{ "Event": { "published": true, "date": "2024-02-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-02-05", "timestamp": 1707177781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "60c3df37-fef2-4be3-bf28-398f1c05db9c", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee43ac0-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111462, "uuid": "8e6ba7d0-732b-4172-9ee4-cc8e780e70a6", "comment": "Malware payload (Gafgyt)", "value": "0aa8e1e31ad00ea0ad9060f3bc884ad8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111462, "uuid": "d154d37d-ca07-49ce-8bb3-f70403104b47", "comment": "Malware payload (Gafgyt)", "value": "00070c26e1e3af1c3e12c1533be329f784af1432f9dcd16bc08a7837000a44c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111462, "uuid": "b7555d9d-b6f0-45f9-9abe-ede8bb5bc1c9", "comment": "Malware payload (Gafgyt)", "value": "6ffcb76882da084bc590e8f96d89e104fd1aacb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111462, "uuid": "3687dffb-4ea1-4926-a9f7-5ed002df56ed", "comment": "Malware payload (Gafgyt)", "value": "a259b3e1b1b22a2e0c812d253839585d35cd8cf66282213293ca04215c05a2867ac7c06e040d3cc6063cdd371e1df4cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111462, "uuid": "714480a1-6795-4b4d-9605-7003e249034b", "value": "T137C3C63B67170E23C0CA50B101E34332AE75DF9B34B952D7AAD07D686F36A843856BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111462, "uuid": "e0c18760-b6b0-4746-ad0b-b9667614bfde", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqPjL7ymm/QMurB1nKGNb:SMQplVjamm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111462, "uuid": "c8e4f3c0-9ad9-4b67-b314-66a3cfff740a", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111462, "uuid": "7c5ad2d4-b884-4f47-9367-09065dd0c6b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111462, "uuid": "361a43ee-88ea-43b4-b714-0d6aaf61e564", "value": "0aa8e1e31ad00ea0ad9060f3bc884ad8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbf8398-c42d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707141072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141072, "uuid": "867fc8f1-fe55-4058-9195-c8201067bf15", "comment": "Malware payload (Socks5Systemz)", "value": "bc909b26bea19169bfc28816e29877d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141072, "uuid": "92847361-fec5-4f7a-af9d-edf4041c0470", "comment": "Malware payload (Socks5Systemz)", "value": "00dc90ea7c9b2541b73cfb3cb8893b8cfc54ba4c578db4975a584c27c924368a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141072, "uuid": "7a270c63-ae34-4224-8701-23d3cec9aeb0", "comment": "Malware payload (Socks5Systemz)", "value": "4bc25ef21454885a0af9df3ffe58dca0397570fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141072, "uuid": "c74b5b48-9ca4-4ea8-94dd-5fae831a892d", "comment": "Malware payload (Socks5Systemz)", "value": "981df0c3ab387175dcf8b6b4f4a6f3e49e353a22b5ad4bed842d5e59d57aae65af5411eb1322061be01745e8c65ef21a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141072, "uuid": "50be327e-604a-4b94-a9f0-9fe1fc4acb5e", "value": "T13256226C43F75C48C1E0EAB56D229B946FB9FE13299EC3E112F1BD4898391465BC3983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141072, "uuid": "9c2ee177-e8f4-4965-a32c-d6a2a56e603b", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141072, "uuid": "2ebbd207-01da-4955-a6ad-791896af209f", "value": "98304:JiLLL0k0eN8muc9MXMqBYWNRmyvV27Qf8iYUpEDzml0yPEpI+TkJ+JNyZReL2uC9:YrVpNzum4YWNEgV2BiY4mmvPnYNuRC2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141072, "uuid": "af753b74-acfb-42d8-85d3-35e2ad15c23a", "value": 6079670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141072, "uuid": "69acf4b5-1227-4ad4-aace-a9f06ac42b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141072, "uuid": "f7cfb1eb-ada9-48c4-bc82-472fca7ceddb", "value": "00dc90ea7c9b2541b73cfb3cb8893b8cfc54ba4c578db4975a584c27c924368a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39e7d84-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144139, "uuid": "e12b1157-9592-4a14-bf30-f9cac57d82e7", "comment": "Malware payload (AgentTesla)", "value": "6d0eff7ca858e1eeeab52048c97db684", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144139, "uuid": "ffbbc335-1454-4712-a42b-55c33ee7da2e", "comment": "Malware payload (AgentTesla)", "value": "03362c69bb1dab91a9b3700ba7d8868cf233318dab8541eae47bb21b017bf862", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144139, "uuid": "a294a192-cc0d-430e-b368-38dd50db2f1b", "comment": "Malware payload (AgentTesla)", "value": "672450f9e15d9c6db7fd9d56d35362dd3869c4b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144139, "uuid": "f73d9cfd-0087-4873-a5bb-60ab04d9e96c", "comment": "Malware payload (AgentTesla)", "value": "7adddfaf2260e8dae6e1f697995694292977778e58217969f7a98036f248f2a4bd679caa6ae016aa3b43afd302fd76da", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144139, "uuid": "2aa21bfb-83d9-4d39-8e69-fdd00abf97e6", "value": "T1B1B23929B3EC0B32D8FF577958B312002774B5578A12CA5E2EC9558B4E73BD05A12BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144139, "uuid": "6c9aa8d3-7155-40c2-9b26-9931b45fd617", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144139, "uuid": "f26440fd-7ca5-4ad8-9ff1-429b98e17189", "value": "384:+TnQapqGq+Ut/G7IvWjG/e+zhXqZCawwXZThfYi5GtjZSNsYpKtpsmr9ZOVUpT:iQaUGq+Ut/G75+zMCmlhpESTpKtSkOST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144139, "uuid": "9eab6848-129c-4951-9def-eaaddbed3988", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144139, "uuid": "f891c247-4115-4712-8644-3c1a952fdd28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144139, "uuid": "addde6e5-fdb2-408b-9463-cdd4eec185b2", "value": "DHL-LHER0006981753.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb86468-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707144126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144126, "uuid": "de5792df-14d0-4f72-8a20-9561926a346e", "comment": "Malware payload", "value": "d2cc66c09a1ca375e5556e956822275f", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144126, "uuid": "6fd28f9e-bc71-4521-bcc5-794f1fc0b78b", "comment": "Malware payload", "value": "04c0f0bdeabba294fe264d44cd517de7ea9cc15f39323a6ad31e4c713a42fb64", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144126, "uuid": "fc7d4621-0297-408c-8294-73c267138036", "comment": "Malware payload", "value": "adbe12938e7c238789f4ddf8f278b6d27d4d932c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144126, "uuid": "3708f808-981e-426f-954e-f1be3a62d67d", "comment": "Malware payload", "value": "f51707b8a5b3794e9633f5bdb73d65016cba5414dad711d93a8928b21193f4328e726a2fe131b548dd5b36743aa96091", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144126, "uuid": "8775193a-d783-471e-9ac0-2a382b979233", "value": "T189458D84B1C4FCDEC01B4432C838BC34B519F69A923BC917651B6158E56F393BA27E6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144126, "uuid": "c41e59dc-046d-45e8-a205-5c81a9ed9dcf", "value": "24576:45RPT0fJKjwYZ/I0P/ekwSVzGHkw3lpjn9LmAC+eMmEHI:yGJKcYjOONGN1ln9LmN+ZmEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144126, "uuid": "b0397806-849c-41f2-929c-2d02cbbcf0c3", "value": 1229312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144126, "uuid": "f39805e0-2bba-4eb3-8e89-c469d0804736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144126, "uuid": "e17c074d-aefc-4a78-b00a-2d6c95fdc464", "value": "DHL Delivery Shipment Notification 30247.