b1-8d07-41e4e0b02641", "value": "49152:C9KvClLO1Wp0BAiTazgdEnJ/b//gjzI+R1NjbY/xnDOd64L:MKqI1WaCyo/b//go+LNjbYZF4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709103330, "uuid": "b01898d8-240a-4f6c-9efa-fef49a491bc9", "value": 2740103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709103330, "uuid": "efebb6b9-0c41-4dc5-9eb9-c0810c797e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709103330, "uuid": "a0951cee-f79c-49c3-b5d8-f145350d0e42", "value": "4a97e493cb878e52710d31852c6a4189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827d95e7-d5ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709092227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092227, "uuid": "7c7c46db-fc95-4e7e-8074-2026d246daca", "comment": "Malware payload (RemcosRAT)", "value": "6f44b75ec1ac8b13c2fec56531529cfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092227, "uuid": "b83508f0-917d-436c-b86a-d762b2d838c5", "comment": "Malware payload (RemcosRAT)", "value": "aec168d080731ed61697b7e87fbf020d3284c9f158b5db36902ef85729b1d97c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092227, "uuid": "b70bb85f-b841-4e00-ad37-a730281f00dd", "comment": "Malware payload (RemcosRAT)", "value": "2e8fd0d9cfc54e76f4ece2a33e1747f074475708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092227, "uuid": "4f574b5b-9a9e-4a96-a4a6-c606099f3c04", "comment": "Malware payload (RemcosRAT)", "value": "1d68cdc1fa3ffc01e877850ebe654a6c473161467e5e4a7344800215c8bb060371f5768b7901e6bab31af5507e1ab08c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092227, "uuid": "80c2a649-bd10-448e-a20b-4242b5040ada", "value": "T16765AD216392E93AE0F75978644E434FEBEA7D40FECAB9512ED43D2C5EE0651F924023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092227, "uuid": "d2d7b71d-74b2-4b27-910e-0b8d5a8dff34", "value": "7c5a4bab06926700ad6797c5d4d8c6a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092227, "uuid": "d00ee22d-bf9a-4e0f-9817-6c6f8e82c5af", "value": "24576:r+L1gVG0tnercn/0B6qsArOLEgvNmVM+q6JqKLWWW6eAwifa:r+LX8cVAEiCZqy5Wrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709092227, "uuid": "cb991bec-8647-44a4-9adf-dccdd6a9308b", "value": 1461248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709092227, "uuid": "7d0f6da0-11b4-42d9-b32c-3c76fcf89614", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092227, "uuid": "2da9fd43-8013-46c5-9ddb-0048ee91aa30", "value": "Quotationfor4220197476pdf.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b990f0db-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145147, "uuid": "a094a42f-5af4-4002-b839-5a272af5232e", "comment": "Malware payload", "value": "4fe446a6392bb4473a45ff037592d52c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145147, "uuid": "115ba0cf-3702-4f1f-9866-4d2a1da9be2a", "comment": "Malware payload", "value": "aec37f0045fb7091d04f8eedd38d171debaec8225d344a8050cea1c31b435e74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145147, "uuid": "3283015a-3ad2-4a89-90ee-c3d2282c6d61", "comment": "Malware payload", "value": "ca815e429534931c4c189c2c91a81fb1d6df1cc5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145147, "uuid": "6b5459d0-110d-42ce-9b0a-ec63e4b7e2d9", "comment": "Malware payload", "value": "df6950aafaaffc04b5efba3867ca3b0d0480a26709b8c19d43e4e9a493f4cc1e85c662b4cbad6db022fcd8b7fa395c59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145147, "uuid": "77e05611-139f-48a0-81d9-db49bdbdbaef", "value": "T1F234E0207780C831C4EA063459B5C6B55A3EBC2276B501BBA3AFB72EDE757C1853874B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145147, "uuid": "8e915b0d-3afa-4a26-906b-cb40718581a3", "value": "82e2f6a4dece6269daba8be879ab2b7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145147, "uuid": "52df515e-b704-4ac1-9794-bdc9dbd2cf08", "value": "3072:z0/Jk9z3DmaXLVODmGP+Xrn6dThsLNkeBaxRuiluCxh3t35waZVTGh:wxmz3KaXC2Xr6dWLPoRNH3TlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145147, "uuid": "2b4335d7-4db5-4c4d-8b9f-6b96a9b20e0c", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145147, "uuid": "a9358fd0-c41e-4d9e-b898-0b0ab73d69de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145147, "uuid": "641677cc-5822-4ad6-9a01-77a079d28868", "value": "4fe446a6392bb4473a45ff037592d52c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfca567a-d684-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709157613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157613, "uuid": "9362ce1f-678d-4240-a232-7a41cb29e840", "comment": "Malware payload", "value": "b0bf0a477bcca312021177572311e666", "object_relation": "md5", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "long sleeps", "colour": "#66B0F0", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157613, "uuid": "c705443d-6197-463b-aa71-8a116ae611bb", "comment": "Malware payload", "value": "af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9", "object_relation": "sha256", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "long sleeps", "colour": "#66B0F0", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157613, "uuid": "8a03d260-870d-45e7-82f0-c9e90445bdb4", "comment": "Malware payload", "value": "ea77332d7779938ae8e92ad35d6dea4f4be37a92", "object_relation": "sha1", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "long sleeps", "colour": "#66B0F0", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157613, "uuid": "ffaecee9-138f-4080-92f1-755f3e7f8b5c", "comment": "Malware payload", "value": "5a2308ce59c2e277c50f1610136a08adefe7e1761442efbe9e27ed0a20ad0eed79d92af9770881fcea4f3e8e0ee38870", "object_relation": "sha3-384", "Tag": [ { "name": "defender", "colour": "#6B12C2", "exportable": true, "hide_tag": false }, { "name": "Disabler", "colour": "#776734", "exportable": true, "hide_tag": false }, { "name": "evasive", "colour": "#079829", "exportable": true, "hide_tag": false }, { "name": "long sleeps", "colour": "#66B0F0", "exportable": true, "hide_tag": false }, { "name": "vba", "colour": "#04FE11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157613, "uuid": "8fa61973-e451-4fe0-85eb-63b77bf9fd7d", "value": "T17BE0720B25BCD2C3043322D0806D6047C1F28A202C68E0032AA1EDCEA870BB902EC2C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157613, "uuid": "207e47df-a100-4094-af54-ef5d3884bf3b", "value": "6:ZRoicqjnCfF6A7lKVBmW4J7y9MFbMgzEWii4Ut1JFnky:v/LrLVBH4JMMVM5i44My", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709157613, "uuid": "b146c16e-0c48-4441-b66a-e3eb7460303f", "value": 313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709157613, "uuid": "02b9d4be-9916-4a09-b2d0-ab350031c184", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157613, "uuid": "e962cf7c-bc16-4ed0-8224-6ddbcf5d09ad", "value": "Defender_Settings.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8be85d1-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709129738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129738, "uuid": "2d7a8be8-a523-4eb1-89fc-9099e1baff8d", "comment": "Malware payload", "value": "34fbe678d8ef22957dd2c4e5191dca8e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129738, "uuid": "2147c7b7-439f-4e21-98ad-0aaa6942e40b", "comment": "Malware payload", "value": "af45c2417b809b0e24dcfff1f344ed56680a1f6c01d8e8618807526e39ceb1e5", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129738, "uuid": "c430a7b0-7161-426e-baf5-c1bcdcc95d2e", "comment": "Malware payload", "value": "10c6abc97d4ff5bfac8af2e292d39115bd5ffb85", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129738, "uuid": "2d6bfccc-a640-4015-9467-2e5d49aa4bd0", "comment": "Malware payload", "value": "5019a034391e12e9f299534316cfef1e7e413809178180434b95faffa2035193a9bd63c805b272481a4fc0e5b349ab63", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129738, "uuid": "ca4e0a55-4aa1-484d-bd91-1b87b5c6f479", "value": "T1B0F023CFFAD34400D661D3243CD0B0143A9ADAC423EDC9598CC490F5FA98701C8D75D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129738, "uuid": "67ec02e8-404c-415e-9390-767c7a354023", "value": "12:hYd05fgKz4xiXqhChD5JDivN2TgFchkloQb:hYd05fgWrqhCF5JDivlchk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129738, "uuid": "aa0fd05b-4b66-4ae9-becd-f6d45ed749db", "value": 460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129738, "uuid": "682c3141-2cdf-4e8a-acc3-4db2ace3c36d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129738, "uuid": "2e1af051-533e-4297-93f9-ecafdb8f6521", "value": "EUMRU.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5239a9c9-d61f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709114050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114050, "uuid": "22db82cf-df89-4285-92e5-e9b62ea35768", "comment": "Malware payload", "value": "fa8cdfbdff15a0372fbd6a2bb6203e08", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114050, "uuid": "2da6c986-60ce-415f-a36c-04f1f27caf68", "comment": "Malware payload", "value": "b08125d6addebf36afa19b4e2aff0192c12417adeaebe96c26a557d3941f3a4f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114050, "uuid": "31ecec69-b3a9-4cc0-94e4-27ab70d73bbe", "comment": "Malware payload", "value": "628ea149e0484d26100003ea24b62db4d1708f0e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114050, "uuid": "daa5a9f1-f5ac-43a6-bbe3-9143d4d95cae", "comment": "Malware payload", "value": "e18a5915e7948b9d916cb843092430b0630d405a4273ea09e178033a174d6b5e9334c69315a4fb46c4366d16c65a4b7e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114050, "uuid": "769ea04f-27b4-4fba-b7c9-d530658f4a74", "value": "T15EB633651BB34079D9BC13FCA8F58DE36E3BFC42297136EF86B86A9D0D122065530366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114050, "uuid": "ecd1b531-f0d5-4e9d-907b-52779a25cc03", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114050, "uuid": "cc9d4f77-5d13-442a-8a77-20cb4c9bf8af", "value": "196608:XU78BGJPD3kExwMcj1ZelOu6XfK7a9bFD+baMXSwh9vhwitvkWdmqjvZr:XUtF0ExijClORXfK7GD+baMXXv9tM4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709114050, "uuid": "8a43f4cf-2002-49dc-b482-98b4a81752bb", "value": 11358720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709114050, "uuid": "50580a55-b0cc-4bfc-8c68-ae2e17243526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114050, "uuid": "117607a8-6a48-4a32-b8f9-345e562d95d4", "value": "fa8cdfbdff15a0372fbd6a2bb6203e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1c9e10-d611-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1709108324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108324, "uuid": "a3d2f59e-8fde-4ba7-b25e-c3834a02abad", "comment": "Malware payload (Vidar)", "value": "7fa128c7060719f0954ca71639920e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108324, "uuid": "05b24727-49bd-44a1-983f-08987a52d1cc", "comment": "Malware payload (Vidar)", "value": "b1e5bd12279ecaf63aa22e082d6e833d8137d35ee32f87d2798e30e51a91367c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108324, "uuid": "e2447530-df20-4233-8542-a5c8ac531927", "comment": "Malware payload (Vidar)", "value": "f870bb7a42e1fc99dda40f11f1405846cd1dbc9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108324, "uuid": "cd14d641-042d-4453-a9c6-92d03f6b9dab", "comment": "Malware payload (Vidar)", "value": "4af5babea5d16f991403d1d696e862bfe2c5f8d4b1b63138da70994b007ec9d92aebf4db403f8ab9b9f3765724c9c7ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108324, "uuid": "aca2db75-6b76-450e-8aba-a96a70dee1ef", "value": "T11054E02276B2DC71D95B44358824DAB82EBF783269B4C5AB33B42BAF5D303D146E6701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108324, "uuid": "52528bd7-dd3e-4a62-9cb1-783e6345c259", "value": "49d84a51f28bda92ea8885bbc40b0c72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108324, "uuid": "aa8feb9b-25b3-4183-9873-43718215227c", "value": "3072:GtI08aJVW2uHCVd1sj4ZU2tezdvEoVaEvamVhvVNBDkEnq4laIrXB12g5erT7V+c:m8QuiVTDteZvkESmjxB7lJBADrT7V+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709108324, "uuid": "9b0c58f6-18fa-480b-97d4-d1e0c0231d0b", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709108324, "uuid": "b14794b6-863b-46f4-849f-7aa2ce0fd46d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108324, "uuid": "bf759969-51f5-4e0b-86aa-591c08b24460", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0681044e-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139263, "uuid": "2ba757d9-ea35-4bd5-8c76-507f213c2f25", "comment": "Malware payload", "value": "40cadc216af20d41ee77e21de8be8dd5", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139263, "uuid": "1734eeab-73f6-40bf-b0bd-485f8f2e84ad", "comment": "Malware payload", "value": "b39d081f524ff0eb4ca7ee63e77d953baa78c58401ce4f0af3d4b8f49549edfd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139263, "uuid": "7c367849-1180-47cc-996c-bbf0eaec69c0", "comment": "Malware payload", "value": "24ed073282a9e7948352315d07750f9c3ae5b7aa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139263, "uuid": "b2706665-c21c-4ea0-817d-e9543cdc93e1", "comment": "Malware payload", "value": "23aede90e345f01c21d7c2f1e6962153a66ddd654a1d220bbe95f3f76bd01ca1fb9d8d5efda2bfbd04cb4dcdb5dd8447", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139263, "uuid": "06ae200f-2cff-4d37-91c0-dcc5cd28dd9b", "value": "T1EF43F168056F7935E6C29479089E42FC5770585E87B1B2DE31AC32BE3982CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139263, "uuid": "59331340-17f8-44e3-b4a9-18228a09a8b2", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehG:BoOAcw7nXDUsOjm3jTxhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139263, "uuid": "33815cc4-37b5-4aa4-8246-47780bc5fbd6", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139263, "uuid": "ed9a69d3-f433-443a-b2fb-0d5d9d5d0d31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139263, "uuid": "bd7c8590-92d4-46c0-9d02-3b88ab02cd9f", "value": "scanned_doc#2024-27-2_4259.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c82d90-d680-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709155642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155642, "uuid": "5165e367-85ba-45f1-a4ad-8f06c902d180", "comment": "Malware payload (VenomRAT)", "value": "36152f2efa31421e3eddc1358d5e5ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155642, "uuid": "74abde8d-75bf-4f56-863d-1d57cb0efb1f", "comment": "Malware payload (VenomRAT)", "value": "b3d417b15e1f00fceee54400f8616f83e74e3f143ea885962ae380802c637841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155642, "uuid": "97c1462c-026b-464b-923b-2027a384ba03", "comment": "Malware payload (VenomRAT)", "value": "9fd25156c441963aa3a45bd75996ec1ae3ef2a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155642, "uuid": "94972ec8-8077-48fe-8904-04cd32a98223", "comment": "Malware payload (VenomRAT)", "value": "b70a8f7e928200ce72c141d713004fa17f753a6c061f6efd1802908c32dbae05b08980f8f9790a29925bed28b17994d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155642, "uuid": "ab1e80fd-99b4-47eb-98b8-c5f7dafc9d7b", "value": "T19F735A013BE88D26F2AE47B9ADF251074EF4D5576412CE5E3CC800DD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155642, "uuid": "33b703b2-f99c-4d8e-9320-35912441363a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155642, "uuid": "999b7120-ecf5-4162-ba21-09902317f32f", "value": "1536:jUk0cxVGlCBiPMVeNqien8I8h1bq/+5cGW/AQzcmLVclN:jURcxVMWiPMV8qzah1bqdoQ/BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155642, "uuid": "c2ac1787-e2bf-4e83-83e6-3f4d1da4ea45", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155642, "uuid": "778e4c6b-d120-4459-90ed-1eb3c9740aa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155642, "uuid": "07592956-e75d-49a0-9448-aebd5756f5b9", "value": "x0c3paPJQU9u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b77d94-d65c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709140207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140207, "uuid": "f126b43c-3a48-42cc-adb5-002bde77c604", "comment": "Malware payload (Formbook)", "value": "4ab337ca8fb0e68c8300cb019fe486f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140207, "uuid": "1a77048e-2898-4d1e-85a5-9695a5b17d8b", "comment": "Malware payload (Formbook)", "value": "b3feaf40b142df4a3782bf8867c9401254a18b08e61fe85db3bb6832bbfd2e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140207, "uuid": "e75e1938-d0c5-4b6d-a362-e51290fa6eec", "comment": "Malware payload (Formbook)", "value": "4c7b2b259a8b0a2e4a2f26ed327010832f0e4767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140207, "uuid": "dba07d2a-8b82-4817-954e-025fe2cbc813", "comment": "Malware payload (Formbook)", "value": "7dcabe90fb7fa99263255ceca3c4839925df5f2a8bdd868d2e552a9d9218dffefab2799a4f4cda83b81b0d0ec360796b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140207, "uuid": "ca21dac0-f1b0-4542-b23f-c200a5250535", "value": "T17005026533BCAF62E87E67F49AA5A44143F27D693532E2598EC274DF2A35F000661F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140207, "uuid": "fda2a7b7-15de-425a-b3c4-760efdbb0795", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140207, "uuid": "adfe40dc-4cd8-4fc1-a244-40633361b92d", "value": "12288:11y1ScVr4yj/YShQKeLtZG9cIUamb/CWnrhn8nMLyF1xoTaMTiTGTv0:vuSOPjgSh0t3nb/VJ8MaQaMpTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140207, "uuid": "b0922d9d-fa61-4040-9346-3e956e308029", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140207, "uuid": "3f2cca2a-73be-470f-b7de-a953eca7a765", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140207, "uuid": "05b60b9e-8f2e-4604-a1bb-4954ba217b65", "value": "SST Statement- FEB 2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41538ea1-d61a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709111874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709111874, "uuid": "8c74d718-7cd7-465a-977d-a4cc47e63de0", "comment": "Malware payload (AgentTesla)", "value": "85b6afaae1fbd343ade261da56361b12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709111874, "uuid": "19a2f0c4-c65f-4637-9eed-15549ed8d1b8", "comment": "Malware payload (AgentTesla)", "value": "b4d75e86f89e926a2afe1d1939bacee1066a89e9d4b84817488d594a6316c80c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709111874, "uuid": "cc99b0ce-4aef-42bd-9c40-8ec4a56c3bde", "comment": "Malware payload (AgentTesla)", "value": "d3a99975228be4e04f591362a31f36b5543890f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709111874, "uuid": "c4dc6dd7-4ade-4a87-8e17-436a1d52b045", "comment": "Malware payload (AgentTesla)", "value": "0191619094ab47fc7a958a761876152537e374aa5827f6324499218ac9aae96340a183be0aa53d8cdcea0bbaaf83e3cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709111874, "uuid": "86b15486-7210-48ee-a056-2c816037aae4", "value": "T11BC40119B7E8052EF6FF537FE86016004B74BE932417D78E69066AFA10727E48A11B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709111874, "uuid": "0fea25ef-cb84-4d1a-85b0-d3cecd3d4249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709111874, "uuid": "f60b38cc-e197-466b-93b4-0b8de6a6fb34", "value": "6144:aYUsMaT5cA/F0Q9aF27NkmZgIXMjWp5nkCYJ9D0yxu7K9XaE24gwV73Fzdi73GrD:pFB+27NkxIXeEY7G70aEJFVT1kG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709111874, "uuid": "03e92345-e957-4aaf-ad3b-628d0d443853", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709111874, "uuid": "0dcb753c-0b3b-4f62-aec1-df9973362437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709111874, "uuid": "4eace70b-6b98-436a-b122-b3d86cbbeb53", "value": "FAKTURY.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8aba4b-d67c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709153876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153876, "uuid": "34c5c79e-a1d0-4a24-bb4b-ec63a7c96f39", "comment": "Malware payload (Mirai)", "value": "0b1e2f36c65326a40ceeb5a8cecde150", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153876, "uuid": "d1fb115c-f50d-49c9-9a28-9aab38e9627d", "comment": "Malware payload (Mirai)", "value": "b5ea5d7f37869ada06bf561507ee94e57ce4f741b525faa50331b6d0a8b31753", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153876, "uuid": "e44228d9-3d12-48da-9783-617b8eec9427", "comment": "Malware payload (Mirai)", "value": "1f3bd1fbf886f4c9b5904428203035a8af36cf90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709153876, "uuid": "c1edbf1b-9571-4219-a4f8-c6c58037357a", "comment": "Malware payload (Mirai)", "value": "d0ed3aa5b76c69815c83fbc482dbd1fc5b627f34bf83fce259835ebc1abb3185add51dd21ddf3da56025885672505892", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153876, "uuid": "01760516-88ca-4ff5-a6ec-0ba74f30285a", "value": "T1D1043B46EA508E13C4D22777FA9B82553323A764D3D733065A28BFB43F876AE4E27105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153876, "uuid": "7aaa59c6-353a-4235-a5ce-cfa7e0c614ae", "value": "3072:utw2kh3wDO5wDPMaEaC0kiu+/yiFAnnbjHzBiEzXS8bM/9FcwgymAw+BVnOR:n2D3hEaC0kiuTiF+jHzBdzXSgM/9EymB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709153876, "uuid": "fec4dd93-5d7c-440d-a206-8b3cd7a49354", "value": 189893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709153876, "uuid": "cbeac79a-c045-4246-94d5-ef053af53c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709153876, "uuid": "8bbeefde-8419-48f1-a75e-e1b305dcd793", "value": "0b1e2f36c65326a40ceeb5a8cecde150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df0b6521-d685-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1709158095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158095, "uuid": "9f391757-b375-4787-bea1-b473f5895fd3", "comment": "Malware payload (AsyncRAT)", "value": "0bdc1b0a44429d769e00de4f618f28de", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158095, "uuid": "6429190a-522d-49d5-9e0b-cd3794961a9c", "comment": "Malware payload (AsyncRAT)", "value": "b6e9a92088c06053d47298a4f7d09dc1bdc34371bee829aebe157531b02fa9e5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158095, "uuid": "f84a2cff-0bb2-4cd1-b49b-b22cc18536ba", "comment": "Malware payload (AsyncRAT)", "value": "5cd180cc0c193d683d0d4d1df6bb736d69979337", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158095, "uuid": "155c95bd-56f7-499f-a247-b9db997ae71d", "comment": "Malware payload (AsyncRAT)", "value": "97cc8951528bba3c9a61ba54e10079aabf1bda9a7047e797a96e97fa9910dafd9d075a1b436572988ae716fe15d8f89b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158095, "uuid": "a206a508-177b-427f-8ce4-85c34d997582", "value": "T19B644A0633558B4BE10A3B79DC61FD1A0AB09C357C42CFD9FC5432CB99B27C8A5926E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158095, "uuid": "194808fb-f89d-444b-8cd3-9a2efc5af7ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158095, "uuid": "8e2bea66-0683-42ad-a755-56cb539ce979", "value": "3072:sUIcxhzVCiPMVSe9VdQsH1bf1+fmVQl8gvSA8MfGk3bxtyi6Y:sOCiPMVSaesVbN+fA28gvSA8Xk3FtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709158095, "uuid": "e8bc8996-f07f-4bee-b5f1-b2d41ea82439", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709158095, "uuid": "ecf3dcd0-3a72-471a-acd2-cc4f3df8e6f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158095, "uuid": "7a57a8cf-39d0-438b-9a94-337791770501", "value": "bTf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170a8a38-d617-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1709110515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709110515, "uuid": "4e70e875-bc46-43d0-ac5d-3ba4d03d0591", "comment": "Malware payload (CobaltStrike)", "value": "1e511ba5634e6c40a4912252d51fa7e2", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709110515, "uuid": "1ac65789-a6d0-43b7-b3a5-1523f202526d", "comment": "Malware payload (CobaltStrike)", "value": "b791bd10759619ad5bf3c1f443d1208336da894686c1b9c9f7f82bfe70f7d59b", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709110515, "uuid": "fc6ee9f9-fef7-4e20-863b-881d118de2f1", "comment": "Malware payload (CobaltStrike)", "value": "f1a9dde39b66a2c426b369281f5e1820e56c2662", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709110515, "uuid": "7e60cb06-4ca1-4d91-8bfe-735f95716584", "comment": "Malware payload (CobaltStrike)", "value": "42d4d7009f6d2fd578f56aeb53361854ddcb4f86bd0c2ee60172aeb1243326065e7877ed1474a656cfeccf91ab02b141", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709110515, "uuid": "242be1f9-c5a8-4cae-80fc-28f5dc6f3ff1", "value": "T100657C4ABCE144BAE0AAA3338CB251C17B71F8181B3223D72E50B67C3F76AD15A75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709110515, "uuid": "c0d7434a-48bc-4217-b83e-a1b58ae42475", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709110515, "uuid": "9718b2d5-9d37-4186-8a8e-a1a0114dfb03", "value": "24576:SfCnpVQpzp/itL301+iZI82caPRkRHadOgPV4iAWU2dU491:/bQpzOhWbHadhbAGh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709110515, "uuid": "d8c2f59d-358f-45c8-92a5-f34aab35c44d", "value": 1410560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709110515, "uuid": "c82a7ff5-f422-44f4-8313-3473e50fbe74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709110515, "uuid": "a792b86e-df81-4fba-a680-684c9a29c1bb", "value": "1e511ba5634e6c40a4912252d51fa7e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87009b21-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139479, "uuid": "aecec661-9d63-4742-bc44-444facdaa918", "comment": "Malware payload", "value": "267d378352f03a8164951a3b0d251a74", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139479, "uuid": "faf9f427-5439-4a49-9e67-436085b45298", "comment": "Malware payload", "value": "bbb7177a938878e5f120099ed584446004d567ce8f1dd32b905496535bec8d61", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139479, "uuid": "b472b2ce-39d1-4af3-ac30-399a1b271b55", "comment": "Malware payload", "value": "5ea250e31e2fa0d4dde32c125bb1b5df474aa4f9", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139479, "uuid": "d1e1d7ba-de15-45bc-81a5-c48f45543ee9", "comment": "Malware payload", "value": "d61224c5942bd59dc9e9c8a8eb36ce35d10a20af515b9113559754182135a26454ea3af4f9a2a8f67d9976905f3c7c58", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139479, "uuid": "b3dfb6e7-ab3d-42cb-b9ae-491c3e0841c8", "value": "T12843F168056F6935E6C29479088E02FD5770589D47B1B2DE32A833BE39C2CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139479, "uuid": "a832744c-96c1-4311-ade1-73aae746c962", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehG:BoOAcw7nXDUsOjm3jTxhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139479, "uuid": "3db39183-5d0e-487b-8434-b5a433927c46", "value": 56841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139479, "uuid": "deb23aa2-6725-471e-a0ac-31f914793755", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139479, "uuid": "a136ab69-50d3-4536-854b-c6f5b1c1a9c9", "value": "scanned_doc#2024-27-2_7644.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171a5f6a-d65d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140580, "uuid": "0c835969-e09a-4797-b113-c063e135204d", "comment": "Malware payload", "value": "b215c99ea088a1ee4757b21334f0b508", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140580, "uuid": "6ee886f4-da0d-4f37-b325-b75c1636c001", "comment": "Malware payload", "value": "bc6e6e8424ee949c7c08cd6185031cc1c692290fed0fa767ead6c868fffa770d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140580, "uuid": "65eda71b-f888-4bd3-b634-ba91a17cdaf4", "comment": "Malware payload", "value": "784f0360e0bb0731d7acc4f10e2b80581a5bf7f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140580, "uuid": "e7def422-0484-4df2-982c-6a5598f48c27", "comment": "Malware payload", "value": "5e9e123ed49fcc048d24050598d92aa26526de0f3ec19f41d42e825fe2d4d406b73282cbc9816ffbfdb93c94c41169cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140580, "uuid": "26b1b790-cfcc-47bf-b4c5-aad54c241019", "value": "T1EA55D01363DDC361C7B25273BA55B701AEBF782506A1F96B2FD80D3CB960122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140580, "uuid": "06e0dc23-9c7a-4c3e-99ae-760541caaa05", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140580, "uuid": "21811ac2-965e-4f5e-9cf4-b5fe971213aa", "value": "24576:ztb20pkaCqT5TBWgNQ7aRt6wyTacJx5llXS1NH0m6A:wVg5tQ7aRtkJxlXS1l5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140580, "uuid": "7a12d618-cafd-4035-8bef-bb98a5b0593e", "value": 1326080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140580, "uuid": "6842e101-b779-416d-a879-271438ff3861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140580, "uuid": "c0d4aa4f-af27-43e6-a5d4-945a43a1b8ab", "value": "Tartoz\u00e1s Budapest Bank.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1b402e-d62e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709120747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120747, "uuid": "4ab7037e-27b1-4502-9964-1abb0e4f20e3", "comment": "Malware payload (Mirai)", "value": "f55b17b2238726ccd6d291c8951eac64", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120747, "uuid": "51cf471c-f4e3-41df-8e4a-9425e7beb306", "comment": "Malware payload (Mirai)", "value": "bd12c8b00314470130f1817de782dc95944d08d8db6bfdc675dfd116759242ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120747, "uuid": "f5fd2b68-8bc2-4a90-8a8f-1eed67acc781", "comment": "Malware payload (Mirai)", "value": "c9bb588dff7f311a98492eb4602097f20bb6776d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709120747, "uuid": "b5e1ec4e-e82c-4cae-94db-e40b077ebd84", "comment": "Malware payload (Mirai)", "value": "fe75cd65c1587919d8191abcbefc4e86d4227faf20d284722233205ef36476a30628cf075a9620fe1faa22928d645484", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709120747, "uuid": "afd57f9d-787c-4d63-9727-1affc1fc4242", "value": "T10A3329C4E943DDF8EC5115712067EB328776F13B1029EA87E7ACA623BC86B41E44729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709120747, "uuid": "dad07d7e-78b5-43de-9c3e-ed1138940c49", "value": "1536:O13kynNjv6czSEZeLmI37KNCgoMTIkvQz6Nsw2RAvah5CQ:AUyntv6cuEZ437KAgogIkveaswiND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709120747, "uuid": "5936e9fd-5be0-419c-b7a8-23d52ce3012e", "value": 54864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709120747, "uuid": "972a079b-76a0-4843-a01c-e56866ce7770", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709120747, "uuid": "55b56a8b-2eca-4ae7-9dbb-f0ade463bef1", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6a75742-d5f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709097925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097925, "uuid": "34ff00b5-39e8-4791-b62c-1648c7b9dd2b", "comment": "Malware payload (Socks5Systemz)", "value": "e6edf0d8118fd72329ce398aa9f32076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097925, "uuid": "1d34e74b-be5d-4325-9e45-d3457e220996", "comment": "Malware payload (Socks5Systemz)", "value": "bd80da78c0269c132933560fbe78e31e66aa32873e2c55f188338c87f5b75ac5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097925, "uuid": "d04ee0aa-17ce-44db-af6c-04e2e74cdc81", "comment": "Malware payload (Socks5Systemz)", "value": "b80b2dc2092c2316bd7dd1543f164936877de058", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097925, "uuid": "2a0bb070-9c11-41ec-a2e1-8d090ffec055", "comment": "Malware payload (Socks5Systemz)", "value": "19e31e9216b76083411951fc2567e6ae2da04d874d0c4265d44bab5a96c1b81f2adcd2d0ee2661073eb3805dea51a7a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097925, "uuid": "ce7d90bc-13b5-4b72-9f59-b536a7f920a9", "value": "T1F7C533B3ED92F03AC050D1B40C7BA2649D7B7E85A4390548B0EE6BDE0F3B591D25ABD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097925, "uuid": "2ea8cb35-d3d7-492c-a96e-90922a2a8158", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097925, "uuid": "acb6af6e-aba6-4cd6-9902-39f5e1a35b9c", "value": "49152:C9789S90OfArbkWFuvunbAepRQGU7yvbWoz84f1QMH58:M7840OGkpvqbpBn9Qkv58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709097925, "uuid": "cbb32680-21f9-4e2c-967e-4163332cf485", "value": 2702834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709097925, "uuid": "2d7c02a2-9303-4541-9a11-9409eb435cfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097925, "uuid": "108ea263-3873-4ffb-b213-f8023a6534d3", "value": "e6edf0d8118fd72329ce398aa9f32076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d058e1-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156836, "uuid": "eadc1e8e-c8a9-4d6b-8990-e8c0c0efbf41", "comment": "Malware payload (Mirai)", "value": "50648e66745875a4585d877609c7b858", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156836, "uuid": "5c060a65-f951-4e02-acdd-b66109938245", "comment": "Malware payload (Mirai)", "value": "bee7fcf847b09f2ec0fb602b69f2d31aa5b2c7ff7c43be0917f9147506173ebe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156836, "uuid": "f6a55b14-9906-4269-92c9-9c47da5339c3", "comment": "Malware payload (Mirai)", "value": "7ec7a5ef586f566c39f584e547cd06b15e9dfab3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156836, "uuid": "2179a76e-09d3-4ed0-8dc4-e3317139eaa4", "comment": "Malware payload (Mirai)", "value": "cd9b5044213791d5c11901ff6cfcc22dd39102510dd06615948540f69b067da72d1a96f5583b7232ead955b1c3cc6b4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156836, "uuid": "63cba29e-a813-45ae-a4fc-fb581c1a8abd", "value": "T1BC935C83E6C7C4F6C843457A605B6A3FDB31FA5A80378696EF899D36C533A04421738B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156836, "uuid": "169b29a5-5f51-4ae0-975b-c971a1a4ce22", "value": "1536:BarkOd/LWjh4Elcw6bBTb7OnDxcZMZW7WYob+ioIutkQKU7xFg3:XOd/M4Emw6dCnDgSYob+ioIYkJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156836, "uuid": "b3a23755-34bf-40f4-9344-67513bcde0a2", "value": 91276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156836, "uuid": "e11e621d-a6ab-4896-8fac-93d70da10c18", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156836, "uuid": "055c4bac-631f-4b80-9d5e-8ca1d148fb5e", "value": "50648e66745875a4585d877609c7b858", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61e10c1-d65b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140014, "uuid": "ecaa7ab0-8142-4df9-8084-68444ad86ba2", "comment": "Malware payload", "value": "5b83a10adbd127979f0cb3153cba1034", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140014, "uuid": "80a8255c-3080-4dc6-8ae4-e75865d9586d", "comment": "Malware payload", "value": "bf36628fcfa6a7846b51b5ab91d135294568025566ab16aa59ce757af0b29833", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140014, "uuid": "e729a76a-b909-4411-9da9-98cfb69f9d86", "comment": "Malware payload", "value": "25eaf52f3663dc29e6c630ddc170b90ccd29ba0a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140014, "uuid": "914f6cfc-4e03-4709-b700-8ce5541bde99", "comment": "Malware payload", "value": "998add3aa6d78797b072d5afe54ff863fc2170e584af01589beb71d58e5bfe40b806dead809ec5c3c6688159a80151cf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140014, "uuid": "dfa9756a-e417-4520-9e41-d516808ec190", "value": "T1E34302784117B806DA82C83E0DCE02F963506C9E87E2F7EB35EC627E6442CE601D87D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140014, "uuid": "aff4c41e-daab-4106-8c92-0100410c7277", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdz7:EoOAcw7nXDUsOjm3jTX6ot7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140014, "uuid": "efd285f6-62aa-48b3-9ad1-9a41795813aa", "value": 59513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140014, "uuid": "8fdea938-9852-4574-b859-84c7ed43c607", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140014, "uuid": "227b701b-7ae3-463c-94da-d0b5735cedf2", "value": "scanned_doc#2024-27-2_1662.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7e0663-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709129687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129687, "uuid": "d853c77e-bde0-4d94-b064-8dd6564b31c4", "comment": "Malware payload (AgentTesla)", "value": "5efe9d205087c1888256b73a27e169ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129687, "uuid": "2a5f7103-c7d7-4c80-a320-f45cee66949f", "comment": "Malware payload (AgentTesla)", "value": "bf3c9018cda0a86ff2b2db9acb0ebd132c496a8652f0bd7eceede49259c60b81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129687, "uuid": "bd6ce6c0-d636-4650-9da3-26cae14d222d", "comment": "Malware payload (AgentTesla)", "value": "d63a245bd2208641d73030d02f7d1977f968f1f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129687, "uuid": "4d05961b-7020-4a0e-a2d2-3c4742626403", "comment": "Malware payload (AgentTesla)", "value": "66872c54d19e688a9107e547b1a1e54d32418515fc59ed924ceb769881b361d6085ec42762345e6f25e55376640f5844", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129687, "uuid": "237bdd47-e172-4d2a-b591-9ea0a554fc61", "value": "T19325BF1373DE8360C7725273BA66B7017EBF782506A5F96B2FD4093DE820122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129687, "uuid": "22bd640c-10a2-4546-ad60-c170959c44ce", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129687, "uuid": "c104bf29-867f-430a-a5b2-4bba9453d81d", "value": "24576:Qtb20pkaCqT5TBWgNQ7aAitZVmTMXOMb6A:ZVg5tQ7aAwn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129687, "uuid": "b174b0ef-fa7a-4673-948b-ed80cbf0bb90", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129687, "uuid": "9e9bc5c4-4952-42dc-ae18-f3de74fed4c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129687, "uuid": "42eb1564-fbe5-43d2-ba76-e779cc44fd7b", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5440256c-d684-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709157433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157433, "uuid": "ecdbd7bf-f836-4a24-83e5-74931f4cd9d9", "comment": "Malware payload", "value": "d39c490dc70f73c68bfafe3fe9970d85", "object_relation": "md5", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vmaware", "colour": "#C88DAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157433, "uuid": "9d61948a-98fb-4815-a6c8-cfb195548d4b", "comment": "Malware payload", "value": "c199cf21b7222adf5758e64f97b828f9ab19b5b1d8b8339e90670807213ed79c", "object_relation": "sha256", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vmaware", "colour": "#C88DAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157433, "uuid": "6c65cdc5-519d-456c-b40e-128752eec3cc", "comment": "Malware payload", "value": "01225f41536ef07c5d1d48907cd202fb2e5dd1cf", "object_relation": "sha1", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vmaware", "colour": "#C88DAD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709157433, "uuid": "60061457-3365-48ff-9ba7-bed40b4d2549", "comment": "Malware payload", "value": "5e2db24d4ef6476108b862f06aa9704260d9ef6621c7b92f8f6914b4d2c22cc5524f5876bae53a9290ada70f7d6b8fe7", "object_relation": "sha3-384", "Tag": [ { "name": "Discovery", "colour": "#B07610", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vmaware", "colour": "#C88DAD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157433, "uuid": "71bc1758-f833-475b-959f-000e0b087f2a", "value": "T18D341229E22F7120CA0AEB7A484F804803E5A3994693CB7F254D7324EF277779695FD4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157433, "uuid": "5c948c15-9f16-4531-99b4-e84859a665c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157433, "uuid": "32363a5e-f714-4e0b-856f-d801218f2c69", "value": "6144:Zfvxsji8BIM1hu+RGbigGEgGBXeb1C+7a58Omo4:5vqwupgG+EZoTmo4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709157433, "uuid": "42d22384-15b0-42df-ba26-4dab8ccd65f3", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709157433, "uuid": "8722eccc-1156-4a40-bbd6-4461dfd3533f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709157433, "uuid": "3ceb1e9e-268c-4b4b-b299-031305905c62", "value": "Unlock_App_1.