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9077de84-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707144053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144053, "uuid": "00e31e48-733a-4568-a767-8410455a3347", "comment": "Malware payload (Formbook)", "value": "2e940d2cbe3d110e326a7c8109520661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144053, "uuid": "d29b99bd-7d96-4e61-b41b-5505a7abbc7b", "comment": "Malware payload (Formbook)", "value": "04fcb96d2e900247b8773dc5ff106d673da732ecfb31e58109133c08e16e1d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144053, "uuid": "beb7e74a-8d22-4d29-a84d-25bd4cb5cb33", "comment": "Malware payload (Formbook)", "value": "55d2a699507363029e9c46021aa88c2e001004b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144053, "uuid": "97a742bd-f844-43c3-b0e3-e2c377fa48d1", "comment": "Malware payload (Formbook)", "value": "99c9b89cbc0426e0ad6d149fa85236b4fee9bc81d76f191de3417609416e260fd150aaa56b24affdb317dbba7dd0c329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144053, "uuid": "eac7ad26-eb08-4f41-9451-7c7bbf084589", "value": "T1B5356DD1F150C99AE86B06F1AD2AA43021E37E9D94B4C10D599EBB5776F3342209FE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144053, "uuid": "c3868007-dba6-4391-b5dd-b528be8f4f4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144053, "uuid": "6e4d87bc-edd3-4aed-ad78-1b0c71ac89de", "value": "12288:kqpCrAaXYykD9c3hv6yjv1EOgKquenEs4Gipu2PgrFEDRCsEfbSpC9aLafOfYkhE:TpGIr9cx9v1UmrGqgrmDRCsEJ9a7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144053, "uuid": "66ca5c75-f562-41ac-a535-deb5290f7992", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144053, "uuid": "a1c93278-eeee-4d6d-a777-822c6e33b199", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144053, "uuid": "548fa4ba-a790-49c5-9b21-202b31d02fbe", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58fc4b3e-c3fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707120767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120767, "uuid": "c7ff545d-4463-4b11-a639-2c08f211485e", "comment": "Malware payload (AgentTesla)", "value": "35a3ea67f40367a4c8b136666cb048ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120767, "uuid": "0ac807da-35eb-4367-9f2d-8883fd560f48", "comment": "Malware payload (AgentTesla)", "value": "0538fb78e9459ca726b08c4de952bcad3e397c0c019318a52a7495e1c3e802f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120767, "uuid": "3dba3398-ee85-4b0a-b107-86e2e62ccf6d", "comment": "Malware payload (AgentTesla)", "value": "5d8f790c1e28e2406f5065ff0c29012eb699448d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120767, "uuid": "c61509d6-8bc5-4cd9-8175-9ef7a4acd22f", "comment": "Malware payload (AgentTesla)", "value": "f743ac4106f06f61cab563c77adaffec426797fa97f2b51a56ae5f97836c157bb494d6d661cf93220913c7a040af6917", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120767, "uuid": "33d79abf-f06f-4a35-806e-9a5e2f08b248", "value": "T1A224B7823185DCDAE04329F258AFD57061787D9E8164C60E3783BF2B95E734234AB79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120767, "uuid": "f07802b0-771a-473b-a145-fe73b9813f07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120767, "uuid": "25bd807d-1150-4087-b83b-3459d5eb9f71", "value": "3072:6h/H+4iIjNnCDDRvLGbrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/oPYm21KLbDX:6lpstvLGyELbMUTKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120767, "uuid": "7c169ffb-5a62-43ce-8329-068e8a71ee8a", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120767, "uuid": "7d24fa1c-b0cb-4129-8728-0709b1910d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120767, "uuid": "b6e6b16e-fffc-4c9e-aeec-e4b77f77bf48", "value": "QUOTATION#00913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310aa702-c481-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707176964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707176964, "uuid": "024572c3-e488-42af-9c37-e4612cd16f72", "comment": "Malware payload (Mirai)", "value": "f27ac2f60ff8b3a863a560ee0b7adc9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707176964, "uuid": "1cc4e1bf-630b-4d6b-885c-3396a889db35", "comment": "Malware payload (Mirai)", "value": "05e5064f12430c75894df91219e47d3cfd776c1e6f180376f33546607487c447", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707176964, "uuid": "6e2d047f-bc7e-48d2-9c5e-d58d76ae3cdd", "comment": "Malware payload (Mirai)", "value": "aa7b9c49fdf44b016c300957f3cd3dc43f10acfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707176964, "uuid": "49948224-b636-4eb0-8585-3cde50b52853", "comment": "Malware payload (Mirai)", "value": "cb1007d74e074e32f223434d96f74fde84a4040d3e31c48b3aad3e0d01d7cc164e72ec0e24fb041f3c1299be44f98e9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707176964, "uuid": "8d3600d2-3bba-447d-ac56-0d6f82e2288b", "value": "T18DA3C60E7E218FBCF7A982344BB78F21975833D526E1C645E15CEA015F7028E641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707176964, "uuid": "848b5791-3617-4860-9eb6-5cf21e2a616f", "value": "1536:OPsrfTYtbUVzn3mQ8vN5H8tVQg01dxjyPFFfFBQJsHcBSYTsee3RwXWNLX:5rfTSbUVzn3VQg0oHusHcwYTsM6LX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707176964, "uuid": "e03c2c85-545d-4c2f-9e15-09b71bf72bd2", "value": 101460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707176964, "uuid": "7d2d0d07-c454-4f19-a579-d44e62b0cbf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707176964, "uuid": "71bc4eca-4d8a-4835-9bfa-7c59565937b3", "value": "f27ac2f60ff8b3a863a560ee0b7adc9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ec9b5-c3cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707099630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099630, "uuid": "3ad3795a-fefd-486c-80e8-bbddf99a5a12", "comment": "Malware payload (DCRat)", "value": "08ef924d6dc6b7159cf34fb9db4cacac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099630, "uuid": "65fbe515-e6ad-4872-b993-600097062b37", "comment": "Malware payload (DCRat)", "value": "07ef2eee7e56c2338327d52269e755e7dc2bc82e2fb8781de0c1ea7857003d49", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099630, "uuid": "db662fdb-0dd9-46ea-af45-3d0a4ad8201a", "comment": "Malware payload (DCRat)", "value": "ba2527b88a6b290c1c49649fa66aea144fffbe4d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099630, "uuid": "2ac10f48-16ee-4df8-a64d-789c6f95a7f9", "comment": "Malware payload (DCRat)", "value": "d8a8fc59353b5b52f612d5a005529a4afbda75d1e2bff015a9955664a1c9f8e263fbd62c6be098f9c008037d6970db94", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099630, "uuid": "6abcdd10-dd18-4d5a-b5e2-6c1566ae20d8", "value": "T1F34542342EEA502AF173EF7D8AE47596DA5EBAA33707985D00B103C60723A42DDD153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099630, "uuid": "688a9a7f-32c0-4588-a585-f702d2e2c9b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099630, "uuid": "ab283beb-93e6-4eb9-b38a-de1ad182454d", "value": "24576:6T25fx6ZCxiXt5onpL1QkRdSAAS7HrU/:0kfbi0pb3pr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707099630, "uuid": "81ffae32-982d-4284-8f90-d4190ace7e97", "value": 1179136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707099630, "uuid": "b76e9c58-bb25-4754-9293-805996af855c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099630, "uuid": "faf03d74-ec73-4e36-9e39-16a7a95d65ff", "value": "08ef924d6dc6b7159cf34fb9db4cacac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3ecbc6-c3e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707110518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110518, "uuid": "ed40509e-3e59-4480-b93a-88cd949bf0fb", "comment": "Malware payload (AgentTesla)", "value": "20c1410fdd05a6deccfe493c4b21544e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110518, "uuid": "47d93c09-c2ab-424d-b3eb-a6f9a1021c43", "comment": "Malware payload (AgentTesla)", "value": "07f7e9bc869b416cdb600550826db5eeea94a6ea8214364e0a042f549d6da42b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110518, "uuid": "049d9323-21b2-484c-9a98-ceaf21fa4bcb", "comment": "Malware payload (AgentTesla)", "value": "1d7522d0beeb17cc139e772dceb4688ecb7e8779", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110518, "uuid": "74ae2c6e-847c-4710-9c2d-126d9c00f42a", "comment": "Malware payload (AgentTesla)", "value": "e6bfb08ad9fc6ab0a62d8a6b4f22378b8b1cb47fc2d77a8be6a6615b8d639cd5abd7a0a07ba02d98139a4426d488b3a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110518, "uuid": "e0d22a33-e9dd-447a-9a96-1db36629bfc0", "value": "T1DBB23A15B3E84B33C8AF07786DB311101BB4B6975A02CA5F6DD9544B8DB7FD08612BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110518, "uuid": "a7168419-6d41-49c8-8c9b-0be4098d7bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110518, "uuid": "972a4224-72a2-4811-a082-f5eae289260a", "value": "384:GD1Vn0rgsO6qSU5/d7IvM8vHzFAeeEvyLQ+RZ/gGCkX4ItFn1NiWQmjZOVURj:+1100H6qSU5/d7STFADEvyk+L+Ivn/iE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707110518, "uuid": "5dd0a1e2-3799-4cf8-9227-468b08ac106a", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707110518, "uuid": "9c1dab61-0152-4f3f-a82b-83511d897dbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110518, "uuid": "7da49b1f-c0fb-41ee-9fcf-4edf6700b4b1", "value": "SecuriteInfo.com.Win32.PWSX-gen.8295.28016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e86455a-c3f2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707115488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115488, "uuid": "27467c4e-ce93-4b37-b239-ee79757ea5a9", "comment": "Malware payload (AgentTesla)", "value": "a5fdb39b2713f883b4e0fef2ba9a6984", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115488, "uuid": "fc4ef141-64bc-4dea-a3b0-03f01a2afe2f", "comment": "Malware payload (AgentTesla)", "value": "07fbbc06d0324a0d87abe8f69ffeb7bf3cfd7498edfd20da7ea4a370f2495edd", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115488, "uuid": "fa5bd98e-6e88-4220-b094-2685d9faa2a0", "comment": "Malware payload (AgentTesla)", "value": "6674b074b17797064883cc0bf8a077b68ca57be2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115488, "uuid": "e90dbafb-571a-42b4-bdfd-58d2b374efe7", "comment": "Malware payload (AgentTesla)", "value": "878da641c80debddebe2f93fba13941934b0583ce73b4b0e796eb66885269d96f591f80e5f5a2e2197421f9b6473f477", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115488, "uuid": "6a886622-3672-436b-b42e-b30a77fc070d", "value": "T1F60533EBB40C62E651085C999640FF5FFD72153BCCAE0599508D889E0B98EF4F19ECCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115488, "uuid": "69ef7dcb-e1b7-4c89-9d7b-affa0b3896b7", "value": "24576:NJQspjcLMC+RSau7jXMlEoy67gK1rOdNsKw62k9Jm:kMEeSaE+T1idOKgcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115488, "uuid": "35e6f4ba-952b-4f32-837d-42dcf6ccc96f", "value": 808818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115488, "uuid": "c442b747-e2e4-4390-993c-9d1e25b3dd47", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115488, "uuid": "7e948a34-be46-417d-a6d5-688936519529", "value": "BL draft.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250086b8-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121968, "uuid": "a263f4e1-0724-488f-ac48-03254640dc51", "comment": "Malware payload (AgentTesla)", "value": "fc0f7763cc1bcd56266361546d559ee8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121968, "uuid": "9ec1498f-35f5-4a9c-9997-06b5ed9819ed", "comment": "Malware payload (AgentTesla)", "value": "089463f7438aada6e397465f3951fd3ac4b5cdae44e8e88e6bc7620005b2b418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121968, "uuid": "229cb33b-e51e-48da-af93-96cce5c4f085", "comment": "Malware payload (AgentTesla)", "value": "957d9fe73d67e27823f9dd1164728fb517c87b09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121968, "uuid": "f31c6789-bd31-480a-9b63-a55f79b4a00b", "comment": "Malware payload (AgentTesla)", "value": "c188d77ea7f09ab82528bd0921c3238f542659b7b69899ef30f1196ecd69b20e8f219a474dccdcc39ea755afbc058f7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121968, "uuid": "5a771607-913d-4921-9436-bc12d4711484", "value": "T1E2F4F181E6945B74CD7983B52535C8700BB33C6EA570E61C2ECE7DEB3ABBB415820867", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121968, "uuid": "f5fba5be-6ea3-427c-9c1c-1ed5817b78a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121968, "uuid": "3326d553-f77e-4b72-8a42-840419eaa7f0", "value": "12288:sQqQTOCwWCwpwKAYcGpMGniJET+R8AzVtiTu6Ty/e7K14VJeCtLRzCUad53rD22i:ZqQfdpfXVpMAT+R8ABtOtTcKe+zCnrDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121968, "uuid": "14e4dc7c-127b-44e5-a264-3647c1840678", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121968, "uuid": "8befe75b-9e66-446c-9ce6-effe7f4a9e15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121968, "uuid": "3758fcb5-4471-4fe9-9343-0531d11ed368", "value": "Consignment Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79c0b91-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111531, "uuid": "eb6b375a-751f-402b-bd25-6b8b2b4cd381", "comment": "Malware payload (Gafgyt)", "value": "782bb30f365351e87a62f2f7f657428f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111531, "uuid": "5e2f2aec-cb99-465b-b35b-ba27d1b26d4c", "comment": "Malware payload (Gafgyt)", "value": "08e501f77aaf5109511a8b04b730a502ec842a42785a14193cc8e2e29fd99382", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111531, "uuid": "4e918916-2cce-44a3-851c-40d6183b74d5", "comment": "Malware payload (Gafgyt)", "value": "cc9d7680b9d766747876f55515995a03490d29f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111531, "uuid": "a631dab2-b78d-4434-ad7f-0a9b33002206", "comment": "Malware payload (Gafgyt)", "value": "539c80774aed7851c749c2a5a5cdd646fc8009dc1c1372f868c04bf3d8f257b25d5514fcaa66e21c4c89073958da31a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111531, "uuid": "eb07a1e2-58b0-4810-8ce6-69847fdd9fe7", "value": "T108E32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111531, "uuid": "53077633-ca03-49e2-915a-f42ccc437cea", "value": "3072:Cv/WwsLgaq353qHiCOvhOpMqkDQHbeskmhxQwoVSUNu:KPLaq351hOpMqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111531, "uuid": "e214440f-1195-4d5a-95b4-e4185a96b6bf", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111531, "uuid": "12594038-614d-41e6-9832-18418dd38f48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111531, "uuid": "e594e16c-d317-48b2-b2f5-b42240a4e8a0", "value": "782bb30f365351e87a62f2f7f657428f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ac81a1-c423-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707136782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136782, "uuid": "097b8956-58a9-4ccc-9743-06035e8a1b09", "comment": "Malware payload", "value": "f4010c2113426a083e6a136cb43f5e88", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136782, "uuid": "8a3d7847-5219-4d70-8b16-fd37e62f011f", "comment": "Malware payload", "value": "092ea7da8f28e33e16d0666bc2b153d11d42b94406407338412a4318f3d24461", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136782, "uuid": "51fa1118-6a5b-43dc-b1dd-470d873729f7", "comment": "Malware payload", "value": "0c748baf78e7279687398d41811f80b63c598fd9", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136782, "uuid": "e2b98b69-7f10-44ef-91d0-9690991db4b0", "comment": "Malware payload", "value": "9bb7b0ddf9bb8d927b12606aad4e2eff558d002c31907d1650626d8986eec796921a0dc6c94480132571710d83b58a80", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136782, "uuid": "6eac3813-18ba-49cd-96b3-0987feb5ec1a", "value": "T1D90833AA0A45311AF0E933FA3F3E6DEEF634C0012B5555F3AC955686CC83CE66C6846D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136782, "uuid": "827c119e-8df2-4289-b69a-41a23904d92b", "value": "1572864:bD6LBYYcLL+oX5YQxwhoZHBFdNYZvpXm6IKEpJ:b6upnX5RxGozFC3IKED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707136782, "uuid": "11a0cc0f-a22c-4805-9d47-d5c7383eb8e1", "value": 