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6d0548-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709125608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125608, "uuid": "6d499e0e-7f0b-4d30-a206-869de4c659ef", "comment": "Malware payload (Gafgyt)", "value": "a10cebbb3c8a6632dc736914e9a4eb04", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125608, "uuid": "62068de7-1cf9-4952-beb3-b6d49cb9f15f", "comment": "Malware payload (Gafgyt)", "value": "c2302af9eb192e4267b9ec3625879c24554b54230c7022d840d34448423e3490", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125608, "uuid": "52281c3c-cf4a-40fc-9e1d-b0c6547264a2", "comment": "Malware payload (Gafgyt)", "value": "55df11dd3fc5d7ab6d1c48884cd693593f3ec1f8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125608, "uuid": "6e272bec-66f3-4886-a437-615dd768537f", "comment": "Malware payload (Gafgyt)", "value": "68785c9e8fdbcf9fca68f64796d325388de687314f9cd2242c6ff6ff7474c66b7167541ac1f16e59009129d5241e730d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125608, "uuid": "6612aa2a-3be7-4b43-9221-fa7043c46763", "value": "T1A2935B23B552C67BC0C756B91BCB9E618823B8BD0B33320A73D87DE42F169D92D59B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125608, "uuid": "60088002-5fe5-42cf-bdad-008161c39783", "value": "1536:/7yWSCATAXfoGcHOtP4dBMO6juUcuO3ahptmoIcuOXFje+ZY6Q:jnATAXfo2tPoMaUcuyahmrcuOXFy+ZYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125608, "uuid": "81c88ecf-724f-4fab-a094-badb3dd99908", "value": 89625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125608, "uuid": "ffb08891-69f1-4add-80c5-d16b6dee7bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125608, "uuid": "9455c29e-d845-44c6-9ea2-b1855de7711c", "value": "a10cebbb3c8a6632dc736914e9a4eb04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edfc885f-d685-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709158120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158120, "uuid": "d402da4a-8776-4dd3-a870-25d80f42bdff", "comment": "Malware payload (VenomRAT)", "value": "8adea7a853cd54e4a4c50449d0acf5f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158120, "uuid": "7e198d45-f0b0-48f8-88b8-cb33a07d5a26", "comment": "Malware payload (VenomRAT)", "value": "c29da2306b6d491c1907b6fa1150104854bc32530fd70f50cd7da4d37c1fcc26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158120, "uuid": "439121a8-eb5a-4a4b-8fed-ef8c951ce31c", "comment": "Malware payload (VenomRAT)", "value": "a782355f448e68a7298c487b8bcf7c2a621f212f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158120, "uuid": "9bec8bba-074c-407a-95db-553e6aac72b1", "comment": "Malware payload (VenomRAT)", "value": "54c182536c2d717c9e9a06db4b601d2b35c86ba79bd0b2b34c8763eaca64c45b11f64b0f63489e849f5da8ff71676dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158120, "uuid": "c0d90300-b025-4196-b126-6a8c29b09eca", "value": "T1C3734A053BD88D26E2AE4BB8ACF251074EF4D1576512CE9E3CC440CD6B67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158120, "uuid": "fd551c6c-f0c6-4be9-95c4-cf5b80a59399", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158120, "uuid": "1f5778c1-cd1c-492e-aaba-8802187a3495", "value": "1536:1ULkcxVKpC6yPMVosQyXvp5IOMH1bB/qFNQzcGLVclN:1UocxVENyPMVl/vp7MH1bBgQfBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709158120, "uuid": "c9a09453-f9b0-4334-b037-d4313865f41b", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709158120, "uuid": "2800ea8e-af07-4443-b6d5-89607ed4f9dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158120, "uuid": "0e36cbaa-4430-4f81-86e4-0657eafac66f", "value": "bTkg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b228ec2a-d637-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709124519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709124519, "uuid": "3f1ac1e4-c4ab-4546-a515-fff09562a411", "comment": "Malware payload", "value": "46ec9e16a842b84d34a2e595168b47ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709124519, "uuid": "a92e0f7e-ca47-445f-84d3-d6a2c03d1323", "comment": "Malware payload", "value": "c4f07c1ae53564153eaf2b003b8a5f7c970d32e0cf2c40378324b582386e760e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709124519, "uuid": "24d39781-cc24-4ba3-b10c-1d21b846055f", "comment": "Malware payload", "value": "d9d55ce7b0cec8b6c0dfd173d920902d85a167a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709124519, "uuid": "80bc8b69-d97f-4049-9291-ebbbff361322", "comment": "Malware payload", "value": "c7e64f460e98e074261631746ecce870f5198d3070e9ee4957fc2f1eca5ead64e4ea71182702e347e81b6f1700e5ba9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709124519, "uuid": "81fd866a-c6f1-48e0-b88d-8df0121cbfc2", "value": "T120B533A18E64C161D188C8F2409F461FEF73964440407ADFDAF83EBC3BBAC5593696B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709124519, "uuid": "644c721b-227f-494e-ac8b-f1d219900c70", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709124519, "uuid": "6e4fbbae-1bb3-480f-a020-123337ca2e13", "value": "49152:3iP2zBoTsQz3b21IPL0Ik7gndPgUQ7aH4jsh8GEbWuu7z3vsDCiS9:3hzBTWKmwkndoUQ7q4j+EbWxyS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709124519, "uuid": "dae15620-eba2-45df-a5c9-98a4aafd56f8", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709124519, "uuid": "b45f7901-d8ba-472a-89c4-81572b5a0147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709124519, "uuid": "6367069f-e928-43a0-b835-679fb22b2683", "value": "SecuriteInfo.com.Win32.TrojanX-gen.27124.23512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d54bed53-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709159797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159797, "uuid": "683a8a90-739f-4245-b2c0-2bc1c6640bb3", "comment": "Malware payload (Gafgyt)", "value": "ea309f0ca298587b895eac62f2bca019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159797, "uuid": "6279a1ed-f2d3-4625-894f-5c66045c5e4a", "comment": "Malware payload (Gafgyt)", "value": "c5115185ed445bf83bd1de3f433c0dbc36df6b3d56fbcc5518689182ebd0aa83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159797, "uuid": "3149396f-ef9c-49be-9f73-d70d213932d6", "comment": "Malware payload (Gafgyt)", "value": "8902cefcc14364214c75db6b1d311d294d4935a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159797, "uuid": "66b3ce6a-2beb-4c78-9753-112254cf8e58", "comment": "Malware payload (Gafgyt)", "value": "60d611cb5e6412c79651c4958bcba894c98830c842bc65e808fc057f551a71854b96c8816e1f7a71d273965800d53ebb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159797, "uuid": "aee2e783-9dc4-4d93-963d-24b0f2365a56", "value": "T1B754D713C2110966E29519F232673280BA57437FDBEB3283F9191EE0BFA4A5B0577ED1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159797, "uuid": "db224130-f1e1-4d3b-b386-cae3cdfcee6f", "value": "6144:AYYcatHJ2y2+z4RZedkAM/LaSXV7zm6wxTIe+5:AYYcatHJ2y2O2LAMZl3m6WTIe+5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159797, "uuid": "e0476dfa-fd72-4785-844b-d03a3b2da515", "value": 304714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159797, "uuid": "2e4fc045-741a-4e3b-99d3-ef3a70dc5bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159797, "uuid": "49726003-b78a-4afc-9950-ac138175a28e", "value": "ea309f0ca298587b895eac62f2bca019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e307a4-d635-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1709123646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123646, "uuid": "3d19bfc1-2e83-4473-b07d-5ca8ea87c7a2", "comment": "Malware payload (RemcosRAT)", "value": "10c4765d877dd5af8bf188b45dcc4009", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123646, "uuid": "d3c00d8a-1b3b-459c-b986-d57f83c7e3bf", "comment": "Malware payload (RemcosRAT)", "value": "c55e1ca73e2539c23fa96c51aec59fd49c90ffc4b2441707c516e1b44eb018b7", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123646, "uuid": "f1189c07-0a49-47d3-a672-4e4c26c4acdf", "comment": "Malware payload (RemcosRAT)", "value": "9eb63ba82df53b0072043f2feada974c2db21f78", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123646, "uuid": "d42fd71e-cd1c-4d1a-b41d-3cb6666e5d5f", "comment": "Malware payload (RemcosRAT)", "value": "3cf813bdf1484a4f4d3ce9c2bf3e06653ae3bbff2a6a666007a3411593d09a5bcf3a66f191df27996d80f66b75b4625e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123646, "uuid": "d95c14b4-dd51-42ba-81d3-2a033216c258", "value": "T13BE4237843FCB090D5CCB5A2C8158DA9A89291CD3815FCA95C92C5BF0819F4DFEE46BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123646, "uuid": "339b9937-f983-4d66-b112-79bdbd515954", "value": "12288:GQXXm3YSePDkCAlgDVlveKx4O1tTKw6F59dQX4uhNPUeVQyVSEz4:GQm9egCigplveKxXYlFYUyRSEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709123646, "uuid": "4697dee0-49c8-4ebe-a682-d45ca25ed43d", "value": 658747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709123646, "uuid": "d713866c-00df-414f-ab8c-1a20991c7c0a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123646, "uuid": "8d93461b-0cb4-4594-ae37-706f17e1ccf8", "value": "n#PO60502.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41816465-d62b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709119176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119176, "uuid": "21c4552f-06c0-4eea-b42f-ff1828acbbcf", "comment": "Malware payload (AgentTesla)", "value": "d9d68de21221d5a0ce1bbec1b68b3383", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119176, "uuid": "cd7ed54a-efff-47a9-94b2-9532a09708a6", "comment": "Malware payload (AgentTesla)", "value": "c9ac7a94d91767c92b94cc265b68c2b29506bd2ef6e3922fcb44695d93a9a4b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119176, "uuid": "0bc0481d-c3c0-44a9-9608-362a45c3cc80", "comment": "Malware payload (AgentTesla)", "value": "9b549c29892782f978b6a8bf45378cc52e615829", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709119176, "uuid": "9802ce24-c5ca-47e5-bfb8-6a897ddc80ea", "comment": "Malware payload (AgentTesla)", "value": "8b40ecb3335c27895e030aa87931b76b6c4192f80843f05309cf960b13fe1cdfdf632fc0398594db396c789e733f32fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119176, "uuid": "94da0dc8-95c9-4d6f-8052-3bdd28dd5e23", "value": "T102B4237CCC24A4F41052AA49CC0F153F8A4E65337CD5EE6B9830FD687982B5BC2A8736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119176, "uuid": "be237bf2-a7a7-448d-9fed-1b0c94596bdf", "value": "12288:tllXZECc54A/gcwNBy3GLlnW1nwvaWcHJLwRppczwDoPVru5b9M:trXZHc54A/gXy6nW1AaFHJLwlrDUlu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709119176, "uuid": "f8e80657-d9f4-49aa-9a15-3f5a7682c8aa", "value": 524987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709119176, "uuid": "b1a2b72b-ab07-4aca-a92a-500647e44683", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709119176, "uuid": "d9ccbd87-5624-4156-a2d5-47490fcda192", "value": "JUSTIFICANTE DE PAGO PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bafe023-d60a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1709105073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105073, "uuid": "3a3c02e4-e3f0-4836-a302-0a9b397ad760", "comment": "Malware payload (PureLogStealer)", "value": "5ca4fe497968b99c596eff95e1aa9a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105073, "uuid": "b44e1993-e95f-44d9-9f58-db87a895716a", "comment": "Malware payload (PureLogStealer)", "value": "c9b51f852c0cb780bf1ca5bc137df083af9c9192188491d8ac1219ec30de8795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105073, "uuid": "922134cf-aedb-46ca-bfdb-6094523fe0f5", "comment": "Malware payload (PureLogStealer)", "value": "776732defd9c4abdf35871798af4379bc925a879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105073, "uuid": "37ef9de3-bab7-4a37-bba9-bb5ab57c54ee", "comment": "Malware payload (PureLogStealer)", "value": "2bd93b5abaf08d2b42e12aaa82d40ebc83bca52fa78519a761f50799a43f9f3708e419f47987fd3881b10f7ab51d9291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105073, "uuid": "649b08f4-2432-4614-8b19-eed2c72b794b", "value": "T14567332F27B4912ED55A8F3056328620947FAEF1F81A8E1E93F0390DDB3BE611F16552", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105073, "uuid": "790036e4-7f4c-498f-9002-e9145763bbe7", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105073, "uuid": "647c87af-1caf-427e-9c9c-2557f6b0c5fd", "value": "786432:Jyzzi4dXPbtUDBJJad4Ap2mE6z9BT1+F38Wr9CIf:szzisXPb2tJJad4aE6JBT1s38Wr9N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709105073, "uuid": "22704555-d056-45e6-8e3e-282429c223b3", "value": 31172160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709105073, "uuid": "42fa4013-e011-4f96-bb77-f29b0f488a39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105073, "uuid": "50b4126c-9a3a-4ce3-a8f0-6b9399503e04", "value": "SecuriteInfo.com.Program.Unwanted.5412.13791.2233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12ae3f2-d67e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709155012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155012, "uuid": "1c3b04cc-df72-41ff-aabf-c5960993d076", "comment": "Malware payload", "value": "063b554ac762e071050daa3b62b27063", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155012, "uuid": "5285ccd0-e4ba-4054-9889-171f07b55812", "comment": "Malware payload", "value": "ca89d967747508268a710bb9f0c56afde1377e8c818da8d5635c95e3dbbf7683", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155012, "uuid": "fcc7a0ca-3f98-4c0d-9236-584a340f011e", "comment": "Malware payload", "value": "64ec4debbfbeb0ae69fc00b6eabd37eee45b3d78", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155012, "uuid": "a42cead5-9279-40e2-8873-e8dbc97d0601", "comment": "Malware payload", "value": "9e0fb2c7ba9455f57ac4ce9e8d37fc08e69d728545c47965b92ac16598beb4d24ecda52722d772f4ead2ec265950ea70", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155012, "uuid": "9745e62e-3c07-4391-b11f-8c8b379a3faf", "value": "T1F1E633850605C7A3AADBFE41EC5E772E0B4ACB8795F0C2E36AB601D1CF4774E94A4C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155012, "uuid": "445f1f40-9a0a-4264-91e6-6c8759151da4", "value": "196608:OiOI7uoKGGCcjmpja7ZRH4kQ0bwpL7vaNdiD81GJyioPK3TAqVXaNVUX+GtWaguH:4bMr+7HYl0EdiNMIM1oyc00WtNLZWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155012, "uuid": "bc9ca992-cf22-4fc9-9de5-ff011fb10f81", "value": 14024223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155012, "uuid": "aed8a69e-1eec-4304-bb36-ee740b508188", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155012, "uuid": "6fef110c-9fc5-4bca-949c-9701ebc5ba46", "value": "nopagadanueva.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a0a2d0-d61e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1709113806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709113806, "uuid": "8a0de059-a0b5-4a7b-a2f4-2e8b97949a25", "comment": "Malware payload (Formbook)", "value": "71fe929f572ccb9fccc4d3fa192a68b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709113806, "uuid": "cf7b9146-3d93-4c9f-b0b0-ea05829796a0", "comment": "Malware payload (Formbook)", "value": "cc05f16255014ff65462677d57fe36baff89c741ab9c2b9b8b71ff24bfb7cd49", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709113806, "uuid": "b274a803-173d-44d9-b4f1-8a4038cb3bc7", "comment": "Malware payload (Formbook)", "value": "e32dfbede3f6fe5c14687ae404c5208639dd6d7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709113806, "uuid": "28bfd41d-7a0e-487f-b4aa-91ebfefd5de8", "comment": "Malware payload (Formbook)", "value": "6b02981802f7488144373b0b9d36477f2f66ba9164c8ad0f468e72d445e58250ba60f8eb8fda2483587e7092724af72f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709113806, "uuid": "0cea5d66-85d6-44b8-ac12-8d51339b0238", "value": "T14ED4230FB9AF8CD81061D4ED629B7147FF3750AECC84182B5AA4606DBBB57218D43B39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709113806, "uuid": "8c8c4a3a-2a85-4a54-813c-dc799fec3b0a", "value": "12288:ms2v3vve/T5tQUKtbg7hsUvdOLk/yAPCH1Xrf2CNIaFz2WJe6Tz:R+3vve/T5t9qcpvdOLk/yAPw1bf2YfFl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709113806, "uuid": "1278d0ce-3ecc-4aad-8be4-a0ceedd398a2", "value": 640974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709113806, "uuid": "175f0894-9365-47de-8763-263d68147cd7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709113806, "uuid": "4d9ecc1f-443d-47e9-a354-7c950b2bc6db", "value": "Receipt.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a0d046-d675-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709150852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709150852, "uuid": "0708b2a5-be6c-42c6-985b-a10c4eeed7eb", "comment": "Malware payload (Mirai)", "value": "edd2af7c1259a74bb15486e700ecafe3", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709150852, "uuid": "5e8b9e00-f18d-4757-806d-1d6787bb1fc2", "comment": "Malware payload (Mirai)", "value": "cc255f5c6eea79355000f16a0a3cf49fb4d4debdba7daaedb13a8e8c1a60601e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709150852, "uuid": "8f23bbaa-da24-456f-a467-5a1cf8370a84", "comment": "Malware payload (Mirai)", "value": "9102a4d9fb13ce3363cbefb272f5e5177dcaf9de", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709150852, "uuid": "857fdc8c-53e9-4b0e-b0bf-874e1b615472", "comment": "Malware payload (Mirai)", "value": "1730ed7878e8373a40e0abd44a9b2d9f829178eb300ccb2202352c3b9fb33f22c7fd850003a4aad7ae21d8dd5190783d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709150852, "uuid": "0afb3e31-a158-4ecf-9918-14aa5458a1b7", "value": "T16C936C17A18250FCC45AD27A2B5F6E72D432FC3E1336765A63C4FE152D89D202B6E760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709150852, "uuid": "6e7954de-3731-4ed0-a3db-8f46c24fbd5d", "value": "1536:QTlzeI9MrvyxYIfGxnym0jl2TfOtZziJ4e3RmxNkOp696+3viQwcy:UeINYIfGxnym0jl2DmZzPe3RmQOc96C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709150852, "uuid": "37078c74-cca2-4381-a6ff-dc06659dd8f3", "value": 92984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709150852, "uuid": "5c6bf036-d03a-4167-8611-ef4cfbb6eb53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709150852, "uuid": "538c2246-ac85-4286-952d-777066c312a9", "value": "edd2af7c1259a74bb15486e700ecafe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ad3861-d5e4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adwind)", "timestamp": 1709088925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088925, "uuid": "3fb51a27-6de0-469a-b874-e1456bcb6a5a", "comment": "Malware payload (Adwind)", "value": "f3eec7b15fef099b3edc95f3c02050a3", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088925, "uuid": "77576603-c5bf-4b7c-9d56-5142cdfd4947", "comment": "Malware payload (Adwind)", "value": "cfdc61d1bc5dacead87daa55030b1a57866b4c99453ba87d34ef21f67bebfb05", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088925, "uuid": "60ebb1c3-affb-4dcb-b689-8d1dad4159c0", "comment": "Malware payload (Adwind)", "value": "bc3765bacc92378d885570df030a7540a6d279ac", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709088925, "uuid": "e42c9188-54d7-446b-a046-1204c03631ba", "comment": "Malware payload (Adwind)", "value": "f8b34388c55a67ae90d5c38ffe6fc69c15f452fdf5a10e5df864cf3d1432d63a27e101ce58c8b3ebdde56b4a1e46c4c5", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088925, "uuid": "4b73f2e2-d316-4a3a-86dc-c5d1ee5e8f39", "value": "T1BAD423709E7BA0B7ADAC9A52712B77B7FD209876D20D4F37027C4F3D903176A14940AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088925, "uuid": "0e88eea9-d8c8-413d-a1bd-0c9b2c78b831", "value": "12288:VWvL+iEi8yioH7a+Gj1hKmNPiDgB3lYEW0/92iT33rJd3co3m:VElEiEoHGK8PisBORuMiTHvso3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709088925, "uuid": "a685a43f-c0ef-477b-938c-1c4adcdf12b1", "value": 647826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709088925, "uuid": "d88cec96-2b57-4c38-acf4-059b6600c744", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709088925, "uuid": "be0f6bd7-771d-49f9-885b-1f345bd2acb3", "value": "DHLAWB907853880911.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58b8a30-d5f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709097923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097923, "uuid": "a3246778-4e19-412f-ab3a-49910c120dd5", "comment": "Malware payload (Socks5Systemz)", "value": "2f79a7faaa1e8d04086b4090f141697c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097923, "uuid": "827887ad-f44f-4156-ae52-a4410b519922", "comment": "Malware payload (Socks5Systemz)", "value": "d06a3ee9fa7d2e183950a405ef20020bf4184e98efd7535bd0229de00d2b2d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097923, "uuid": "34921fb9-a69e-4383-8c68-58eb786b4c1b", "comment": "Malware payload (Socks5Systemz)", "value": "7bd91b3155571b764c5f64e7a00c31f866f1d83f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097923, "uuid": "2141c09e-fda2-4e90-af66-45462eb2e0da", "comment": "Malware payload (Socks5Systemz)", "value": "fa3e50a5e38fb85825f16dcf06dec6679de3ea61291b18d127286ddd4c460737ab4a8052c751425d1cef1f37a70875b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097923, "uuid": "7044c570-90e7-4631-9dfa-72f423356a6b", "value": "T142D5339335B104FAE16109B05E0082586EB79B023C75C55873EC5DBF8B372E5AC56FEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097923, "uuid": "f2ca74a1-52f0-428f-9af8-eb793b2a39a1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097923, "uuid": "858d8b18-c8d2-417e-b41a-3e04e5884465", "value": "49152:C9/cn2d8HF9ybHXQiQvECr6/U05dNiQdnEiezQwWwqV8tB:M/cLnybHXQiivun5dNzdnEiMQwWdVUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709097923, "uuid": "7a9db3e3-363e-4c8b-bc5c-d7a23f90645b", "value": 2872546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709097923, "uuid": "68e2d6b2-de76-4a65-a017-eb515d5280bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097923, "uuid": "3353bccc-2148-49f0-906f-92a29160b37c", "value": "2f79a7faaa1e8d04086b4090f141697c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49b99fc3-d61f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709114036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114036, "uuid": "da56d502-5379-4725-bff5-f1d2f35f0e4d", "comment": "Malware payload (Mirai)", "value": "5e709aac859b9378bd7480029c41feeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114036, "uuid": "a9d17075-2e8d-4508-9f53-5a2d288e277d", "comment": "Malware payload (Mirai)", "value": "d11dec33107d3e1f8abd9fa3911b02cd733d17251d332f02fc88915b4661648d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114036, "uuid": "96da9985-914d-4720-9fb8-74ca4add1bc7", "comment": "Malware payload (Mirai)", "value": "bc3e544bef9f663497aa41f847b4ce5269e94e29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709114036, "uuid": "a735de61-3ffd-4c37-ab1e-628af0f5c519", "comment": "Malware payload (Mirai)", "value": "a68d41af81b62edc6325b47fc618a93ef46218bffa5ed76db8d725692739fbe1c513489f87ca0509ea6bc6db835c9a30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114036, "uuid": "75f31034-2343-41c7-9bb8-85a625de868f", "value": "T12A53E781BC41A629C7D11777FD9F559E3710A3C9D2EA32138C240BA07A8F94B0D67F9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114036, "uuid": "fe9d51a6-3b3e-41d8-9835-071572fff04b", "value": "1536:qmg+V1yILr6oJBOP3SSBPCXXM33eZtxot/DHh:qmg+V1yILrfchIU3worh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709114036, "uuid": "0a9f8022-678b-400e-ad6d-eefe9e2ee335", "value": 62908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709114036, "uuid": "f951c8bb-14f1-4bb1-9caa-fa501912d25c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709114036, "uuid": "039c84f9-658e-48b7-9534-b0226bdff340", "value": "5e709aac859b9378bd7480029c41feeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13543c9c-d65f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709141432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141432, "uuid": "bfeed90d-92fd-4bbb-8877-d229524e2ac2", "comment": "Malware payload", "value": "29ee2c666c57005ec2a80de3eefe745b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141432, "uuid": "79264735-b413-444a-813e-cf17eaee9e11", "comment": "Malware payload", "value": "d13d2e65b719500bb6886ee905d500e6414706f3fac84f076b8c5ca4032cba72", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141432, "uuid": "7e6fbebc-ff1c-4d99-94ca-8362f0f91527", "comment": "Malware payload", "value": "02ebe504b90cb6a2ea29d81de3548ccd1338c054", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709141432, "uuid": "385bf82d-4364-4412-92fb-b9adfb9ddf4f", "comment": "Malware payload", "value": "2cef30a5107c42c373ebdb6208dea37a84a30f3a5d9211fe93cd08e52a6496fc39a3e4631120c3f5cde4bbd4edb73738", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141432, "uuid": "f2ed5292-b2ce-4a97-8441-0df17d261437", "value": "T1884302784157B816EA92C83A0DCD02F963506C9E87E2F7EB35EC62BE6442CE641D87D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141432, "uuid": "d0fe603c-ec40-45d3-9e8b-a9f4adb66ea8", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdz4:EoOAcw7nXDUsOjm3jTX6ot4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709141432, "uuid": "e143601f-7ccf-4cf7-8339-db9543bf3a0a", "value": 59515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709141432, "uuid": "85dfc4d7-83ca-48d5-9a98-ff47310ead0b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709141432, "uuid": "dcaf46b9-225c-433f-9389-10b881211246", "value": "scanned_doc#2024-27-2_3315.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86583be1-d5fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709099964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099964, "uuid": "b3d7788b-d2de-44ec-bb3e-26862f740235", "comment": "Malware payload (GuLoader)", "value": "1a81a4bbb804f4d4c3567b8f4b15f1fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099964, "uuid": "b4b9372a-9104-46a7-8b66-0384eecd14a9", "comment": "Malware payload (GuLoader)", "value": "d1ccb1bacee1f1f9662a7a17575937a05111fef02d0756cb29c538c8e2b45022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099964, "uuid": "ad3ba35e-b579-4c57-9a49-5446dbbbe4f6", "comment": "Malware payload (GuLoader)", "value": "7c89ec25ff92f9ce5919eaae654bdcfa342b99db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709099964, "uuid": "fcd6f727-30a7-442a-abd9-6a4d5fcf483b", "comment": "Malware payload (GuLoader)", "value": "efbaa7635a84a2ede0a2583b1dfcda06713e2de72fef6c873b5f20e9045461836567ccda41ab9bc0314d3c32c4381b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099964, "uuid": "46b5decb-ae54-46e0-a2b6-bcc78dba14ea", "value": "T1C5C412252BE0E81FD662873566BABA6E9D5CFD101806551F17C07EBCAE3ABC06F4F101", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099964, "uuid": "f9d74bf5-b132-453d-8a13-38c35058332b", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099964, "uuid": "04a74a31-4543-484a-84ff-e5029746944d", "value": "6144:WGpoY5A5QA2vVVnSNMJu+V1wv0ZlDeG4dCJP2+8HP778cpm4VHXT11d9z74Mm8NV:WGzEt2rKHcfe6JH05meXT1Lh7OeLpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709099964, "uuid": "a05da703-b8a7-4558-bca8-c20c5f58eb79", "value": 545600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709099964, "uuid": "2281bf94-78bf-40ce-bd34-0d377f805007", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709099964, "uuid": "3c30ef8b-5987-4082-a78b-8d25d099ce2f", "value": "Salary - Letter _2024pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69bb803-d5f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709097871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097871, "uuid": "4d5e3c50-c283-4e83-b967-4f91b71dc852", "comment": "Malware payload (RiseProStealer)", "value": "d722a16d8e16fbb63c22cdf2bdebe9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097871, "uuid": "3a236197-13b0-4101-bd36-c6d63975b6fd", "comment": "Malware payload (RiseProStealer)", "value": "d20bba3292cb7fdf63b88f7e4079da9b4c69e9d11ac8e9fbcd05200b2be908e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097871, "uuid": "5d3a1908-9672-4662-9556-56722c60be82", "comment": "Malware payload (RiseProStealer)", "value": "2cab229458f12a43092148d83c35a617a7207240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097871, "uuid": "7a63ebbf-e8cb-4913-8cb4-99180a3e82a3", "comment": "Malware payload (RiseProStealer)", "value": "a35f4f4ebd5ef445a6296cff19ff52880a4b82ae33bc98a002864381d3567b8714a72c4b5fa3ddb699f4e5a4ed8464a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097871, "uuid": "f10ac976-7083-4d15-92cf-1f6172531c9e", "value": "T1DCB533A49BA406F2E23891334DCA7FF33F109159B5958161337C3BE56DB2B8D87A0DA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097871, "uuid": "10da7695-a1bd-48b9-a734-772fe5764fd8", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097871, "uuid": "5490144e-f764-435d-a1ed-af56bd9ced94", "value": "49152:mFCNAYYsEtzkDWjIVJzZak+jHfCRbG+4JTaA3Yo1MFmbaVbNHxRaHo:mF9YYtgaIVx7+jybGZHoyAm+Nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709097871, "uuid": "47f6adaf-2aa9-47df-8a5c-fd129b40b17c", "value": 2327552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709097871, "uuid": "84ccb74f-cff5-47de-8551-f67045c46ff6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097871, "uuid": "556d39d0-8f5f-4906-afd5-39d7ce57d4f1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.17108.10883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a48daa-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709125515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125515, "uuid": "e015feb9-d17a-4b68-bf5c-5cdd2dcbe4ae", "comment": "Malware payload", "value": "0d4625bd91676746eb960e7686bf374d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125515, "uuid": "b3875978-d898-48b9-b871-23f03faab1d2", "comment": "Malware payload", "value": "d41d76a461cf073a737181f7545055ed349a5e29557b0471d903b4d70a16aa67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125515, "uuid": "48a1d61f-1e5d-4c67-a3bb-0b320f090629", "comment": "Malware payload", "value": "b75c8b776c3176acbccb4be475ee160cda2a3112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125515, "uuid": "b2fb16ea-0615-4c07-a957-8e68f0a57599", "comment": "Malware payload", "value": "28573d21b77ea06a3bf287168eae91e86ab0640c65748b96726e5b13282cc9dffd0e8dd1d242703e2a998d82a168d96a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125515, "uuid": "cf6814c8-ec0b-483f-8225-f675653fd35e", "value": "T1EFB3B617BB618FB7C85FCE330A9A4901148DA19612D97B6FB2B4C96CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125515, "uuid": "861961bd-734d-4ef4-9aac-ac5bbe6ff55f", "value": "3072:AQyObdjiB3YpIfJj2eYUmkiCFx1DKxmgQ:AQpiBoafJShUmkiCFx1DKxmgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125515, "uuid": "8a09ee6f-b9f9-43eb-938c-b47c8d1ce61b", "value": 117624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125515, "uuid": "de1d63c2-f700-4069-a28b-60ded273478f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125515, "uuid": "8247f77e-1696-421b-b65a-f15ad2edae87", "value": "0d4625bd91676746eb960e7686bf374d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7f3c64-d5db-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709085023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709085023, "uuid": "bfe690b6-b1ee-4b58-8979-290a9cbd8052", "comment": "Malware payload (Socks5Systemz)", "value": "270d3f441e678ec516527bf25c20023d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709085023, "uuid": "726a7573-41a6-4c6c-9218-05fe7445912e", "comment": "Malware payload (Socks5Systemz)", "value": "d6567cc8e6b82d69347065de9fa8c7d2441ee63185ac52fe0e5e4bc6b2642910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709085023, "uuid": "ba929da0-9e6d-4f8c-b891-a6ecc1842d67", "comment": "Malware payload (Socks5Systemz)", "value": "4664604103288d56244609208fd8de851a5599a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709085023, "uuid": "1f983a23-eff3-4b06-b15b-1e087c131e9a", "comment": "Malware payload (Socks5Systemz)", "value": "c6663e0b19449ed01905ab20fa0aefe9ea2f3bf59be58861d1581513117b99b4b59131adf688be74d4ae07570d618bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709085023, "uuid": "f13e5afc-1bcb-4acc-9062-93f156d2cf9b", "value": "T16844BE117A92C072F86B44348C68CAF4EE7B7C7296B4825B37683F6F2D732905766352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709085023, "uuid": "fae6d11d-f719-498e-a87d-389807516128", "value": "a24ea59447df74f26ce8c1567f650e9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709085023, "uuid": "46da63fe-e038-4b37-ae01-820f5e7ca63b", "value": "3072:rHYuRgCFBQh1Sjw67WXFsFk3zXnE20P+UX/Ig5JiT+yx:DFw1SjBWVsGz3E/+QQAiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709085023, "uuid": "028176ec-ef4a-4547-8099-2bc12b225068", "value": 267264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709085023, "uuid": "7ca97da7-e46a-4661-943e-e7214f229d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709085023, "uuid": "42f3b0c9-2e87-4ee9-b263-7c0bdf392888", "value": "270d3f441e678ec516527bf25c20023d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0735f393-d680-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709155586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155586, "uuid": "ce198b7c-8ffe-47b2-9e97-1c7fbd86ce16", "comment": "Malware payload", "value": "1cbce8f27efc863a70ede529a39ea500", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155586, "uuid": "20e47230-7b83-498e-8cbb-81aaefc4ffe5", "comment": "Malware payload", "value": "d7ea92accca8e18a6a1de730c24e9e293472f1f8ec6b5c7b71cd0e81c367d2f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155586, "uuid": "8d73441e-285f-49e6-8318-696989e514b2", "comment": "Malware payload", "value": "2c32a13255d21b62e610663848e4f36f735b6a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155586, "uuid": "f0bd96dc-7d29-4c7d-970a-c4f622e41475", "comment": "Malware payload", "value": "9bf55bae03800bf776b2e1556d6d781ead5e78e0c218e33038e075faa589058927f79158b726b1c55e876612aa95dd2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155586, "uuid": "cd991aa3-f913-49e0-918f-db47d8136cd9", "value": "T140734B013BD88D2AF2AE47B9ACF256074EF4D5576112CE5E3CC440CD5A67BC68A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155586, "uuid": "7cd38cfb-ef49-4e22-bfd9-ef8d598a1d04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155586, "uuid": "93deee05-8b0c-4522-9b11-c3ce6c0a2323", "value": "1536:LUk0cxVGlCBiPMVye9VdQuDI6H1bf/DPzQzc+LVclN:LURcxVMWiPMVye9VdQsH1bfXQXBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155586, "uuid": "a6723904-c3bb-4567-b83f-05e7eef06eff", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155586, "uuid": "e3a2c4a7-21d9-4915-88a6-80fa87ffe87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155586, "uuid": "4a4536a8-466c-475c-a08f-331bd5561a9b", "value": "xZtqUCWzYDJp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5ea889-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709159807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159807, "uuid": "c58cd3be-e1f0-4abe-a290-16cb48cb47ec", "comment": "Malware payload", "value": "754cfae3cdc8831c810ab08757b34ca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159807, "uuid": "e4f6e09e-f738-451d-bbe9-28d65362f96a", "comment": "Malware payload", "value": "d8b68e562fcafa7f8fee6c9a842e721724bd6933a92a0dc45d327d2e59e3c951", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159807, "uuid": "cdd0d2a6-d931-41c2-9899-31519422582d", "comment": "Malware payload", "value": "f73dd8afa7bfae7be82dd3f87cabcac999b6901b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159807, "uuid": "75fddc60-adf9-415f-be4a-464448bba90d", "comment": "Malware payload", "value": "061d4d878d0e5d9c44f2380b47d0abb0fe89be2cbf90b9992b9ec915ad10d2e06fbb5b8b882361314fdc583b84bf5928", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159807, "uuid": "8ea5c598-7b91-4d79-ba8c-f68dfd3d18a9", "value": "T19C547227D3214CBAE41D8CB211A73240588E927B85EA7797F5658E94FFA984F01F7EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159807, "uuid": "5aaa3fcc-7b3e-4ff1-9691-a985a19d42d5", "value": "3072:QhgKi4blthWBUtVodhQvgyuWDgmFnNP6c65:Qe56JVod0CmFnNCc65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159807, "uuid": "31f4dfd9-2cac-42c6-95d8-a95b6853f502", "value": 302577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159807, "uuid": "f90bc400-3414-49c8-9eda-af42426796fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159807, "uuid": "9a210c33-77e4-4603-bfa1-3c9c3dfc4748", "value": "754cfae3cdc8831c810ab08757b34ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7591de68-d681-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709156200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156200, "uuid": "12dd65f3-40af-4ece-8768-e201126484ba", "comment": "Malware payload", "value": "7aedf8f8a11a97880b16544588f15683", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156200, "uuid": "3a544937-6678-42cd-9695-0b6afbdcdcb3", "comment": "Malware payload", "value": "d8dbb40faf7b8585dc9963d2addf23d922c517623a24770e42f91dbe58975194", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156200, "uuid": "1d56e367-3e78-4372-a82b-5c16b832abe3", "comment": "Malware payload", "value": "a31781401cc7dac39e62d4812c17cf96f889d350", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156200, "uuid": "774aec64-d3ce-41f2-a86e-a1f039185370", "comment": "Malware payload", "value": "fb52253ccec942675e5917354d5df8262e2c6f5409427b79d0ad37b13a4a46aa9038240e4a2163924b6d916de2430135", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156200, "uuid": "ef35484b-835a-41a2-b0e1-a47cadce6358", "value": "T1AF5157006BF95314F3B39F79AD7AA2218C7BBC29DE21CF5D0160814818B1A10E8A5F77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156200, "uuid": "c86b8700-10ff-4491-a395-ecc979359154", "value": "24:8s/BHYVKVW7+/CWylh1cI1tMw9nAUm1MrDABO/QAY3dd79dsrabQ:845alh1zM+AUIMfABO/Ql3dJ9Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156200, "uuid": "a3ff497c-7dd0-4e41-9bc7-69c12780937d", "value": 2556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156200, "uuid": "e676c97e-694e-46d7-b3cd-cf36ece157ed", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156200, "uuid": "9051a4da-ec40-4978-be26-91de2512c4bb", "value": "FYI.