82587635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707136782, "uuid": "57530974-7147-4de0-9456-cb6b6b088463", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136782, "uuid": "810ab5fe-9d9c-491d-9a42-3bceb05ffe28", "value": "Planets Therapy Installer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a1d0b1-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121936, "uuid": "2a7008c8-03be-4af8-b218-845be2dcf809", "comment": "Malware payload (Formbook)", "value": "faea8b7bde99414440392a36a1f0c801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121936, "uuid": "d6e719d1-3951-4318-85d0-b91de0592d50", "comment": "Malware payload (Formbook)", "value": "09ec60bf9426e895f3a7f7722867f818100251eb8207fec0d7ddcd53534f9e08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121936, "uuid": "f55f22e2-88b8-4b0c-9c7d-fa11a857cb7f", "comment": "Malware payload (Formbook)", "value": "c3fd8107df1e491d971a61aca1a623cbed738a8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121936, "uuid": "aedbc76b-ac8f-4997-952c-aec381756182", "comment": "Malware payload (Formbook)", "value": "85bda968eaac4678e15f731c76f8ec8ad5a751cb2f88f5fad702a503fe0f7e685a56c340634a8dd504120f1be2f40856", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121936, "uuid": "7bc067ed-067d-4447-9785-3d281a4be4e2", "value": "T18F049E32D601C031F2B251B5B6BD1B7B883D4E357255A4EAA3F216E06EE49A5F03931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121936, "uuid": "289b08c4-1c4b-4b32-88c5-0be599f58fc5", "value": "3072:SgSsHkVi7vvnal3DmHnCo36AT0yJ6Tcq90rfmNpl0AstFssaCOjVa:lmiaJD8D6AT0yXqYQ0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121936, "uuid": "f7ae2a9a-e6e9-4972-9575-a78dd4cfbe29", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121936, "uuid": "41113994-16de-4993-86b6-94d41c358324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121936, "uuid": "6199a4db-fc38-485e-bd86-5f3b0e4d78da", "value": "09ec60bf9426e895f3a7f7722867f818100251eb8207fec0d7ddcd53534f9e08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b06608-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707120490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120490, "uuid": "1cabf6cc-7190-41ae-be7b-814e697cc6fe", "comment": "Malware payload", "value": "b9205ed32a4c4db3f41002ace006c259", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120490, "uuid": "0faf2199-abc3-45e7-97cf-9bab4d7c4da9", "comment": "Malware payload", "value": "0cb339e3865ad38f005f54a27cf44fefd2c1a0f6a6ce1d11fae3cbba058bdfc0", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120490, "uuid": "e642003b-cda9-4bb2-a802-39256722968e", "comment": "Malware payload", "value": "2db759be5f1ebce103a07a5bb5bc4eb211270354", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120490, "uuid": "4a8dc95f-6f19-4c2b-b587-8cf4dc028997", "comment": "Malware payload", "value": "a57d3251480d0a6890b927829b2c0b88e6c738da0a9e1f33b35360dd972162e7980d2bbb6c33cb13489facba873a29e2", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120490, "uuid": "385b500d-3d72-4a6e-a274-d52452dbceb0", "value": "T1470174A9A3A80E7F44B38681CC759C0C98FACCB30E4EE09EDE733588C9251A61FC1644", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120490, "uuid": "c459603c-ed76-4771-89ef-00637aa03f61", "value": "12:nKeVJeVkeV35m0oA6b9lPGds981Eui6NxeV9VIz87KZIxKITASceV9VITeV9VUa1:K6J6k6Jm1AOYgcEmx6O40uKITfc64T6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120490, "uuid": "b7369649-02e9-4dc0-ab87-590f977ee04c", "value": 738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120490, "uuid": "fd11c6a1-f990-4c83-b0fa-9cb6d87198e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120490, "uuid": "c0d81a43-9d49-4d08-85dd-b2acfc51f25c", "value": "GCGXQQQU.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd3e3902-c3f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707118842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118842, "uuid": "561d610c-530b-44e8-8e26-9b3491400317", "comment": "Malware payload (Adware.Generic)", "value": "528e7141869861ec3da7c094de54e224", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118842, "uuid": "2a52e41c-e790-4566-806c-d465d7b55c89", "comment": "Malware payload (Adware.Generic)", "value": "0d8975a53ce7f4ad061991650e5106fa16508beaa72d32e62fa4f3bd0d86006f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118842, "uuid": "25c90aee-d275-4069-bdec-5b31d42639e3", "comment": "Malware payload (Adware.Generic)", "value": "997d65e27f27ff7ffb00cfcce96058496e992825", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118842, "uuid": "7cbb44bd-122a-4c85-a0a3-788b04678dd1", "comment": "Malware payload (Adware.Generic)", "value": "e3baa0b185f8f2e07bba076f92b754ac3074e28796f408e019eb6eefadd18ac8d66963cf66f5382b4d0c09d42aa3a71b", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118842, "uuid": "2129a523-f5e6-4e19-bb19-1a587bfcd9ce", "value": "T19A673337F225B93EC82912324172D22005BB7F1A64164C5E6BE42D0DFB7F1912EBEE59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118842, "uuid": "afeca95b-2859-42ee-9476-8de26f552a61", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118842, "uuid": "74010ae9-6b0f-45a7-981a-014a32552cb6", "value": "786432:ZzbBqYCYV23hu8qvSI79IOKho3tP4o1AAAQWVk3xy15:hbBqF8dvSI79IOKS3tPRAAAQdy15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707118842, "uuid": "7156a139-e399-484c-a849-01ddf1f10d7d", "value": 31651736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707118842, "uuid": "d2dae56d-ed2e-4aab-b4be-22c28c8f31f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118842, "uuid": "2fbf62b9-24d5-462e-9ad8-833f09fd2cf2", "value": "SecuriteInfo.com.Program.Unwanted.5387.22420.32496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8115ba9-c432-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707143234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143234, "uuid": "62c1ac26-8919-4f57-81e7-0c85fef3e897", "comment": "Malware payload (AgentTesla)", "value": "7347ed302adfab36c6ee639dfe5d145d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143234, "uuid": "45cc4f01-34c2-4558-adeb-0cd57d2cb75e", "comment": "Malware payload (AgentTesla)", "value": "0dbf864fc16ec8630c340ac40b750c0225e1169fbb911f678a1b3c2bff1b1e8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143234, "uuid": "6e6fe03a-a49a-485e-87db-97b4f0c91787", "comment": "Malware payload (AgentTesla)", "value": "849f8dc47a0584f62cfc9348e53cfc782389e206", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143234, "uuid": "57958679-463b-4a0f-8c1b-b408e5198e55", "comment": "Malware payload (AgentTesla)", "value": "98be753ebd0aeda8bec10d6865eb62b51263c5a70868272b698ec5e915fbf666c9e35de932bad18708c0c68e628ded3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r02", "colour": "#754C06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143234, "uuid": "61e6e237-0e39-444d-a3ca-6d88316e22b5", "value": "T18082E1C52A75DC9F04895CEC5049F24F22E4AD8EC6225A183FF5F8581C9B629BA364E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143234, "uuid": "e29cb43d-a8b2-48ae-ab83-cafdf52081c2", "value": "384:oMetxSe7rX+hp4/9u9Kn/gpGqu/63xFwFOLKkj7ZlIDPPoA:oMeue7rX+X9oY4qt/pj7jgoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143234, "uuid": "45a18283-ed8c-4a25-a982-6ab037a393a8", "value": 17686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143234, "uuid": "e30b0f29-8dd3-4a4b-bc37-aabd6a41ace1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143234, "uuid": "8eeb9e34-7901-409e-807e-619a3a9afbd0", "value": "nxF3n_de_cotizaciones_________xls.r02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d50376-c445-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707151224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707151224, "uuid": "d47954b7-0f93-404b-bf2d-baedebf29638", "comment": "Malware payload (AgentTesla)", "value": "dd431704c8c32ddff67d9ae830fdedef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707151224, "uuid": "8845ea0f-4216-45f9-a244-5303f7eb054a", "comment": "Malware payload (AgentTesla)", "value": "0e1c77e4b230515368f3da9e4c79de3b2d8d0a8d9597b03e05995a3cb41f5ef2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707151224, "uuid": "6e93a644-868f-476e-aa88-110d4d8acd22", "comment": "Malware payload (AgentTesla)", "value": "4e7462fb037c5904e94f44f4e09251238d808944", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707151224, "uuid": "5ae587cf-d6fb-4114-b9e7-1f778d7c9021", "comment": "Malware payload (AgentTesla)", "value": "360b495755286f1dd220cb5d3962166e1aa460f81b408a12f093db64cf59b4298fb6eaf5ebe66e17fb7c2430a617ccfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707151224, "uuid": "0ab63b59-fa6e-4f37-b951-287070890a3c", "value": "T1CCE4F13F6B3EC014E57124F96A93D6D95AE45F41246DDF6BC2A13C52CABE782380E087", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707151224, "uuid": "07153251-2410-4547-b931-a383a3d975a4", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707151224, "uuid": "d524555a-b21e-4734-8842-6980b97637e1", "value": "12288:26Wq4aaE6KwyF5L0Y2D1PqLmSZQj3PKqngCmVtO:8thEVaPqLmSczn8VtO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707151224, "uuid": "d8a5d361-0cd6-4339-af4d-a63ce7d11c0d", "value": 670657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707151224, "uuid": "e6568195-3ed0-439a-9168-cda1e4c52810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707151224, "uuid": "ec9b71e9-3096-4ed8-9f25-3bbb71588adc", "value": "PO-38666 MAYOREO FERRETERO ATLAS SA DE CV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f824cfa2-c453-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1707157541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157541, "uuid": "7f8a0be8-d3b2-42c5-a22e-01b99af3342e", "comment": "Malware payload (zgRAT)", "value": "6416792070e7b43ed911608ee1e3b527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157541, "uuid": "4dbf0771-c6ec-4406-84e1-fb7934fc0c20", "comment": "Malware payload (zgRAT)", "value": "0e7db2246bd22d301a88bda71ad3f9f60455eeb9761e787ae9be5cbcda74c348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157541, "uuid": "d09576bd-d639-4261-b190-0c2f7f3eb4c7", "comment": "Malware payload (zgRAT)", "value": "a3d8e6c339ba9d0db1249f25374b3deb7b876979", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157541, "uuid": "f1ca79a7-7d34-45a9-8b36-e47f7c234166", "comment": "Malware payload (zgRAT)", "value": "896e306bab4072b8ab0b56bb0cc342e43077e5c234e756781801766789f6af51da2a64fa598dbed152b4a597f97480b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157541, "uuid": "dcd9d816-dd10-44a1-a0e9-18ee0f447cf4", "value": "T178568C0277918E53C63B1F32E493505043B5ED9B6F63E38B238262AD28733D95D5E29E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157541, "uuid": "2d7108c8-1a02-4b5d-8f55-cef999cb62aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157541, "uuid": "1933a24b-4128-4095-8b3d-21d95dbdc9c2", "value": "98304:Z9nO2MAlzxpHoHSUO6JncA5gjAKWofCfbFTP:Z9O2DWXqAKWICTlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707157541, "uuid": "7852355a-9a3c-486d-b8f6-c1b8b607fa7a", "value": 6095224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707157541, "uuid": "adeb3567-1812-44c6-8bc7-94dccdb5058a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157541, "uuid": "128c8be6-77de-4f8e-827d-5d0f37a0d83e", "value": "SecuriteInfo.com.Trojan.MSIL.zgRAT.Heur.12729.4854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d108d1cd-c432-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707143302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143302, "uuid": "a6ade7fd-4c8f-453d-acb1-e457bbb298f6", "comment": "Malware payload", "value": "e4e89ae4a6b6f283ced84b3eb74fc7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143302, "uuid": "5475b52d-35de-4125-b943-780cd7c264c5", "comment": "Malware payload", "value": "100ca608fb58f2d68cd968812182cbd5966b29d8c5c04ce15b4983d7f3e8e93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143302, "uuid": "3fe9d691-66cb-4d36-864e-0a1032edfca7", "comment": "Malware payload", "value": "2f8d2780459a5adc2c60d03edb24d9b462e831c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143302, "uuid": "a758b6be-aa91-4dd5-9d36-72aa9c5f3228", "comment": "Malware payload", "value": "999fb1aa011430c5358ece97ddce602e91132591d58257cf7c572cc64e2b3d1baa56321be276b5c0cd020c09e2d5bfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143302, "uuid": "75773e7f-b377-48c0-bb90-8015e194ea4b", "value": "T1BC863384F5849831D0BD9DF9347B2980EA3BEE2D4A8CB05B17CD8C7169D1EA06BF2157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143302, "uuid": "4c6e183b-4907-4f71-bd01-1e1e17f57fb3", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143302, "uuid": "2fecda35-0e31-4617-9148-3d811abaff62", "value": "196608:h/XEeTMrxDIE3lw3w6RzWhPbdO1jTvjmja1cPhK:p0ew92A6dWFbdSj5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143302, "uuid": "f2d8adc1-cdae-46f6-8d03-d4c66c03ffb0", "value": 8065216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143302, "uuid": "acd94647-5888-4537-96c8-d07b15ef9baa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143302, "uuid": "cab38b47-a010-4e1d-a7c8-b8a8acc8365f", "value": "SecuriteInfo.com.Trojan.Patched.7121.29797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c1910fd-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707122007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122007, "uuid": "9e3c3b56-328e-48ae-bc15-9dca6e6d8475", "comment": "Malware payload (Formbook)", "value": "71dae67433007cdf1f5103bc0ae46c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122007, "uuid": "aaedab97-5cd2-4b32-8ee3-e6f2653588ea", "comment": "Malware payload (Formbook)", "value": "10398d4c8575fd74a79384654cd23f1f5393dc704e11e0e2f4737f82c7794d3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122007, "uuid": "40ff7471-17ac-479f-ad9e-a8a78568cf82", "comment": "Malware payload (Formbook)", "value": "b982416ba0740558b4058ba280e1e0b74b3a311f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122007, "uuid": "90cc0234-1ac2-4886-9b95-87ef642694c3", "comment": "Malware payload (Formbook)", "value": "3a87d4f93be42bfaead9627725934584169292ab114aa560463e1267d804ac4119324c0d6c3cdf92e2e12ad34e9b143d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122007, "uuid": "4013a0a4-dd80-4f39-9d26-3b005fb6fd13", "value": "T1E5F4125A66486C23C66D09FDCC1550CE5774EF2DAE83E38B2CC271E926F27A5261A343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122007, "uuid": "39964b30-5b7c-47d9-a799-d630879d1e45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122007, "uuid": "d04ce656-1e22-446f-8009-88c0c1121aaf", "value": "12288:zVw9SCF1Oz4Uxe4jDDGtJ7LrY1i2gG7J/Og9VUC+he/H0AK7mnyyIpZoeOW7uji6:z69Zwx3/Gtto1iUl/OSVUo4mnyyIpiBZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122007, "uuid": "f68fca4c-1d3d-49d8-9186-015c4f04df58", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122007, "uuid": "077bd9a7-da77-49a9-9371-bd34dc4e9423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122007, "uuid": "3ac97a3b-7956-4a29-babd-d207934bcf5e", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126616c4-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121937, "uuid": "160a2d4b-eea5-488c-be74-76f24de86c38", "comment": "Malware payload (Formbook)", "value": "ac74a3f87bad050767f30365b4a55e16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121937, "uuid": "a06960ec-b256-4623-8ef7-f2321ba3bdce", "comment": "Malware payload (Formbook)", "value": "1289919af3b27e4d5af2d06e92b2f7b70b67f2d28405384456d22423544614af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121937, "uuid": "6648ef84-5e7f-4b64-ae16-8f7fef5bc0a8", "comment": "Malware