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de9d3b8-d605-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709102930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102930, "uuid": "d674ac3b-1a25-46f8-830a-8550a3955c07", "comment": "Malware payload (Mirai)", "value": "0093ac0749c2271c84d80672bcedb747", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102930, "uuid": "ed43144a-b2f8-46d7-8bda-590db7326b35", "comment": "Malware payload (Mirai)", "value": "d9149945d1179f131c409acebb1eb7aa8d6f153681281d0194f786567849535b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102930, "uuid": "e59f7bb9-98a7-49d1-9c57-bcfed0e4e4a1", "comment": "Malware payload (Mirai)", "value": "9e7952ef5be313168db3babf544209b7cdd7fe2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709102930, "uuid": "d9fb490d-ab95-47b3-8c46-96b5fc55f56f", "comment": "Malware payload (Mirai)", "value": "df9ea89c3f2e5a88a961872ee618ce77f2be49ef9e4aff33626068b72e01842d4daeff828766aff6efc78b61d7bc0ee9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102930, "uuid": "37f1f6b4-4674-4fb6-bade-c5163044cc36", "value": "T1C9735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102930, "uuid": "4efa2750-90dc-41a6-9f38-fe96cabcbab1", "value": "1536:DNpp9RXI1vgi0uvp8zomz8KRyxOReqpNiSejOjNfXM:Xp9djCIomz8E2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709102930, "uuid": "527e66b2-5b28-4995-be12-7693bca1da6b", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709102930, "uuid": "cef296ca-5c9d-441a-b4fb-21fc885aa119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709102930, "uuid": "4f5c021d-eacc-4ac2-b582-45603a6e1431", "value": "0093ac0749c2271c84d80672bcedb747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce003f7-d686-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709158575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158575, "uuid": "d2b56c7f-aca1-4e20-8150-8c439c322512", "comment": "Malware payload", "value": "a2e967bb7b16a6a7f0e74ec9033682cc", "object_relation": "md5", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "antivirus", "colour": "#D7FBE1", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "persistance", "colour": "#8D7708", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158575, "uuid": "4d16a0de-46c8-4395-bc28-916a3e6f375e", "comment": "Malware payload", "value": "dabbaed6ef1a2e69fde3fca24e85a909b3ae5aaf52a039f7167918ff2711bcd3", "object_relation": "sha256", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "antivirus", "colour": "#D7FBE1", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "persistance", "colour": "#8D7708", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158575, "uuid": "0422b04f-737f-47c9-ba28-05a2fe4b5403", "comment": "Malware payload", "value": "4b59a0eb2004905c8c14506bbca1bf34b2e4dcd9", "object_relation": "sha1", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "antivirus", "colour": "#D7FBE1", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "persistance", "colour": "#8D7708", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158575, "uuid": "26e2a4e9-53bb-42ed-ad10-528480383757", "comment": "Malware payload", "value": "314fbadf0e9c1a471eabd7f02d8bec349f2c17946ac57b59bc3d7a5d43945df43cb4926564c62eb6b9e84c4a7c0ae0cd", "object_relation": "sha3-384", "Tag": [ { "name": "Adware", "colour": "#00D21E", "exportable": true, "hide_tag": false }, { "name": "antivirus", "colour": "#D7FBE1", "exportable": true, "hide_tag": false }, { "name": "Bootkit", "colour": "#784C25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "persistance", "colour": "#8D7708", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158575, "uuid": "fd1111c8-1020-4dab-a4ef-2410c30e5549", "value": "T167452351B6C18033D1131E7C1C46DBFAD5AE9A041B7C928B77DE0A088F7B386596D2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158575, "uuid": "117ac5c1-cf44-4a62-a252-f060fbe7f402", "value": "710b4c559675f6d65697110d8f6c48dd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158575, "uuid": "3cb2fae2-1820-49d4-bceb-2eba02f119cb", "value": "24576:C/ukNqOaIM0D3Q1gqUbHU8qX0H6mjrlsVTHi9gnn0Oe2QbYOJcQyLeSXCeSLZ5b9:CiO3LQXUovX0H6mjrlCHyTNOO3ieSXop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709158575, "uuid": "24feca2e-7909-464b-a931-b2d72ea9f106", "value": 1269540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709158575, "uuid": "904c89c3-ac29-4a16-813c-9fdcb4c07b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158575, "uuid": "2b5faa82-d17f-4f52-9899-b6174bb4e1ba", "value": "A2E967BB7B16A6A7F0E74EC9033682CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2012b3e7-d612-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709108383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108383, "uuid": "eea16f18-82ff-48c8-b54d-5d816ce8b404", "comment": "Malware payload", "value": "b0ccb2d60449c1ca2d165fbfe2f52ac5", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108383, "uuid": "77ce9533-bfc8-4be9-9082-e4f3bc465738", "comment": "Malware payload", "value": "dbaedd738cdd6368ba48aa13d64313e10cdfed3de3ac8b03ff607957f6a037d4", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108383, "uuid": "ba54ae20-403e-46f2-88a1-757ceea2c7df", "comment": "Malware payload", "value": "97754c4ab233a899d1230919f797c83953c7fc8c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108383, "uuid": "ca75a9b5-469d-40eb-a12b-7cdaadf08ed9", "comment": "Malware payload", "value": "68c4315209c064950d8e277c8a4a9be154af4094cbe08080b422d9c54367702bca80fe73703bace39d7b7f9248aa8ac0", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108383, "uuid": "6377e8e7-fa7d-4e0b-b049-09303b43d401", "value": "T10A3733AA770182B1D7564133B85AB19B153EFD64AD322D2713A8F77C3AF11732632D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108383, "uuid": "938d9c24-2f0a-434c-9afc-7955662d92b5", "value": "393216:0z0oBd3rVi2v5+KWYeIPhWqQCiknDRxQb6ShqzbX3I4pOcF6qiqaWjDN1HtA:0zXf3g2kJ74hMpKNF44N8qJauHHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709108383, "uuid": "9a423286-ef91-4081-92f2-db6942debb4b", "value": 23830528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709108383, "uuid": "9b4500ce-d33f-44e3-94c7-3556d3fa47d0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108383, "uuid": "1c02cfbf-0ddb-482d-aa1c-539103970076", "value": "SecuriteInfo.com.Adware.WinDivert.20274.24678", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1132e0e-d65b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709140060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140060, "uuid": "d7c7bcc5-3244-4163-9188-7152ff4b2345", "comment": "Malware payload", "value": "d655a780a1dfde205054d2963d6221a8", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140060, "uuid": "39babd98-67a1-4992-a519-f6db9ffbdfd8", "comment": "Malware payload", "value": "dc3f81db5ae7c27665ff37333f06f3fb9e7d009d76183b9130507a0d5a034c62", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140060, "uuid": "816a8271-fcdd-401c-a106-a76b70549fcd", "comment": "Malware payload", "value": "a6aacebada715e6efc1ef56b131e50ecc0c665da", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140060, "uuid": "88f6b95a-2627-4f49-946e-b226437b3192", "comment": "Malware payload", "value": "868aed6a550c8e8d5c18c7d3fb3744c01a73146ee0ac996ce8a00f1d5bf85ff298b56328f3d410bedff9e953747e9ed7", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140060, "uuid": "18cdf911-673f-4674-8453-c0a210e7d9ed", "value": "T150458D6287BD09E3F2F2F23047A153189BB6FA41A574C20A795C0B1C4BE59860D75F8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140060, "uuid": "a0a6861f-0a68-4aff-b70f-da49fd36059c", "value": "192:aEHieippt4thqpHODpvuKlLhDlvmqoDEUp:7ippt4thqpHODpvuQLhhvmqoDvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140060, "uuid": "f0dec948-e0d7-4ecb-953e-5820bdfca654", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140060, "uuid": "5665e013-da12-4869-8106-dd9f3531b33d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140060, "uuid": "28094474-e00f-453a-ad37-20c3892a3dd0", "value": "5418348934.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7736d0-d685-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709158069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158069, "uuid": "866b74d3-2d1d-4229-8666-71686fbee2d0", "comment": "Malware payload (VenomRAT)", "value": "b4e559ce25c07161c4ffc5b1ec1ee6bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158069, "uuid": "8c77ddd5-b8ce-4683-80b4-1b5a449f5d84", "comment": "Malware payload (VenomRAT)", "value": "dc418453bf88c80f1116fea30fceb6ede7dcb91739b97efded4beb3a1b9aba28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158069, "uuid": "9599f366-3f51-4b3c-84e4-cecb01cdf27f", "comment": "Malware payload (VenomRAT)", "value": "f133f2776fdfa1c6eabf32a1213162d76cd0587a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709158069, "uuid": "ce5fc3ea-acb2-46e6-921d-173f3fb0398d", "comment": "Malware payload (VenomRAT)", "value": "f93a4147e43fc08a73862703512177e3c313c63398894b597bb6b8a9986a068d1d46db51edbdf65b8b92e52512ecc29b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158069, "uuid": "bad3d4ad-e263-41ee-99ed-cbba804f35d7", "value": "T1E8734B013BD88D2AE2AE4BB9BCF256070DF4D1576512DE5E3CC440CD6A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158069, "uuid": "82a50c7f-1e5e-4ef0-88cd-91a6ee8a56c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158069, "uuid": "d9e35da0-ace1-45ec-bed1-ecaf4342bbc3", "value": "1536:aUZGcx5NVCMoPMVWe9VdQuDI6H1bf/T6XNBQzcZLVclN:aU8cx5zHoPMVWe9VdQsH1bfWnQQBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709158069, "uuid": "f7cc3802-3b6e-42f7-a3eb-73a973b503b7", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709158069, "uuid": "885c992e-60c4-4d99-b261-a5dcd7884f99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709158069, "uuid": "b587aa61-ee33-4d41-b5e2-b6b4c2339061", "value": "bLWi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f70a64b-d5e0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709086934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086934, "uuid": "60fa7304-a475-4453-9b5a-3ccd65cc4b52", "comment": "Malware payload", "value": "645af366bc7ca73d3513000b59f4c113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086934, "uuid": "31f3cfe6-850c-4ac6-ae04-af44f388f08b", "comment": "Malware payload", "value": "dd5ac8c381a79098b14be8e0539b423ee9f818b4cab66c8ba24009d8cff8e5cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086934, "uuid": "355855a5-6b3a-4e06-a854-3d01fbfc69b4", "comment": "Malware payload", "value": "f5baddca558859996b701ea98c26e1150633c151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709086934, "uuid": "eb744756-71e3-4bba-b47a-6b7da22189df", "comment": "Malware payload", "value": "34dafd183354967cb4c9345a998da9c9a644a9ea4152532a0ab416ba5fc687481649f1db0e9eaae0372b370876c6bdb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086934, "uuid": "b9019af5-dfbe-492c-b312-ee82d1c08503", "value": "T1EFD31236C9506FE2C259C83630A3B721EFF1AB316918945B0765DE8A4A313DF7C1B018", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086934, "uuid": "75cc7603-44aa-4388-9f38-6932d2bccf6e", "value": "81638d02019c0bfcaaf23a9c69f2f12c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086934, "uuid": "688573b9-24e0-4481-81bd-e07c86920f84", "value": "3072:dCh9EweNnFPw82CAtitBrfKxJZ6d8SreaNt:dC+nFWCnqJZ6d8+Nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709086934, "uuid": "c697a1f3-6f3d-426b-a774-5c82d0aaa9ae", "value": 139544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709086934, "uuid": "23cf8828-543f-4400-84b8-4b2b88a25356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709086934, "uuid": "4cc24662-6e35-4b6e-ae1e-d0ccf15edc03", "value": "SecuriteInfo.com.Trojan.Siggen24.12781.3226.12786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217fb576-d689-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709159495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159495, "uuid": "84d7582f-280a-4296-8d85-522762d8832a", "comment": "Malware payload", "value": "f3a09214e717ebaef7f1b6d75f291826", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159495, "uuid": "b0b203f7-5210-4110-a8f3-a5cefc442cda", "comment": "Malware payload", "value": "dd7d4f35c116f54ac219dbc3f956d1b6a6a171c4a14ff22fcbcce80afa28fc0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159495, "uuid": "86e9c01a-b217-4261-99f1-59d213b611b2", "comment": "Malware payload", "value": "305215668be1e641ff5d0e4323cf0082d582e2d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709159495, "uuid": "8f55a488-3124-4d06-95f0-7ac0ffe20360", "comment": "Malware payload", "value": "105fc621bdb25b0665864f2bcddc80136f00e3b1d128e8393e310912b7ef8d208297bbabeeac07d0aeb3ec657b6df106", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159495, "uuid": "3b747d6f-8ecd-446f-88fe-f66d5bc28714", "value": "T1A8549527E6114AB9E25889F213B33690DA86527B89E661C3F51D8E50BF7054F08BFFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159495, "uuid": "13286473-46f3-4f38-90d7-a614b18ce693", "value": "3072:i6CtgvBGyBvlQshltQMYrYlRrgZCV7jRjxF50Uvz/yaSCp3U5CsiXiak71DXHU20:iTtjL2YlCJdwkrDZmFnNCc65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709159495, "uuid": "f49483e7-efea-41a4-a36d-8cc9a1706fb3", "value": 302577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709159495, "uuid": "c0883111-a943-4508-8dca-6898063221a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709159495, "uuid": "6c4ba710-4a24-4dc3-b8b3-53f6be21bfcd", "value": "f3a09214e717ebaef7f1b6d75f291826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267c5256-d612-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709108393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108393, "uuid": "e551259a-2cf0-4e76-a155-e1d368e73db4", "comment": "Malware payload", "value": "e15642b40008a827258873bfeea59407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108393, "uuid": "3ad0a2c8-e598-48dd-9af5-d9584e79985e", "comment": "Malware payload", "value": "e002d5bbf4a98ac6d80a3a6277fe76b13b7ebdfdfb374495161180694886e6f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108393, "uuid": "3a6ac9f7-dc90-4355-ba87-d00fd4813b4c", "comment": "Malware payload", "value": "45d136f50d4fbd3d8a840d1a5f85c64718ac96c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108393, "uuid": "1d548c64-6a9d-4f6e-9b28-9ed304070c89", "comment": "Malware payload", "value": "ed1cbc35519d543ffad9d3be5276bd1ce3a75ebd8b6b443750107f957f5ab0d69fb8720e7bd72b4d56447cfed3d2019c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108393, "uuid": "63eb0abf-3b75-404d-9301-03f0f205c437", "value": "T135572355D784895BE4271272C9FA9B121223BEB95A72C21F34187E17BAB33C30467D2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108393, "uuid": "3638b0bd-a5aa-451e-ba37-8e92c32ebc38", "value": "cbf47572e8cb446c01bd5522c7d7f827", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108393, "uuid": "da3f3b45-20ef-407e-a4ae-f87b38807891", "value": "786432:Of6xp+5NBvQBHox396Fr6x/DiqLCZwXi6tIp:ONpRxtq65DTWRLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709108393, "uuid": "17742414-a213-4d29-b565-6fcc9cc6fa78", "value": 27506231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709108393, "uuid": "2e42d210-5cc0-48b4-aadd-942ef817bf2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108393, "uuid": "24cf6cdb-e401-43e0-a2b9-b4c38b80a059", "value": "SecuriteInfo.com.W32.Backdoor.OGTY-3206.20752.7802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16ae49a-d5fb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1709098829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709098829, "uuid": "7c2ffd79-446c-4bcb-82c2-71a479148030", "comment": "Malware payload (DCRat)", "value": "171c560742cca4bd3cee8f7a716ef73b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709098829, "uuid": "17ae9a80-81fd-4d93-a5e2-f0448e6e176c", "comment": "Malware payload (DCRat)", "value": "e0792800da5d722f62d22b4840883c38c1689a7b4cd93997bfc071f7be64953d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709098829, "uuid": "26346321-a661-447c-957f-2ccc27809bde", "comment": "Malware payload (DCRat)", "value": "955b629061062cf9e58fde23989e01dfd8a27f48", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709098829, "uuid": "5af81006-63cf-4729-88c8-10e7c4946baa", "comment": "Malware payload (DCRat)", "value": "f780427e3a2353afd1ef2bf22b6ad21d4866665a2ef3b9eeaf8c4a3c6adc1e7dd24866d604594074f54fad464c64f59b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709098829, "uuid": "82e462e3-759f-4920-8bb7-b89948175505", "value": "T17405F6127E44CE11F0191233C3EF458957B0D961AAA6E32B7DBA3B6E55123A73C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709098829, "uuid": "d8f639de-e151-4b2a-ad4d-0c7eb981bd64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709098829, "uuid": "c38e29ff-eaa7-4d85-b206-302ee06dc65e", "value": "12288:LGR0/UwUfns7ju82EW7bp1i39BScQ4pJ34PG+06hJrt:LHWsnu8kbpg39Bs44hhJt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709098829, "uuid": "0ef0a0a7-5826-4aa6-9138-e12b2d3ea1eb", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709098829, "uuid": "b0b8133a-6df9-4b4e-9620-99b71d472898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709098829, "uuid": "b52e5936-d358-4858-b5ff-59fa443a10e6", "value": "171c560742cca4bd3cee8f7a716ef73b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54a3e5c-d635-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709123665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123665, "uuid": "854c5fae-7c17-4fab-84aa-8b7f40bf936e", "comment": "Malware payload (AgentTesla)", "value": "ae7c34a6ffb21e0dcb797d60a95a9970", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123665, "uuid": "156c16d2-dbe5-4079-8d5b-13f4f579fc71", "comment": "Malware payload (AgentTesla)", "value": "e30adde12d130a08a125bdd04207bcab94e024755ebac7f7ac6a02044ca783b8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123665, "uuid": "8b249974-25ff-4db5-84ff-a825130605e3", "comment": "Malware payload (AgentTesla)", "value": "9fecfccdd9380067f125e43457f2027cfdc2ceb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709123665, "uuid": "22b27fe1-3a5d-4afb-900d-b5dfb7341980", "comment": "Malware payload (AgentTesla)", "value": "b440fabbb1d9161f74e73ad480b65f7cce4959fc22d6d51f2a512e115d7e174de17e3e210544a9a1654585263f75dad2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123665, "uuid": "39ccdf10-077b-44a0-86a9-5a6ba2a6d2e9", "value": "T19C25BF2373DE8360C3B25173BA1A7B41AEBF782506B5F96B2FD4093DE920161521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123665, "uuid": "ea7cfe60-a7f4-4d36-a52a-84a775c9cf74", "value": "3d95adbf13bbe79dc24dccb401c12091", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123665, "uuid": "1156d390-b8e3-4de1-9f2a-ac98b558ce4c", "value": "24576:Ytb20pkaCqT5TBWgNQ7a9Od0KruL1Z/F6A:hVg5tQ7a9OYLDt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709123665, "uuid": "7c1f99a9-46d8-45b7-9b92-b380f7bc1a53", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709123665, "uuid": "9aae8f13-8d2d-4984-95ca-55962e3aa320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709123665, "uuid": "9fb3df78-9964-4227-899f-66cd8f1f2690", "value": "z53BOQ-AE20003SWT00964DT20240227_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe44f8ab-d681-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709156430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156430, "uuid": "6c91c510-4dea-49d3-88fb-52cd295cd7b8", "comment": "Malware payload (VenomRAT)", "value": "1bcba6d5bb0ebc55d8ee060f5a8eb65f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156430, "uuid": "311a6f48-11a8-4650-81b1-6f8d3e1ed9a4", "comment": "Malware payload (VenomRAT)", "value": "e4cbcd9a59b2a4e68bbc2b59a7db659c0ed542aa271fffda4f288684b0011a26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156430, "uuid": "0d46ef6b-f74b-4829-b539-13a98a73cc00", "comment": "Malware payload (VenomRAT)", "value": "38cb4be425ee29bca58716ede16986644d9133b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156430, "uuid": "d98ba2d2-0e3b-40ae-a0a6-f67a579814ad", "comment": "Malware payload (VenomRAT)", "value": "24cfef90662e43df0635078607a2d78420b7276adbef4c7a6c97d27524ac327c5088b08ba968024edf81d6850a2381fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156430, "uuid": "c6dcfdd5-c4fd-41b8-9bcd-f78f56fa2265", "value": "T136735B013BE88D2AF2AE47B9ACF256070EF4D5576112CE5E3CC450CD5A67BC58A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156430, "uuid": "3e5fca04-e6cb-4b79-8f4f-c81a4d545f25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156430, "uuid": "2636dd05-3f42-4590-b7f9-8b7d6a2b7aa2", "value": "1536:1ULkcxVKpC6yPMVKe9VdQuDI6H1bf/9UTQzcGLVclN:1UocxVENyPMVKe9VdQsH1bfcQfBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156430, "uuid": "38381352-aedc-4e00-b796-b8a444b72828", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156430, "uuid": "4947578f-323a-46f0-b205-6788cc030735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156430, "uuid": "3f6fb509-3edf-4743-8107-0cbefa60e9e5", "value": "yeuifgx7ja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d6332e-d600-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709100626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100626, "uuid": "38a4ab1a-bf5a-497e-8254-7e76d24f05ab", "comment": "Malware payload (Socks5Systemz)", "value": "6a701433bed04f2ef06cef4423bc0ab4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100626, "uuid": "ebb7ac22-0280-4c41-8945-3d834393113b", "comment": "Malware payload (Socks5Systemz)", "value": "e5627c98d27a250a1b6ad6fcaaa5fd191e8cab43c4b4952736836ae3969b6d43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100626, "uuid": "57617d16-15a5-49a0-baf9-ac2b1e97e10e", "comment": "Malware payload (Socks5Systemz)", "value": "3750f9dcdce180f9ff985ba654b7f9e5c5b667c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100626, "uuid": "e1def88d-f053-4c11-a74d-d770921c1f84", "comment": "Malware payload (Socks5Systemz)", "value": "e41392051da31c45dc7e0e06487371065a487628394725c5287daa1eeac87a48fe312d97b153f3f86fa6d10eb5dd80a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100626, "uuid": "8dedb01f-d83d-435a-8f99-867ddafb1d4f", "value": "T180C53346A7524970D284E4704C10F22A5E9A67129AB69CD1F3CC6BAC4F7FEFB4830B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100626, "uuid": "33d437bb-135f-46b5-8958-2486deec21d7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100626, "uuid": "4cbdee59-b9c4-49b6-ac96-4f00f11043d6", "value": "49152:C9jSAZxhiJgliBHVKS2VgESE+csWfqNvZcFIAjO5vWnHepw9DvY7E6tB:Meg8ga1KDg1cfqBaF1O5vUHlvI1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709100626, "uuid": "168518cd-9dfa-4948-b6d3-011bd86cbbe8", "value": 2700460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709100626, "uuid": "a664bb1a-e549-4ded-9396-f53b34cfc6b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100626, "uuid": "b77b4625-bdd3-49e6-b274-863596f29ae8", "value": "6a701433bed04f2ef06cef4423bc0ab4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c45257-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145029, "uuid": "6b620a6c-5b48-461f-a652-bd6554b5a3f3", "comment": "Malware payload", "value": "23f47903df20cf4a5d2bad5f40c45233", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145029, "uuid": "e931ab1a-e5fe-4b43-9a00-27a2d88ca6e9", "comment": "Malware payload", "value": "e8cb451cc2683038a54345af100f2ab4012855fe751daf43b786526fb2da8cb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145029, "uuid": "db4ba016-9df7-4f87-b51d-b678645ab8e9", "comment": "Malware payload", "value": "170dad66f81846efed99ede114527024434fa6d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145029, "uuid": "10f7dd9f-422f-4e8b-b358-fbeb7556b785", "comment": "Malware payload", "value": "aac0195f75cca52362e3c5ae88f067629dc3070aca38c78e813b602c1677caadc2dac1025a9e23622ce189fc35acd2a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145029, "uuid": "0defc6a1-5cb5-4023-9192-f3f44eee3bff", "value": "T1AA84C0C1F7584A42C9A64B7020339D7047376E6EEA91C68E6DD4F9AE68F37470233267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145029, "uuid": "187d6f42-4edf-44d6-90e7-4c614f3fe3ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145029, "uuid": "6dcad739-793e-40b7-8223-eec669680eb9", "value": "6144:1Nwt6ykhy77QrjTPhSVQBFD7sxBUXEe9OmGC0GoMwwnVQBFvzjWjp:1NwB3Qrj4QB97sx0d9OmGewwVQB1vap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145029, "uuid": "c5df23a6-2383-4846-a282-d699fbbde28a", "value": 385256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145029, "uuid": "f8b381fd-fd21-4fe9-a2b0-a679843821d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145029, "uuid": "45d6b8e5-dd82-45da-ab14-89cf7d9a17bd", "value": "SecuriteInfo.com.Program.Unwanted.5492.16779.7691", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f486c4e-d62f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709121025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709121025, "uuid": "dd1cc7c8-faf2-42c6-9b02-df0013bd0cbc", "comment": "Malware payload", "value": "fd80eabaa563a478ff02140684c03ffb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709121025, "uuid": "c7063e90-2726-455b-8e34-1d0fcbb7821a", "comment": "Malware payload", "value": "e930c697f856378402bc135d5ed938128b1bbd8010a37a444519e59f9ce5722b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709121025, "uuid": "b016aeb3-8061-4ecb-ac95-df058d36921b", "comment": "Malware payload", "value": "d80bdf32fa21b011588befaf485b8c36e3c0edd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709121025, "uuid": "da91b33c-5155-4a10-829c-b158c57a0c58", "comment": "Malware payload", "value": "2cf64e0a23ae53dbebab108b886d2fd60e53caca1f0318b4215c147067bd51c48c9f6fb2955e82fa70c31df05ea1dd67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709121025, "uuid": "2665ad64-2fc9-4c12-b38a-4f1c028175b2", "value": "T1ACE72313B344903ED46B1A36983BEA74587FBE516A128E1B37F03E4D9F35640A93A707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709121025, "uuid": "dfdd889d-0d06-450e-892e-abee27f5c961", "value": "acd1564da2530a3dd45e02cf9ab924df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709121025, "uuid": "70b3d738-8bb3-4c1c-8d5f-f7c163b5bf6a", "value": "1572864:rFSRcnawJkKvyl50AHj9u6ZlBggkAZiHGdAQe9DjdIhW:rF0cnawJkuyQUw6TBgOZuGdW9DRIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709121025, "uuid": "9356378d-018e-4944-91be-d4951ee4a958", "value": 66524128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709121025, "uuid": "e758fa44-9b9f-4e5b-87f2-023e3eeaeaf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709121025, "uuid": "b90f9836-64a9-4d13-b82c-eef2a0a138d8", "value": "ChromiumSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f8f714-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709129651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129651, "uuid": "bb010c46-bea0-4710-b319-01a2120764cc", "comment": "Malware payload (AgentTesla)", "value": "cae9b4633aad91cffc3fc84c1fa2fa5b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129651, "uuid": "a21db88a-c708-4915-be26-7cb93e4b0f5f", "comment": "Malware payload (AgentTesla)", "value": "ea76924a61dd9fd2555d3b7ed0e1cfe95fc952784370326699b2e594028a8490", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129651, "uuid": "a1e2e6db-ed26-4895-b18c-17cdfcaf189a", "comment": "Malware payload (AgentTesla)", "value": "f5ed7bfccdc0c14068efbdd988fda835a75a9de9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129651, "uuid": "467224e9-c49f-4e2b-a9bb-9d4c6c7027f9", "comment": "Malware payload (AgentTesla)", "value": "d6b4e3efc866b12c2d91ab6ea1a545d8aa42d418ce16cfe961dc0328467a646fcbca7f645cfee896323dee7348fa6385", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129651, "uuid": "687e4e38-3f10-4673-a7d3-87bde81a578b", "value": "T17DE4234D5293DB31D2AA4BF1087E0B0207F7B6C82A57CF504975319A6EB3B27D27152B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129651, "uuid": "faaabae7-974e-48cf-8dec-fcaafd42e42d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129651, "uuid": "d21e182f-b21a-47ce-94f1-011b790c4e14", "value": "12288:XzNwnqs3y44sAG2HeGCqp8caFC5oO1mkD6/nySdAvWxGk2dvSma+6VN:+nPAGkeGCG8ca8skOTAvPamy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129651, "uuid": "0ad1f82c-1669-49d4-a81b-a6215a46551f", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129651, "uuid": "13624637-950f-4d0b-88d3-432791c3ad69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129651, "uuid": "f1daf60a-3e72-4bb5-9b03-5863e8488241", "value": "JAN FEB 2024 SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ac9ee9-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139364, "uuid": "b33b22cf-6ed4-4dcd-8cfc-44df05f042c2", "comment": "Malware payload", "value": "6fa31bdf2ea98719f60b261be6f2fa3e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139364, "uuid": "19f0b27d-0417-4cf3-a843-6c3e13ba7a51", "comment": "Malware payload", "value": "ea9dc74b741933b3bc28fcc737a01bfb4463e85915fdcbda1df447462dacb158", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139364, "uuid": "3d5ed122-6f62-47ab-8152-5ed46764bd09", "comment": "Malware payload", "value": "9a3607b68bdb142bb1fbf8d0720da159daa717d4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139364, "uuid": "f256da27-ca6a-44d8-a3a1-beac758018eb", "comment": "Malware payload", "value": "931edc6525bedc91428b8a50ec1441248f4d50c67416f91447620a1d929689d85083e19e20337be5bdca8a5e86f35f30", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139364, "uuid": "58ed4c9d-63a1-4f3e-a8d8-cd559b1cfa82", "value": "T1B843F168056F6935E6C2D4B908CE02BC5770589E47B1B2DE31A833BE7582CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139364, "uuid": "9fcbe890-2492-47da-a04a-5cb06875c8d1", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehl:BoOAcw7nXDUsOjm3jTxhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139364, "uuid": "ae53c3f0-a2da-4d24-85b8-96370e534915", "value": 56841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139364, "uuid": "2009cff8-a03b-4aa6-8bf1-644dac759bc9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139364, "uuid": "46ac4844-d3c3-4af1-aad3-33f5bab194aa", "value": "scanned_doc#2024-27-2_3346.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94fa27d7-d643-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709129624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129624, "uuid": "3d27fd70-5c3b-4f03-84cd-a87d9f6ebc92", "comment": "Malware payload (AgentTesla)", "value": "24f7515b8b6e980c405b7a4bbbc7b16d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129624, "uuid": "6320df65-d194-48cd-a491-96a90419193d", "comment": "Malware payload (AgentTesla)", "value": "eb0552adb1393fe7dab33128821e15ff49a4d3b0f9c086da3ca65f04fb19937e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129624, "uuid": "5893d36f-3ee2-43c5-8586-e9425c507e66", "comment": "Malware payload (AgentTesla)", "value": "f4d4df155f5bfed79c84f7f01014b8fb5f33767e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709129624, "uuid": "ded2e0b0-6260-41e0-a94f-62ec1ae3d5d7", "comment": "Malware payload (AgentTesla)", "value": "5e5280c954187e73b8a8fc6d95d51554f4acd0eb6b9d88aeefab1112b01f6bcce34ddaa29af32eca8f53d37c30e06794", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129624, "uuid": "f7ca4714-df3f-423c-b9f5-294a94641f63", "value": "T188C402206BE8453AF7DF57BFE8710A024B70BA573A17E75E24427AFA20627C01A51773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129624, "uuid": "951bce49-0fbf-4596-87ca-596488da4879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129624, "uuid": "2164c86a-453e-4306-abc5-45d718215276", "value": "12288:W3X0lGMjDRmoXuKuloEMm3DuJv7UA5k6iN:WiRFxeKuloEpuJv7zi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709129624, "uuid": "98abb2ac-075d-4b7b-9692-c9aec4009e49", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709129624, "uuid": "197308dd-e2c7-437b-bb42-a87ce6c8184d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709129624, "uuid": "656c1532-4f29-4634-a0d2-1f42c7555407", "value": "romezx.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf790f0-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145017, "uuid": "6f4ce786-e826-40e3-835f-c5235dc0ed9d", "comment": "Malware payload", "value": "e991d47605bc04629af29939ac2cc9b5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145017, "uuid": "fc13909f-5af1-4c55-a9ae-7725ab6d70f9", "comment": "Malware payload", "value": "eda12487c479ff31202a3c60f88f1f0e2bf7392919099315d0d951683f14609c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145017, "uuid": "7ea4ec0d-d971-4105-9c26-218f53ecf775", "comment": "Malware payload", "value": "70dcb9c81d5c8351d19d3a3fbc5530085ca8faff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145017, "uuid": "8b6cc7c7-7d84-4af9-87cd-d95c86719700", "comment": "Malware payload", "value": "e4b9bd14dc8468299c3b99130056ebb9b7057d595227543ee9c86a3f84aca09613a248359882d0e5d7b742ffee19bfe7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145017, "uuid": "c1fab08f-0bae-429c-85d2-32f0644cdb96", "value": "T127537D1123FC552BCFEF0F78B4E411304971BBE57992C3999A58C1ED89A37D05AA02BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145017, "uuid": "cc53088f-c576-4abc-bd52-8f7eaacdda98", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145017, "uuid": "e58eae27-ef39-41ef-8c86-8283268e51b6", "value": "1536:23wBccZdxuB8mQen6JxKjrlMZgR0Eo1jwPxb/JjAPxH:wcHmQPUk1jgxbBjwxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145017, "uuid": "426ff460-c1d5-4d4d-b755-c208297771ef", "value": 62696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145017, "uuid": "863c11a6-a60d-4588-9ffa-93e9ffe61712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145017, "uuid": "8e51faf5-cc95-4f08-8208-92a0e9dd3fed", "value": "SecuriteInfo.com.Program.Unwanted.5492.23281.13975", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df473d42-d682-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156807, "uuid": "ef95a053-5082-472e-8ebd-74da7c39e9e4", "comment": "Malware payload (Mirai)", "value": "b0a9fd7d4057684d97dd7ed8e08d6d38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156807, "uuid": "482c3f47-72ee-4fff-a733-e023e1f73d32", "comment": "Malware payload (Mirai)", "value": "edf418ad6d14013a08c00669a32144b9b94d03b627220b71eda2509d5a393e70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156807, "uuid": "bda52f65-0952-408f-9f74-26fa7c7e32f1", "comment": "Malware payload (Mirai)", "value": "411af79d64e699423b31b2f35dc52376850c632b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156807, "uuid": "d3818a20-8e21-4654-84d5-911aa126ab98", "comment": "Malware payload (Mirai)", "value": "173c056eee67bfd81c36ed06e7ae107b8cbf8764ab23558d0bd896d9686b2ffcacf2a67187253386998ccaa42258168e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156807, "uuid": "0ae318f5-ba18-4331-a5ce-364fb9426fbe", "value": "T178335C02731C0A47C5A72E702A3F57D193FFE99021E4FA84655F9B869275E36018AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156807, "uuid": "3f78b74b-941e-4efa-ba6d-64c6588578c5", "value": "768:UHyfovJMOaRA0zekGkn2LKjme6kW9ptjMuzFzR3PDUFFotVldjI4:Iyfov5agyApNMuzFR3rMofjjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156807, "uuid": "746615b5-dc46-4e3a-a940-afb1589daafa", "value": 52380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156807, "uuid": "17ab1c61-1f8a-48da-8e75-46eebaf820fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156807, "uuid": "99c7ea2f-be3b-48a2-b1c8-94ebe984d5b7", "value": "b0a9fd7d4057684d97dd7ed8e08d6d38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcab3a0-d63a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1709125555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125555, "uuid": "c5009c40-0a92-4920-ba55-417722cf94db", "comment": "Malware payload (Gafgyt)", "value": "bf2b0eaa346cf8c6f38b5eb33b8a4ef9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125555, "uuid": "f6fcfa4b-f818-4bff-a9d0-89f0e19d58c7", "comment": "Malware payload (Gafgyt)", "value": "ee7d7ddc98c4016133c5835c6142cd028e8fdeed9648af476743c12809e85985", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125555, "uuid": "9bb73669-2ddd-4ee1-8572-46f8bcf1d874", "comment": "Malware payload (Gafgyt)", "value": "e6c02616975768ab02b199042713fb06220d5872", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709125555, "uuid": "a455d458-72a1-4d59-ac8b-ba70a98eead1", "comment": "Malware payload (Gafgyt)", "value": "acb96226296019f014bf4f13b575676a2800519ea9b64e9496d42f43eb1b6ae961e2d4fefad0cdd24e629ab95a721771", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125555, "uuid": "e107ea76-27a2-4008-b6ef-1dca1fed3d8d", "value": "T18DA31A01F9418727C2D32BBAE78F475D3B365AA857D733016A357EB42BC27892E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125555, "uuid": "ef174081-5333-41e6-84d5-f8285cee57df", "value": "1536:LeCc11gPMnIDlU7y8RWR617DM0+OHWv1+Py3XuWZnkU8mChrQAhPW9OXFLQ:mgplU4oMD1+PqZkU8mChrQAhPiOXFLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709125555, "uuid": "0e8310ff-e211-4bd9-b6c2-c5b254868837", "value": 101355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709125555, "uuid": "c948f6e8-2f1a-40dd-aa6f-2209d024206b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709125555, "uuid": "0437ebdd-5b72-427e-b328-8c5af6974d68", "value": "bf2b0eaa346cf8c6f38b5eb33b8a4ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d63797-d5ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709092654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092654, "uuid": "53821433-50c6-4f3b-800d-40cdf5b3dc89", "comment": "Malware payload", "value": "7acf4aed2fb50d6de5b0f57302070b88", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092654, "uuid": "ccfacf9a-a589-48ed-87ca-4faa670ff6b2", "comment": "Malware payload", "value": "ef135dc34083956cc31881a526bb6119d24dc93096ee282e0feab8d43d603a03", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092654, "uuid": "0ba1c693-59aa-4fd8-94cd-911e28606048", "comment": "Malware payload", "value": "206ef7dbafb2ca48b06eea639fe1995c391ec9d4", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709092654, "uuid": "a4f50ab9-7c69-423d-a33b-84d815bf79a8", "comment": "Malware payload", "value": "3007538fdf276056b3bb9b7fcfee907a50a99d014cd6f7991d7c78bccf45e87b9422fd56e3094d7f5fca67b1628d45d3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092654, "uuid": "fc891fa8-d012-4d8e-a570-cd3f9a16a4c8", "value": "T1C4847D01B4D08431C97A34320635E7B54ABDBD301A596BDF5BEC39BBAF306C19A16A1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092654, "uuid": "36e5cc9b-abc4-43d2-8c66-4761c446ff91", "value": "6144:L4Tt9ODpYCPEHR+veJ0hUlp2F/UJuNGrF/Lq2J:LAGOCPEx+2SOJuNGrFzpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709092654, "uuid": "29a42b70-cb21-4f25-b347-693281d6f5fb", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709092654, "uuid": "c880aaae-05d7-4948-a596-6b0d66cc15d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709092654, "uuid": "2ef165cd-31fe-491c-8da2-3e07f45c4f19", "value": "S-FACTUR@200309940049003tAomUY6Ao.