payload (Formbook)", "value": "d7b0ece0ad9f3c68b9deb0eaefbf86ca02f5eb00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121937, "uuid": "f9e1cc97-9b65-4a7e-9596-83cdf828b95e", "comment": "Malware payload (Formbook)", "value": "3fe04734bdaf5fad01c6a10052e9daad264a38e2cd8320fa9c8a488dc940c71aae5180484b3c9914764e721c5f09255f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121937, "uuid": "f7005de2-34bc-4074-bac2-ed3dc5a6ea16", "value": "T1FD04AE32E641C031F2B201B5F6BD0B7B4D3E09353255A0AAE3E51AE16EA49A5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121937, "uuid": "84a81ed7-a3e8-46d1-9c5f-cd661083b0ff", "value": "3072:tmImE9JYp/evUk3hiEkCqJrVgj8OsIc1M0Rb799zoByKeLh8aC:t7AKhbtqJrVgr8vVPoByKeyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121937, "uuid": "ddad20ee-c238-4bba-97f6-39a512d7ff10", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121937, "uuid": "9b728a20-00d7-4f61-9017-dc0bcad2bee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121937, "uuid": "c670d276-5ded-47c3-8a60-1e21d25029c2", "value": "1289919af3b27e4d5af2d06e92b2f7b70b67f2d28405384456d22423544614af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959432ef-c431-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Expiro)", "timestamp": 1707142773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142773, "uuid": "cf26d4f6-98ff-48da-8fab-bfe4ae9a52c6", "comment": "Malware payload (Expiro)", "value": "a67ebc5e6a7f77041130a0735f9767c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142773, "uuid": "25be90af-8309-47a9-bb57-e7b0a86c26f0", "comment": "Malware payload (Expiro)", "value": "13d76deb6baee2c184c42b35471799f85adc6ce05db6f29323a8fbe2027a6c87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142773, "uuid": "386a1647-9719-46be-921d-c93472707d5e", "comment": "Malware payload (Expiro)", "value": "6db2c598dc1d63f42f935a09768d21a45121076b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142773, "uuid": "4955f787-2c60-4fbf-939c-63845aa1a1c2", "comment": "Malware payload (Expiro)", "value": "6ab7b04e8eee9021cbca5c7dc3c3dcdd8d7c2725c4698ef2833ba046203f4d489fd7edf33a8c925a4c49220e735ac534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Expiro", "colour": "#5054CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142773, "uuid": "90edd59c-c03e-41a1-af5e-a84fd81ed533", "value": "T1D97523803B0984F7D36F2E70F4AAE05187FCA6AA75F680174FAB4BDC51345C29B74A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142773, "uuid": "a282b5f4-467d-48fa-a025-ae77d1b1319a", "value": "a14fe147cbb35ac7afa52e2cceed81b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142773, "uuid": "7d740e92-17b7-4216-b60b-aca0e112d0c9", "value": "12288:awegeKznl5TXJR0j3p2pVUrrQuLoWTF23JVbd0UILzXSocmKdYNq6:5e7ozX0j52pMkuLoiSJVlIL29mhNq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142773, "uuid": "37023504-e5b3-4f38-b692-7ab5277c8b2b", "value": 1553408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142773, "uuid": "69262433-f281-4f95-956e-a9c02b481a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142773, "uuid": "2f7058ae-ed01-4ce9-929f-a2f20859702a", "value": "13d76deb6baee2c184c42b35471799f85adc6ce05db6f29323a8fbe2027a6c87", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23842007-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121966, "uuid": "5eb97a70-3c50-4a51-8020-deee05da4caa", "comment": "Malware payload (Formbook)", "value": "8c0c8506f9b46f2d9b0bdfc9b4fbe0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121966, "uuid": "9bc6c306-914c-4a2b-8ff6-f099c97a8954", "comment": "Malware payload (Formbook)", "value": "140e80069cdefc1d757704111b10f3ccd349f566584944ed04beef75b233644f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121966, "uuid": "3adc5f42-4e74-4f33-b09b-8e5869d7fdd2", "comment": "Malware payload (Formbook)", "value": "e41720e1a3d6e437a64053216f4e7aaeca1c5a3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121966, "uuid": "2e37f894-ddeb-450a-8830-d4d37957a8c0", "comment": "Malware payload (Formbook)", "value": "5e980cf2dabb15fb682938d6b69c3e1032bf81eb125e880e6f6fe1398f12093a21bf0f3bfd5c7769c8be4954400e6446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121966, "uuid": "ffa7a53c-1566-4e5c-80c2-5c7ea1373bfb", "value": "T1EED4F1F2B9408183F81B24BF553A5D5693D03D7A869C260E334CB62FE9B30E74D6265B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121966, "uuid": "b08453bb-5088-4404-9e40-eb4069d5385c", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121966, "uuid": "f80371c4-17a3-4c5c-a554-299ce9624a4d", "value": "12288:ghNMKBSfLJ0/7DYuhzQ2q1xkVClcwAQp3bEJu1vMcgt0s9A:ghaRfK7D10wCywAc3+u1vMcat6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121966, "uuid": "bb4bc44c-f959-4993-be5b-4bf6139f3fa2", "value": 646264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121966, "uuid": "863cc1c0-d31e-46bf-ae63-b2367d662e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121966, "uuid": "4f61e866-7b08-4737-8808-a30d8612cd98", "value": "CDGT003983765367VND--30983RDGHJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b6ff2c-c40b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707126340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126340, "uuid": "e96eee00-06af-440f-919c-8e753092dce0", "comment": "Malware payload (Stealc)", "value": "ec37b9184eb3457fff8057affeb6ffd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126340, "uuid": "7e36fcb7-d7f3-45b7-bfb7-f090d9d4c588", "comment": "Malware payload (Stealc)", "value": "152e23b6a0f48147c40ceef6fb08f9702ff4da2fee7fbea4afe5c7c6b2cd35b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126340, "uuid": "650b79ed-756e-40f0-aedc-510b10b5719e", "comment": "Malware payload (Stealc)", "value": "4c9c17d1874a44e9708976736620b75d033274de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126340, "uuid": "be27f46e-d587-4e41-b146-896b781a3e8b", "comment": "Malware payload (Stealc)", "value": "bdeea616c61b655ef4d244aaca2a383d427804bcac6dcc72f528b712b05af6eec7a3263c24a4895618a3775cd306aaee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126340, "uuid": "f6bbee02-07b2-4597-a79b-e56d0eae87e4", "value": "T1B6646B20A6E4B561C003F4334F7DE9EFA73A6512A7166DFA09C607B0BED1E986B35704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126340, "uuid": "16ee2446-09c2-4309-bf91-3a116022d6be", "value": "382a4d7b99200ee7e9686d1f1cde0258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126340, "uuid": "1e1b953e-cbd8-4e8b-b8c7-15b4fb8530f3", "value": "6144:tUMOLNJ5l10oVJ4C3CO2uWGcTATRsYQiANCpUxEJKWc+T5omu7Uk9NTeeqKuje/K:mxLt0K4C3CO2uWGcTATRsYQiANCpUsKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707126340, "uuid": "ec517d42-44f6-470a-b831-73ef00a8d800", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707126340, "uuid": "774d907a-16f6-4868-834a-4b03deeee9e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126340, "uuid": "a4107c5c-3ac9-4553-979c-09fa222bbb09", "value": "ec37b9184eb3457fff8057affeb6ffd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85218da-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144201, "uuid": "9bf1acf2-cf03-4291-bb86-fdba86f2335b", "comment": "Malware payload (AgentTesla)", "value": "6a433a249a1f429b3c83006e077139f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144201, "uuid": "7c4b1a6b-cd7a-4682-9c32-81210fca3b10", "comment": "Malware payload (AgentTesla)", "value": "156b52e0e48ed7200245061b2acdf546b19e137007a92786d6187525e89f65ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144201, "uuid": "898c5f65-cb5b-4c4a-b9be-beb07e4a003a", "comment": "Malware payload (AgentTesla)", "value": "a07dd4af126dcf0fc2f73cc0e9f07d4edfe041f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144201, "uuid": "72822407-d6d3-4fdb-98de-50f468e4efe9", "comment": "Malware payload (AgentTesla)", "value": "98331f381560821acb37bfea8beb998e69140b32a7c7e814d1c72da6002e7b2ece471e42c744f6eeb53f625915d240f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144201, "uuid": "2aa531e4-55d7-4d81-805a-3a10c4dfbb9e", "value": "T1E1D4E031A794922ECD480672FCA20774D67EEE5822E2C78F696C797D283336D42F21D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144201, "uuid": "3ca42057-3ea2-4084-8ac9-56e461a3ba35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144201, "uuid": "9f276c65-25c1-4b12-9290-862580d78271", "value": "12288:EdOkVFGgEDZWTXmSrou9mUnFn45FsmA4j74Rg/ge77s618zXpNo:nkP0YTXmuowmUFnosmA64Rgj7s618zXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144201, "uuid": "de79ebdc-22a3-4408-828e-f954162df6b3", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144201, "uuid": "7a34ab1e-784e-4922-8274-6eaf6be825cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144201, "uuid": "136f4ec7-8f18-4080-a1c0-d8568181162f", "value": "RFQ-P-19-0341\u2013REP\u2013T0002(MSE V17495).