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d53536f-d677-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709151945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151945, "uuid": "d5d71b29-cb17-4522-9168-604b652b6cc4", "comment": "Malware payload", "value": "4d132631c0054fd169d7ab45f16b7ee0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151945, "uuid": "400cfb13-9d09-4431-a437-205552a32e52", "comment": "Malware payload", "value": "ef8c13218a741e32fe8c358425826b7a91d865493d4649ecd6073b95eb57a7e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151945, "uuid": "88d7bf4f-bda4-4ba9-8514-107ad37358c5", "comment": "Malware payload", "value": "dfe04f5ddff2faa72a08fb3307e37d525cfd77f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709151945, "uuid": "851475bd-24dc-4213-8f3d-18ed7f78ffbd", "comment": "Malware payload", "value": "e1baa21a7bbfe09ddf91862aea0423543e65c6c9b4a54a184ebae5004e9e964486fb96c7301d110b6fc4091fb6dac224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151945, "uuid": "4c7d3916-c7a5-4ed6-86cb-afcc8b1aef6b", "value": "T1E686339FA48BEE27D51A9478DDB0E7646339EE11D5311800BE0F7E9B7339A16EC23109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151945, "uuid": "7647f080-594b-4c08-9c31-17d221d49417", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151945, "uuid": "7163faf0-a857-4f0f-a07c-fa7f011043d8", "value": "196608:4Txfrv38sddXWgZ263RmgBE30cBdZ4KwwflcXFP3Wwb/v3c1/s:4db3ZdwURLKvV/SVP3Wwb/vgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709151945, "uuid": "ad4263ed-f753-4301-a33b-1f3705166086", "value": 8559080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709151945, "uuid": "1f102730-bbe4-4183-a481-a9a3cf56e9a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709151945, "uuid": "a2d130ca-25e4-44ce-8789-7e285ffd0479", "value": "SecuriteInfo.com.BScope.Adware.Downware.17180.24949", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f06f7c2-d65a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139305, "uuid": "8cf9b05e-feb4-43c9-bb3e-580862ee8f48", "comment": "Malware payload", "value": "77b7843009f545fda79c9c44262fb155", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139305, "uuid": "3be09e28-f544-4254-9c69-2db4366ab6d9", "comment": "Malware payload", "value": "effe15f7cc9e3afcc55b3e608e0b3c9ccacadd7b8fa7ea4299933d6b3a6ff9fe", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139305, "uuid": "da557b1a-8929-4905-8186-aaa525c41deb", "comment": "Malware payload", "value": "5549d83db756d75ef33bc51750fec4173b21fd33", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139305, "uuid": "d25f22e0-096b-4464-939b-0a3ac0c961db", "comment": "Malware payload", "value": "9a810c9354892e06bcde29a25d18dbe2be40003230f2ac82951bb9a5c9d345accfe497dfbc8533d48d4e6061afa5c62f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139305, "uuid": "b3060237-9dcd-43ce-98dd-9ba4b9202514", "value": "T1E643F268056F6935E6C29479088E42BD5370589D87B1B2DE32AC33BE75C2CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139305, "uuid": "73d2c4eb-4efc-4551-90ef-5c702263a725", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehZ:BoOAcw7nXDUsOjm3jTxhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139305, "uuid": "82384f42-a360-4ba4-bf7d-46ab43b0116e", "value": 56840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139305, "uuid": "0feb8245-74ad-4efa-9e58-a21c732a7858", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139305, "uuid": "d63bee29-5f73-4195-80b8-a3eeefbd3856", "value": "scanned_doc#2024-27-2_1091.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ddd8bf-d60d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709106327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106327, "uuid": "69fc1832-f136-4a9f-b17d-9ae37e7e1ae8", "comment": "Malware payload (Socks5Systemz)", "value": "b29615b6d7c6d600bc4eca7d449c4bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106327, "uuid": "9a05b7eb-92b2-4c2d-aef6-97fc920c0b55", "comment": "Malware payload (Socks5Systemz)", "value": "f08f45ac8033cf8d2fefb39f5109d34f4830031cb6742ccc1ad7da010efdff64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106327, "uuid": "19649ab1-2daa-4668-ab39-48c8578afd85", "comment": "Malware payload (Socks5Systemz)", "value": "6f34b4a2338bcd8fcac1cfd60accc1f0d87cdd0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709106327, "uuid": "ee0d1bdc-4d61-4f46-9d36-9aef6bcd0375", "comment": "Malware payload (Socks5Systemz)", "value": "4b37320ea3b86656cf700139823a75264037354d2d4947d765f2bb8a4a35af8754f589c1afc8df1cd9d42851e4f96dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106327, "uuid": "d6396192-f5ac-4a55-8975-8cc9cf22ba2a", "value": "T199D5332232A8C0B5D2A787B54E669F21748B2B2D3DF45119B3CD3ADA1F3B293581D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106327, "uuid": "c738d6f8-3bd1-482a-b150-0217b9f20982", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106327, "uuid": "b65e1689-a974-4ef8-b794-3ab8d45d0bc4", "value": "49152:C9fC/Yqe31XkGCGq1JbqbQaa3Hh0Z5x2fEr0zu1:MfC/a3VkGCGq1ucXhcSfEr0i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709106327, "uuid": "3d3a6c28-292b-4b9b-a5e1-7d4b5b101eab", "value": 2861911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709106327, "uuid": "d824ed32-d1ad-40a2-970d-7d81f1fbced1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709106327, "uuid": "1240463b-f357-491a-9d33-41ac24f31460", "value": "b29615b6d7c6d600bc4eca7d449c4bc7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3046a8b6-d62a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709118718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709118718, "uuid": "589afb0b-4986-47ac-be56-ee926d5499b5", "comment": "Malware payload", "value": "4bf025ff0d51ccb2ac5ad3c6d2ff2678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709118718, "uuid": "4dc3cb71-2779-43ac-a143-80a14d0cadc8", "comment": "Malware payload", "value": "f1e95a4f7a63c851e90934f12a37c64af67f0b428f9d6a39400816a41b50e893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709118718, "uuid": "e985ed49-926c-41ee-86ea-0698060509bc", "comment": "Malware payload", "value": "8da136184f17883c707b948e2becc5a13aa7ec40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709118718, "uuid": "4ac6caed-c8d1-4487-a032-51b4a652640d", "comment": "Malware payload", "value": "f0b52f673a9ed1e238a6ef0a95c85bc778239728ba6b76ff84dbdba8de3b8e998990e775a49197fd243b617002fbd618", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709118718, "uuid": "de3abcb2-b923-45d5-b36e-769160d64745", "value": "T1BE25238A2F95D8B7C64413F0C5A66BF3F6589C21C4B44503E791FEAE3933746DA0B285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709118718, "uuid": "2a784839-bcb1-4cc1-a8f0-6a7f67b72a97", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709118718, "uuid": "966c1732-b758-4534-a555-81bb8ee9e397", "value": "24576:hXbVr7EU8H0zCBEFNjauAdaW6oWE+C8cDNq59z1GCHG//fbLuR4X:l5r4TH06ybMtPYHBGCHG//Xg4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709118718, "uuid": "360c7d69-18a7-4d49-bc1e-e7d937d0fbee", "value": 963895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709118718, "uuid": "0ed41cd7-3ad9-42e1-a0fb-d4e8ad14620c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709118718, "uuid": "3e6d4777-efa2-4ba5-aef7-ff9b13898987", "value": "KONTRAKT 2456325670-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f1bdae2-d65d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1709140566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140566, "uuid": "4df2de93-182d-4497-b9e7-3990f555cd31", "comment": "Malware payload (AgentTesla)", "value": "0087d09cdebcb9892c6a8c09b01524b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140566, "uuid": "77e7aa76-e70a-4078-86da-2c07db0f4ecb", "comment": "Malware payload (AgentTesla)", "value": "f32ad4cea8c6ae589f620f2d6ba76f075b7dae5c4c005650abfb70d195f45013", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140566, "uuid": "d70b6b83-349b-4954-8b4c-3ed02c3ab923", "comment": "Malware payload (AgentTesla)", "value": "37adee59debf33aadbada18501cdb8fce46dba6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709140566, "uuid": "88a3b180-ce92-4490-a59e-a853585e9bbb", "comment": "Malware payload (AgentTesla)", "value": "c8b87efac97677fa6511cb08cf17d5d7277bede9f73278902d8868e5c19c8817262b7e79ef873f29b4153125b4aa9cf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140566, "uuid": "a7a61935-a902-48eb-ab0e-ddfbf26ceb5f", "value": "T1F0F4E0AD325475DEC85BC972CEA92C60BA2164BB570BD203901316ECEA4E9DBDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140566, "uuid": "c48d918c-78a0-4575-ba45-30c3d99b615c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140566, "uuid": "2ad12d46-328e-4a63-a8c2-b7783a2722d8", "value": "12288:pSC40fzNwnqs3y44sAGFj0yoHjl+DXYbW9Ag+BHyMopbzFqNUyJNVjZnzUqvaipj:pSC40WnPAGV0yoHjl6YKOA/wU0/4qz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709140566, "uuid": "5c4e0f55-df0f-47c5-9b6f-13b99a43562d", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709140566, "uuid": "4ab4308d-b0b1-4c9f-86d8-f9efb67dca66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709140566, "uuid": "2447b23d-b1a6-402a-96e7-5e6977295628", "value": "Fizetes,jpeg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db604cd-d683-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1709156885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156885, "uuid": "e8a724b4-7a17-4a65-a7c0-6a2b10318a93", "comment": "Malware payload (Mirai)", "value": "3dd45aca6750bcd3bda60b4205cfdb2e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156885, "uuid": "2867570b-c8fd-4cad-9040-f0eb90d4733c", "comment": "Malware payload (Mirai)", "value": "f4c85b7e5234e503e58b3f598c0d468a95514177c8ee8fb24af31585dee2d8ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156885, "uuid": "3d668f7d-fc5c-4184-bd9b-045c786f11c0", "comment": "Malware payload (Mirai)", "value": "49ee1c70cb5c8691ea86bd8e931038691f1ed04d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709156885, "uuid": "18b28507-4721-4bc4-9720-898d8787ccdd", "comment": "Malware payload (Mirai)", "value": "ce803200903638d34e3b53ee77b9a35666c52ce265d295dce044394f515e8ffc69defa3c10b48941b26af819e88296b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156885, "uuid": "0b7e897d-8cf8-45b4-9ecf-6ddd063a7ad5", "value": "T11F235BC9E643D4F9FD1605B52137F7378776F06A1129CF47C368E6269C92A01AA1B38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156885, "uuid": "9781376b-be57-4680-b1f5-0eec3f046aa5", "value": "768:KOT5/mBBY7RB0bVM5Ez7qG3hfXGrfG3jhh2IkuL00pg9Q+28D+SvIg:KOT5uBBY7RB0bW5JmlXGruz9kCjpaQ+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709156885, "uuid": "e4f03c3f-abf7-4779-898a-6d277096bf43", "value": 46256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709156885, "uuid": "96ec625c-9ee8-4379-837f-980c908bfb79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709156885, "uuid": "a7a04ff4-fb79-4b24-a98b-15583d4fbf8a", "value": "3dd45aca6750bcd3bda60b4205cfdb2e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2622bc-d646-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709130733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130733, "uuid": "9b81df99-80ae-424a-a8d5-2b050a4558cf", "comment": "Malware payload", "value": "5879a124cd6d7bfbf0133e005f1bdebd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130733, "uuid": "37e3bc30-9da3-46e0-a129-ac5eda22337c", "comment": "Malware payload", "value": "f6580f6a21a712e87c8d55662adf7d87df24253976085675014f246cccf8fdaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130733, "uuid": "51dfe08c-53d2-4464-915e-7460e22a7493", "comment": "Malware payload", "value": "3f96bd536b078f321322e52c0a2aa53b2139664e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709130733, "uuid": "7ebf4f21-5582-4fb8-b406-dab603e34950", "comment": "Malware payload", "value": "33d1a3f31acb6e70265a4a5bc969a1470d58ccf449a22eb32e3ebebfc8fc8688ac4c5b90d47a3bd38cee2f2afb2dcf07", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130733, "uuid": "72ea4b42-0419-46db-8ec3-b74c3b00cf02", "value": "T1F41512076E85DD13C69356748DE1E77BA33CCE800E2986476BC03E5ABD72B9E2A4509C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130733, "uuid": "28df54b6-e154-41f0-ad50-3fa9d247c386", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130733, "uuid": "6c791a7f-aa83-40c9-beb0-13896f2a7144", "value": "12288:jJTQrh2guL2ObOOSbH6ROfuhheB0E1QtlKnXUJW+QiAukU30+9Ir/CSQs:tTQrh2gu/9SbAOI4qiqyUk+T/G/Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709130733, "uuid": "b5239aad-9483-47af-95a7-7e94c339ae61", "value": 906344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709130733, "uuid": "40d2c095-820d-4d18-a02d-371399f93363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709130733, "uuid": "21a20775-0589-4246-836c-f9b3daa56ace", "value": "cuenta iban-ES65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f76e50-d61c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709112795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112795, "uuid": "8f8a2f77-8a33-4426-b4d9-33320c54489c", "comment": "Malware payload", "value": "c0a64d25d17743bd2198d56f5ab18d8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112795, "uuid": "a2b8d51e-7d65-4f06-b12e-74979e2dc166", "comment": "Malware payload", "value": "f6a7ae15b194b520c319e6219ae88f1ecbcb3f4d3d2ed62d7756921bdef20845", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112795, "uuid": "27624e00-4172-4410-a072-64ef53ebe917", "comment": "Malware payload", "value": "26c116fede4b3cb0ce145f967aba4a28d5d14891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709112795, "uuid": "74a03fe6-595c-43a1-b5a0-60352264137c", "comment": "Malware payload", "value": "fa3959399c5b15d03aa969557d6d0b725d8e82a6c3501a323ef83ced47ebcc6cf09c6fb360f3d38a78a7c0c78f255eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112795, "uuid": "349da3ae-eb7c-47a9-8865-4f690f006898", "value": "T191B53391F8D696D7C759447A5CB78F68066F2D102F2DABB8BF9ED80138A7C0099032D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112795, "uuid": "1ab7cc8d-6a7f-4a70-9b2d-eaf91e34e1f3", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112795, "uuid": "d64e6867-5236-429a-9067-325931440ab9", "value": "49152:kDuYJ9uu6Sv+Azg/w8OXvxBWP7QicM48cxenoPKDfsQWc6F4L/:aus9uuvdxXvPKJcJRenoPKDfWcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709112795, "uuid": "e796a957-b74f-4865-9a12-b6b1ce3e5ca3", "value": 2314752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709112795, "uuid": "c01181fd-2a8d-4862-9950-88a15c34a047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709112795, "uuid": "4e072e0d-42c0-460b-9683-581ff6396c14", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28142.25484", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18645c79-d680-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1709155614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155614, "uuid": "d0370edf-7e94-4c1b-a467-e0106a978a4f", "comment": "Malware payload (VenomRAT)", "value": "4d35c98aab308c27826278b3d29422c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155614, "uuid": "6363f2ea-f2fe-4fab-b7e8-d1e7e785a06d", "comment": "Malware payload (VenomRAT)", "value": "f6e9887eaac1fcce0392a008216d687515c57984703e0deccbf911d956291282", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155614, "uuid": "3c42ad3c-2c99-4215-8d51-4ab34033e675", "comment": "Malware payload (VenomRAT)", "value": "efee3f82fdb20ec6f0c53f76eb980dbc561196f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709155614, "uuid": "6f15f6da-f6e1-431c-9c53-22d236f3866c", "comment": "Malware payload (VenomRAT)", "value": "5011c49af8fe3ce42fb300460f53bb404223cff0c518ea36ab664254921327428bb0610aad87445bdf6ddf1b707fac9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155614, "uuid": "c78d34b1-2a78-4f01-b0a7-7344840b3903", "value": "T10B735B013BD88D2AF2AE47B9ACB252074EF4D5576512CE5E3CC440CD5E67BC68A037EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155614, "uuid": "f0d2562b-7715-4daf-92da-8379f4c65677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155614, "uuid": "ec07535a-9f90-414b-af1e-6d07c06d3c6d", "value": "1536:LUk0cxVGlCBiPMVye9VdQuDI6H1bf/SWy/l/JQzc+LVclN:LURcxVMWiPMVye9VdQsH1bfPKRJQXBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709155614, "uuid": "aa7b31c5-8df0-47ba-838d-188d1e500267", "value": 