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b28514d-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121979, "uuid": "56bbdf49-b292-4066-961b-a20aa8fc8934", "comment": "Malware payload (AgentTesla)", "value": "7676e85beff5fd64f0915fdb4847f7a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121979, "uuid": "9279b03f-154d-47e1-9fda-d33593fb86e7", "comment": "Malware payload (AgentTesla)", "value": "15ca9c4f1fc178f2f528b1c6d677a77a93b8fe1130172137cf6a8d748eb66f65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121979, "uuid": "595c85a0-4429-4358-8c3d-df3253e98f27", "comment": "Malware payload (AgentTesla)", "value": "11a88d031bf353546abfa78b81a3a53e4c90c68e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121979, "uuid": "934f1566-125f-4575-bb17-fa9693a84520", "comment": "Malware payload (AgentTesla)", "value": "414e863dc15f609486449a8427520b5aef25f67e8c3881f09dfba71aa4c67dfe62cf61ec3e955859d467238492b339c3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121979, "uuid": "1b62ab19-2721-4f31-8645-e47d9475974f", "value": "T15D0501926158EF56D83A17F2C42248A923F66E6DF870E79B5CC53CC376B3B904624D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121979, "uuid": "ea5580f4-5770-4b94-9475-66687a249421", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121979, "uuid": "65d26f02-7673-4070-ade9-8cdae95ef443", "value": "24576:spGIr9cxjoMXfg2UCnpxCMsAqDYoxwBv:SGIrkomfkcFGYo6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121979, "uuid": "c85ded5e-94e1-4687-8448-ca6517bc66d3", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121979, "uuid": "e4125e92-1896-4aa3-851d-9bd18b92ce98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121979, "uuid": "a6543c51-dd47-4385-b031-31daf4f4259c", "value": "Image020224084713.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1873f7b5-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707141704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141704, "uuid": "76ec84a8-0093-4e8e-a033-6c1f5cb0e1e1", "comment": "Malware payload (AgentTesla)", "value": "8593822ffd7be6026d0001b634f2bbd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141704, "uuid": "2ad945a7-9d5e-40f6-9c6f-67887049a681", "comment": "Malware payload (AgentTesla)", "value": "16369b12a77a66c991f8d56e88acb2163fddc0209ef0eaea1079882688ebfb2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141704, "uuid": "9cc0fe40-1443-4149-97dd-c5a0d4accd9f", "comment": "Malware payload (AgentTesla)", "value": "678bc9d6782b191f71d408c85d795170d65214f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141704, "uuid": "2d4f741f-8b2a-47d8-ada1-0e269d2be012", "comment": "Malware payload (AgentTesla)", "value": "ecd76ca6d1663510609d51a9e179587d478a6eaa6cde06d3cb89eaf3fe0a93b4b841864945f99c229ecae388930c44f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141704, "uuid": "692510d8-7bfe-4ac9-9907-5922635ac557", "value": "T1A8F42366FDD92249279DEA10633D2C26E89707017FE70ED0B8BA5B6D0B0F776224D1E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141704, "uuid": "b1c007ef-1766-4db7-b810-f2d6f5ad4f0e", "value": "12288:IE9W4trYUMKRp9SQFTphYu7aaoHmTH7UTv1XGKSEdBLN90DZyDsZ:IEkKrYPK79SQNph2adHYTvF6WBb0DZyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141704, "uuid": "c7262c40-37a6-4e84-96c0-7638d40c9aea", "value": 772179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141704, "uuid": "69e5dfcd-1a54-41aa-84f4-af1e30a950bc", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141704, "uuid": "2115f02e-bd14-40a3-8e05-9d54e79f223f", "value": "nArrival Notice - S2304118292.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13386380-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121939, "uuid": "0d92ae3e-3096-4712-9e94-e9a0800e9cd8", "comment": "Malware payload", "value": "b85eec2193a7f0004da5c28dcddaf3e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121939, "uuid": "cfbae04e-4d85-4360-a96e-9366ba608349", "comment": "Malware payload", "value": "17179a1ce7a05e94c91e33ba3a68eff632170d89036bef3e9e7c7996ee53d08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121939, "uuid": "1fdcf54c-bc6a-4c75-af45-05b9abf5dba5", "comment": "Malware payload", "value": "4c02f298db367c558ca4a4a49c5655585fc5ec5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121939, "uuid": "915b48e7-bf69-4e2a-a1ec-082bc743ea07", "comment": "Malware payload", "value": "70c350bd86e44fd5bdfab59e766be3c70d0e3feb6fb844e27a8b2d2c026fc2fa79c9e7ad117b2c9ecbcbc3e0400cb1d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121939, "uuid": "b078fad8-7d0d-4d02-a263-2844537c75a1", "value": "T158345CA1F798C823E3C04FF0D164E37E8AB7A9645D22851356EB6D8FB768761782C311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121939, "uuid": "c1b1bac3-4886-4d64-9a0f-cf9f55d41c64", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121939, "uuid": "66c56553-a87b-4426-bcd2-c8d8fb1479a9", "value": "3072:6bG7N2kDMUpouGQbgSSu097BG0D6eMk1PowSR9issv/ZISbaQCFkcb:6bEQUHgp97BnXMk1P//KGalFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121939, "uuid": "ca12ac30-26fc-4162-990e-d10a06a05e9b", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121939, "uuid": "7944db3c-dcd8-4600-8a24-4af718b21675", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121939, "uuid": "165801e9-e2da-439c-bb44-a56a3b41c9b1", "value": "17179a1ce7a05e94c91e33ba3a68eff632170d89036bef3e9e7c7996ee53d08a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315e4cf4-c428-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707138740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138740, "uuid": "63a3bb9f-da29-4e00-9d14-e69560b9d2e6", "comment": "Malware payload (RiseProStealer)", "value": "73d4a083ed658d8f433a3637f5e3b915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138740, "uuid": "94e29431-19df-4a2c-914b-428d0c0a99f0", "comment": "Malware payload (RiseProStealer)", "value": "17352f835ec857660334f3af22655260bcd66ef65df21b9d1966b1305320dea9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138740, "uuid": "b129f5cf-802c-4ecf-bae8-6e4e72f64e51", "comment": "Malware payload (RiseProStealer)", "value": "6ce4181604d3d62ab1fb5ea9f8d63d422532aae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138740, "uuid": "551cb038-75ea-4842-9ba2-4b94f4618096", "comment": "Malware payload (RiseProStealer)", "value": "628ba630c538ee32b07ee4f3e7ec7f75ccd7cf166c5cefb2e8bf1c5fc4c81fb19543d87175d9ecbfc7b25a4047adea26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138740, "uuid": "5f5583f2-c9d5-4022-b203-c8ceb3aace5a", "value": "T136851200F151843BF8B315B7CDFF967E5A186A10072164DF27C8697A9B7EAE27A30253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138740, "uuid": "865fa02b-fb3b-4e66-8668-da010ece7caf", "value": "13cabf02ac946361a6c830226d28bc4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138740, "uuid": "52c54062-dabf-4b24-b719-e9a245674614", "value": "49152:VIC+xhKUAPr/Zs9fFpvl3gmIUnFy2vUFYkv:VIF7bMyBgmXFdvUFYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138740, "uuid": "34c92522-e30c-43ce-9cc0-1bafcacabe93", "value": 1705707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138740, "uuid": "afa135a7-4564-4c14-ac9d-7a1d681a0493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138740, "uuid": "5b8fc27c-4f76-4bbe-ad11-eca089eb1270", "value": "17352f835ec857660334f3af22655260bcd66ef65df21b9d1966b1305320dea9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd248c0-c474-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707171325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171325, "uuid": "e07860d9-e00f-4bb5-a4a4-cbb5e63c2f2c", "comment": "Malware payload", "value": "5ff39d9061a046162e110f707a1f5d26", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171325, "uuid": "c5f4b551-5d04-46a3-86dc-a4fee0de41a6", "comment": "Malware payload", "value": "177dac2794c4de7156031285457a39e7f2ac7f5743c71200dc12562d5ed8d83e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171325, "uuid": "50c55889-12fa-4ad1-89de-867264f60e3d", "comment": "Malware payload", "value": "f798ac5d1ba9ead0bfa95ef1b0feae8d91ebee98", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171325, "uuid": "d808a61f-5a80-454a-83c8-452e7cf20da1", "comment": "Malware payload", "value": "e55788b359dc3b461602b372137e20cfac101160f7c68f09f841c21b71e28682bcb6d62977c12e65c87bf91b467bfaaa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171325, "uuid": "a0fb2dbb-656e-47a2-acfe-cbbe660b7296", "value": "T12D2633B775A62D1567E34D2C69BA2C5047C1623DB1AEF031A1DFA3B37370AD80C95BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171325, "uuid": "418580a0-1a2d-4bec-b483-fce9a9a82868", "value": "98304:NGikhfZnbayPm/n9LvR5nLsAX9dWgxlfxBirtQEwH/zlQKwt:anbaymP9LvbsmAWl5B+vyxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707171325, "uuid": "2a2f30ee-e952-4e1d-8678-39dc415e7d68", "value": 4490308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707171325, "uuid": "8a50c361-1023-4329-9b55-9a4003f52536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171325, "uuid": "0310497f-ff2f-4a9c-8684-3cff90b94d4c", "value": "5ff39d9061a046162e110f707a1f5d26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250ec16a-c3e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707108654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108654, "uuid": "3882ac2e-5f74-472a-9d46-ebb9934c6fa9", "comment": "Malware payload (Gafgyt)", "value": "8fadb47a3dea982cf939870475148396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108654, "uuid": "ebcc3183-3c34-4264-90ca-263865998d0f", "comment": "Malware payload (Gafgyt)", "value": "178534f26ae058b8742948f217c011f7e42fcc210be0064dc917736239b5002f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108654, "uuid": "7365982f-978a-46a1-89ee-cbc9fc1f784a", "comment": "Malware payload (Gafgyt)", "value": "216a5043fbe6cad69414fcf2860eab414b360207", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108654, "uuid": "77761c05-567a-420c-978b-6f8e423779f6", "comment": "Malware payload (Gafgyt)", "value": "c73814fbac0e091f67cac1ba78cf7a1e66204286d610f714048c746d7890806c00b01fb5b3ed894169fdba6f94472a70", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108654, "uuid": "98b93d75-d446-4b03-ad4a-dd9edc7c7b98", "value": "T11E337CB7C82A6D94D24986B1B4248F741B53E244C2572FBF1696C2799043EFCFA0A3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108654, "uuid": "7cbda90c-615a-401e-8427-dc1efa626a72", "value": "768:1batwtqbZF0aqxUqwpdYGxv4QeCmpsKaoyvoaLoGj5CcNSJHfGW59aI:NatwtqD8RSdXfeUKaoyrsc5Cc1W5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707108654, "uuid": "30943938-dabf-4b38-bf43-f0b78013d7b3", "value": 54912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707108654, "uuid": "2de2dd02-6a11-44d9-9ebc-9144d001c218", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108654, "uuid": "69ff869f-1ced-4ca0-af42-678e85d44654", "value": "8fadb47a3dea982cf939870475148396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ed5768-c3f2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707115497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115497, "uuid": "25315ace-5753-4061-838b-4b80898c90a6", "comment": "Malware payload (AgentTesla)", "value": "ca7675a5493df18499d0a897eb9fb1f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115497, "uuid": "e9634fd6-143a-489a-86db-184d422e62c4", "comment": "Malware payload (AgentTesla)", "value": "18a28d815375c485b44c9ff8ffef19411083d9bee508e7c52d85ed4edcca5b12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115497, "uuid": "5e2e8e7a-fcd1-4573-9172-7b381a1063be", "comment": "Malware payload (AgentTesla)", "value": "d54da6f108eaaf2bfc693d25d02f3836029b9256", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115497, "uuid": "caed1b7a-2716-4f88-be4b-52f4b09fea0b", "comment": "Malware payload (AgentTesla)", "value": "086dcdcdf540cf5f4dca7ff3f2f1a6185c7ba3ab2a30d728165082cf0a149352ed1220ba122bde7a7bb36d6da5d4c24e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115497, "uuid": "fa800e73-407a-43b7-998a-8f7b18970315", "value": "T1B715128632EC9212D57F0BF6DA701642973B35B6A867D71C8D8560EB1E62BC0C607B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115497, "uuid": "d24834ad-ccf1-44a4-bab1-f7c87e8aa387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115497, "uuid": "41e97045-1033-4962-b621-293c747cc3df", "value": "12288:aMh/MJkD9c3hpKuiifhyTwkOVpJET2Bgjoy+//NBMtq3aOm7ImiKKiIk3HUMI3b:aJO9cx8uWCBMoy+zgq3Hm7NiK+k3+3b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115497, "uuid": "3a2dc2cb-5656-4fe7-bf01-3dd1ade5eb11", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115497, "uuid": "2a7d4d33-044a-4e6e-9ddf-9e5a9deeeedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115497, "uuid": "d342334f-ffd2-462e-8a36-d603e455edbd", "value": "BL draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68a279da-c40d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707127236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127236, "uuid": "2daf05e5-daff-4e1a-ab28-e329931a9a21", "comment": "Malware payload (Socks5Systemz)", "value": "5106a05e4a9595ffb603ae2486a5bd04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127236, "uuid": "8d842ee6-bcd1-41bc-b3a9-ebc0ad6c4c77", "comment": "Malware payload (Socks5Systemz)", "value": "19421d02842cab9f7dce5184053c17ecf65b1e3140f51b729c15734a754de979", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127236, "uuid": "65ec55aa-e5eb-490a-bca7-a2dfc5607f4d", "comment": "Malware payload (Socks5Systemz)", "value": "ff64146243a2bf4c40b5d9a4207ed1c1a45bc42c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127236, "uuid": "61f23481-cb5f-4fb6-8fe8-8b5d4c5e898c", "comment": "Malware payload (Socks5Systemz)", "value": "dfcb9bfdd578f689124f34aaa7ba30796bd3c65784ef507f0f947e70123a944c5d6f69c2892d2c2354fa60e232549a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127236, "uuid": "049c9702-c405-4068-8a25-776b61fb0cd5", "value": "T1D1545B4396D1BC54DD264A73DE2EC6E8BA1EB560DE1A777A3218AE2F04B0172D173331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127236, "uuid": "23a92b8d-e443-4aad-9f3e-3514ce2b5464", "value": "6ccd4bc2d35613d37d4776250d7c29da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127236, "uuid": "ebe1451b-4fd5-4041-9af1-e7f266e8d5fc", "value": "6144:PwfL+Mwyd3H9scA0xRHPAiO/IttRYkM+:4fqMNdzH5PA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707127236, "uuid": "1ff66c32-31e0-4542-93fc-6a3ec155f7d3", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707127236, "uuid": "9a5ca8c2-3d0c-4abc-ba01-d4b52e4c04b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127236, "uuid": "b8a30258-52be-4cac-af0e-