75776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709155614, "uuid": "18472d06-9585-402d-85f3-c12000cbb832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709155614, "uuid": "efe80193-a0e9-4857-b531-1653a6909fe3", "value": "xf3ng4iMAz1Z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72225d8f-d667-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709145027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145027, "uuid": "fd47f240-f6b1-4ed1-b7a4-4d5429cb25d6", "comment": "Malware payload", "value": "d5d708e9e7625ab2c4ac1c1faa099350", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145027, "uuid": "769ef6f3-b5e6-44c4-92d9-8fad5020cfee", "comment": "Malware payload", "value": "f6fadf0375d22512b2b3f075362433c0de173adfb290b4d8999cdcb7acedb0b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145027, "uuid": "3c8630f5-7e80-45b6-8587-0f285498d1e9", "comment": "Malware payload", "value": "9436c35fb72c4fd0ae1420effdbe5a8a14326077", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709145027, "uuid": "4102896e-9454-43cf-a8a2-95ebba994821", "comment": "Malware payload", "value": "afd82211cffeb28c8bfe69187e127322eecf5889c36b5ff239b3669b3c8ed17f4e4ae5fb56fa01f56774e4c7a57babad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145027, "uuid": "9c01a158-c142-475b-b9f7-ce46bda31642", "value": "T1A1636D4A337C8C17CEEF4B3478D822268270EA973D61C6A71568C1AC5ADE7E516903DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145027, "uuid": "d5a9ac4c-668a-4d2e-81f9-68892e18c3bc", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145027, "uuid": "0b1f42f4-b40f-41bf-b8a5-51392e199e20", "value": "1536:KfgDdceepOS3u594ww89rRwjwPxvjLbPxHZ:KfgP59Fw89FwjgxvjLjx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709145027, "uuid": "b04c056d-36bb-4558-89aa-5fe02a3bbe50", "value": 67816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709145027, "uuid": "60ade922-42be-46fc-81d7-d42aaf9fc254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709145027, "uuid": "a7a958c7-dd9c-44a9-bba6-25f3f221d558", "value": "SecuriteInfo.com.Program.Unwanted.5492.4830.27629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961a0b66-d5d1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (ISRStealer)", "timestamp": 1709080663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709080663, "uuid": "0b426616-588a-4660-b7e0-4575bbcefce0", "comment": "Malware payload (ISRStealer)", "value": "553cac5b073a4a5ebea85ea95301a0de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709080663, "uuid": "573f8c0a-b2bc-4c55-bef6-8d1fced44eb7", "comment": "Malware payload (ISRStealer)", "value": "f73416ad806e3eae3d07f79ca3707a991b9919ef5c79d97484e598611cd66fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709080663, "uuid": "8c533ff0-90ef-465a-aafb-f491ebb60f39", "comment": "Malware payload (ISRStealer)", "value": "7be354f7f49cc6ecb4be135138f2e6d2c2fea7bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709080663, "uuid": "93129598-c668-4120-917c-379414405308", "comment": "Malware payload (ISRStealer)", "value": "0eb6fa47283c507f49fd6bf837e1da090571523bff03b1fcecb16a275cf3a507747f24c993210af8e1e72e2a9a5b5ba7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ISRStealer", "colour": "#FFAB01", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709080663, "uuid": "25f50d31-4670-49ce-bc95-7f4ad3687aa4", "value": "T111B53389F6E76CE3C896ED304DEE8D3D423E9D7421008B3865E99730B5B7B79A14A44C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709080663, "uuid": "00a00eeb-a522-463c-93fe-526932e8f675", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709080663, "uuid": "d8d08767-c661-435f-a4e8-755f66e40081", "value": "49152:5IR9FHOmquBYcamY65FQmtnnk1VFhYSYGBaiv0RhGCxsGT3:5OumquoX6LPFSYia06/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709080663, "uuid": "f4e7f550-332c-44c6-a5d2-b17c6a3ec483", "value": 2312704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709080663, "uuid": "401210b4-c4ad-441f-be6b-84e1286c1a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709080663, "uuid": "0a6548fd-4876-483b-93d5-c51c9db5143f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c22d1a-d615-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1709109768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709109768, "uuid": "c306c5e7-08f6-452e-b536-aea1d1a1298a", "comment": "Malware payload (GuLoader)", "value": "30e29eda15e6a0e5779aa51fdb117b1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709109768, "uuid": "84b1983a-a74e-4dde-8bae-123f51c30b64", "comment": "Malware payload (GuLoader)", "value": "f9cf48429302e6d13375316cdec3ea2a4c76fc0b303f791093ef738b4dc8aa75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709109768, "uuid": "12e1d887-1a1f-4741-a4b5-2ff5a4dcb687", "comment": "Malware payload (GuLoader)", "value": "5f01ac4b716a561329c54960090ee4ae7f7ff731", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709109768, "uuid": "6d433b4b-27f7-496f-a59b-26fbf46972eb", "comment": "Malware payload (GuLoader)", "value": "abfb1b9109ec1c7ce628d979ce9a175d96f38e9c0657cc1706e9ad642c3cedb69a861f8d1e4b3046aca0ac1d8722c751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709109768, "uuid": "c285845c-2a7a-45f1-8188-f3097fe9c01f", "value": "T1762512BD2690D8D6DC7A0331D52F8C7419D1ECBA08AE455E22D27B2AB5F334E46123F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709109768, "uuid": "52fea6cb-df59-47fa-85e9-da2fe2fa4aec", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709109768, "uuid": "0571c558-71ae-4fe8-a604-367a7b90e233", "value": "12288:qguGYqcr9XyhjFXvSMQq1vwesLByX77K8QqKrqFBBwCeZ4c65V2yoqINbeDECqeZ:Ncx2FXvXFD/K8QqK2TBXy4Z4yC8ceR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709109768, "uuid": "fef1e5cc-77cf-4311-9984-76b75dc2b2c5", "value": 967640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709109768, "uuid": "da6d5ac0-1921-4bc6-beb5-2e80187d7580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709109768, "uuid": "f39f25ca-852d-4bc5-858d-da9635d6545f", "value": "Booking Information ##208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2749cfdd-d612-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1709108395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108395, "uuid": "167bc9b2-6301-4611-9e1e-7913fc8d0a70", "comment": "Malware payload (RiseProStealer)", "value": "018549838511a1117ab84f934af4678e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108395, "uuid": "02da49c0-8eb3-460f-9212-1255d97bc5f2", "comment": "Malware payload (RiseProStealer)", "value": "fb63180c0436a686cb9a2b9049f408b5ee666be00ee2af296b014dd1c1ff0900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108395, "uuid": "be90cf3a-1904-4dbb-8436-8ed5eda010e4", "comment": "Malware payload (RiseProStealer)", "value": "9116293b0bc36f0049b45dd18b11b1ebf22d7cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709108395, "uuid": "1aabbb39-610c-4f07-9c0b-98bbd3473d49", "comment": "Malware payload (RiseProStealer)", "value": "f0b1d58251ca6b784edf1535d36b15c955f03612a2b486faa76dfa9bad3792c750cb814da6bbfc39a0eb509d30d76f0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108395, "uuid": "183e4292-304d-46fd-8ceb-8b0c216ff018", "value": "T110B533873FE078B2CDD04E366B39CCD46A1B5D9386994A22BACC1607498F46C6FDB521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108395, "uuid": "84ce02b8-3c7d-4fe1-ab76-4c3e5e8668f5", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108395, "uuid": "27e30abf-49a3-40d8-a20e-660a3b15d28d", "value": "49152:68Hiag4Axh4l0eaqv6m+53yxGVhlrYSqYzvGwKscpx8oROpUTjbod:Wag4Eh4OeUMQlrpqSrcpCoQpUz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709108395, "uuid": "9ac1bfc6-0160-41cc-9792-a6c382237fc8", "value": 2333696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709108395, "uuid": "bc0ef92d-d34b-4637-946f-bd83c19ac8ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709108395, "uuid": "ec6e324a-5872-4458-a66f-4a13608c666a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.5575.2730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8c2e31-d60a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709105125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105125, "uuid": "8928382c-b7cd-4e2b-ae1b-277005a227a1", "comment": "Malware payload (Socks5Systemz)", "value": "ae46a312e5cad0c1a0a25eddfd4c72ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105125, "uuid": "25d599bf-8581-4f02-90f1-9879044cb5bb", "comment": "Malware payload (Socks5Systemz)", "value": "fc856e3614e21d2cd35550401ac7dbdea7da3be2f9c8d796320f804b06e25748", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105125, "uuid": "4298a137-1fd5-42f5-95ad-3567d047011b", "comment": "Malware payload (Socks5Systemz)", "value": "00a691955c3741b0759396954ba69643eb5cffb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709105125, "uuid": "de60c534-ef15-44ed-8436-857bf351c9a2", "comment": "Malware payload (Socks5Systemz)", "value": "936d9c10d094ba758351fb5c3c860d1a2ab609e585e5e4e9d24b68429f219caf4b91df3c57a38abc5a598527decc197e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105125, "uuid": "2731be0c-7f57-4f76-9fa8-fc39a19c6f3a", "value": "T116C5332A3B68E67CD30194744BF94728123BBE7C3C736462759C015EAFBB6A5940C3DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105125, "uuid": "f6efe2b6-8e5c-40c4-b8a1-12bf281dd720", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105125, "uuid": "f2ba1807-e99f-45d3-bfc5-87e083f1d8a3", "value": "49152:C97Z6OtHMAu3yK/+ev+DArvaxcdKSeYZb712jggadFv9kyprzsV5nIpu1:MV5eA0JWu+DCvaxGKXYhMNG1zzsV5n/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709105125, "uuid": "6215bb28-e758-40b1-aed2-9c2323b20b37", "value": 2719693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709105125, "uuid": "c2de0082-789d-46ab-a848-0c34cd70b798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709105125, "uuid": "f7004c15-ebae-410b-b192-e2429e6baa8f", "value": "ae46a312e5cad0c1a0a25eddfd4c72ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b4c3f2-d600-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1709100634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100634, "uuid": "65c66e12-e15e-414f-8aa5-465f0eb86d63", "comment": "Malware payload (RedLineStealer)", "value": "decb86294bdc9452d5751b00a7e78f62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100634, "uuid": "d62bf799-22cf-4ab6-80c8-044f5276e686", "comment": "Malware payload (RedLineStealer)", "value": "fea79a1ff59d69800b423427fd0aee002a1f2480ba58fcaeea211292ede4f5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100634, "uuid": "2dea2269-4dbc-4375-997e-c716cf574b82", "comment": "Malware payload (RedLineStealer)", "value": "467cf2a2589e55b5df9ee8ce767322db63697359", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709100634, "uuid": "89132457-e593-4c80-8a91-365bf7075804", "comment": "Malware payload (RedLineStealer)", "value": "4a29c541c35c82e61411f43c9d14417c24b81b111008006b438b90b213417646bceedebec57e122bcf2df6fe800d0daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100634, "uuid": "079889f3-af75-4335-9dff-cb4200366f69", "value": "T1E7C4126B32DC119BD8AF6EF86535291007B6E81A6979C3DC9C5170EF16A1FC9CB82703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100634, "uuid": "3011417f-8618-42ad-8cb2-d362eda25da7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100634, "uuid": "e3bf084c-41f1-4584-9997-98f590ad7114", "value": "12288:1vLL9bW9ez8puUscJJCd7EbTq5Lh042K/jrw23FcyFm20/:1TL9iy8q4JCdcYVS6T3FfJ0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709100634, "uuid": "4e2f6dd3-7a4a-47b5-b2bb-a887fcd7c60e", "value": 553984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709100634, "uuid": "25fc2fe2-f3e2-4a05-bc3c-1e04c256eed9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709100634, "uuid": "d17948be-c7e5-4e31-8448-0fcf71e930a4", "value": "Packing List and Booking Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2a62d4-d5f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709097023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097023, "uuid": "72d4314b-f7d4-48a5-b798-0d05f929d177", "comment": "Malware payload (Socks5Systemz)", "value": "b3384ca662e18f78d17c9ef62cf6222e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097023, "uuid": "6f5eb2fa-b8cd-44ff-a45f-6223ac1232a8", "comment": "Malware payload (Socks5Systemz)", "value": "feab12a05792166eaf80c66ee53b8a0dcb1e2a2250deb7ba44feaa2ca295c668", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097023, "uuid": "dca6aa97-3201-4182-96d6-f5aa5956278b", "comment": "Malware payload (Socks5Systemz)", "value": "ad9537e1460b976af8d8849e3f4758b654428626", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709097023, "uuid": "05643fca-feb6-4927-9f0c-338c7cd620fa", "comment": "Malware payload (Socks5Systemz)", "value": "39bf0489ecc1d9d4ff2f82c06d6604dc31dd0bcec1985ea819896a4aeb69999237a94df56040dba9040320be4cffdee6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097023, "uuid": "8e83601f-f827-46ea-b7c1-2d873c71829c", "value": "T130C5335229974872E3E0CEB05D6F80AD6537B70B127A906072DC946B4F2F7E81B1DBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097023, "uuid": "2f351914-313a-4e31-babf-8f12c4fe298c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097023, "uuid": "c7b4970b-d4b0-43a3-be4f-d1ee02669942", "value": "49152:C9H5RjhgtKNZsrhlXyJPT56DZ4qqUDk5brzMnbWIVigZwH58:MH5dk+UhEJPNcuqs1ryWzgw58", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709097023, "uuid": "8fc49d97-6aa7-4042-bb5d-3cae5878519f", "value": 2515467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709097023, "uuid": "c1723f10-8160-4c02-a16b-05892e10f8c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709097023, "uuid": "057d0e67-5fbf-4e81-973b-a346da0b1ad4", "value": "b3384ca662e18f78d17c9ef62cf6222e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db071b4-d65b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709139947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139947, "uuid": "3a807586-3181-4ffc-961d-a2a7ce1d915e", "comment": "Malware payload", "value": "546a7355ac49bd97f5ece38f92c7ce16", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139947, "uuid": "80541141-0394-4ca5-b4cf-8336c117afe0", "comment": "Malware payload", "value": "fed7d1e40c6124244efeda7127257a506786baaa44dc46043614daa15122aca0", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139947, "uuid": "345c17e4-2f88-46f4-b55d-ed4f608a2fba", "comment": "Malware payload", "value": "1a8d6f8cc5ef9f6aea7b8ab6855b6bb17d4eacaa", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709139947, "uuid": "7a100b90-f8f2-4b2e-8abd-f02ef6ea0e31", "comment": "Malware payload", "value": "9348c7cd68f3ad83ffabdbaa0c9c013e0a074514b1770224e2b983f1c6c08c9921548c9df4650de53845aa0b71e1b7b7", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139947, "uuid": "637adca0-506b-4326-812b-3d842b1f029f", "value": "T1DD4302784157A816DA82C83E0DCD02F963505C9EC7E2F7EB35EC62BE6442CE601D87D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139947, "uuid": "ba7d2bc5-4630-419f-a961-4f725ba33505", "value": "1536:nGToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwaw86RUtdzn4:EoOAcw7nXDUsOjm3jTX6otn4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709139947, "uuid": "2712e1d6-06db-4906-9abe-7a58fd661716", "value": 59514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709139947, "uuid": "c9b98933-cf32-41e3-8a1f-122fc5562710", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709139947, "uuid": "fc655421-b1fb-42d6-a443-a5dc9ab07da9", "value": "scanned_doc#2024-27-2_4864.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ec297c-d5f5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1709096122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709096122, "uuid": "1f1a14c5-3122-4357-b1d2-c51a214ab4f9", "comment": "Malware payload (Socks5Systemz)", "value": "fa3d666cb96555090deedde6a4862781", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709096122, "uuid": "79802924-85c0-422e-9d19-d61ee59d25a8", "comment": "Malware payload (Socks5Systemz)", "value": "ff8d6d997a080203e173e7773d75ce4bec74419c53ecb6541cfc6e13900ae525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709096122, "uuid": "cac1422a-a3b3-49a3-8e92-e04a55533985", "comment": "Malware payload (Socks5Systemz)", "value": "6ee92d586190ac99086076a7d400a03564228dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709096122, "uuid": "109e19fa-df11-40f9-ab39-bf335131bcbb", "comment": "Malware payload (Socks5Systemz)", "value": "cd6299d42de7241b4b37dcc7c21bc220691c5f757e537c2648f7f93b8839b54a24ced21bc690dc1521538c453f109b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709096122, "uuid": "10988488-1005-4b7f-a4a9-eabbffe03d0a", "value": "T1CBC533069AC4893AF811F3B04DBED2164DAB76108C305417775CADAE6F63B54FCAA7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1709096122, "uuid": "abb8e75a-4425-45fc-849d-979c3b6c5dbc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709096122, "uuid": "37f1f9bb-3ccf-4ad1-a411-9f73ce5cf8bb", "value": "49152:C9JXDEZBDAjLNqNHUyoOe/CDjTYsiHetr5+1hVObhH58:MVDEGwN0yoOe6DjssiHetrQl4558", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709096122, "uuid": "721d29e8-06aa-43c9-9f9e-45e91431153c", "value": 2519262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709096122, "uuid": "19878003-f6bd-4a4a-ad34-94882cc9f64e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709096122, "uuid": "2c19bc32-6743-4eda-acbc-b66a3ef88f39", "value": "fa3d666cb96555090deedde6a4862781.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f43168-d656-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1709137920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137920, "uuid": "ba67bb3d-f5af-476b-93db-210f516ec82d", "comment": "Malware payload", "value": "f1cb57f4bf38e8efa3c28a2e4b55b043", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137920, "uuid": "378e87ba-126d-46ec-a07c-bd147f2dd710", "comment": "Malware payload", "value": "ffd5b17bd2b58f4c3f1da74c39a4caf536ffb82953f737addcb52f29eef6cbda", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137920, "uuid": "b08dabed-2b24-419e-8829-8a5068b6dd4e", "comment": "Malware payload", "value": "362a4bbc0fd85b5f13990ede9a5214b06f4101e7", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1709137920, "uuid": "2378821d-ef08-4ce3-8b3e-5288ae0702a2", "comment": "Malware payload", "value": "2d1151eb13829038530c8594ded283e9cf3594050638f5ff7b14f3eb086d7fa8090ef2dae561c6a1e99ece975b325373", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137920, "uuid": "02bb7c67-4255-4414-b8c4-0b7b79d505aa", "value": "T18C43F168056F6935E6C2D479088E02FC4770589D47B1B2DE36A833BE7982CD522E93FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137920, "uuid": "25fd3882-0723-4c4c-8eb1-52620dd8cde3", "value": "1536:p/ToOEjzAw7Y2r7DUsV4XzY9t3jSagJYwehT5:BoOAcw7nXDUsOjm3jTxhl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1709137920, "uuid": "20f772c1-ed94-4017-84f9-99395e641a3c", "value": 56837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1709137920, "uuid": "b7b35e20-6a09-4fe2-9fb2-79436d23e81a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1709137920, "uuid": "e6b8dfa8-cabc-4e7f-9530-48ad3f758c1d", "value": "scanned_doc#2024-27-2_7548.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }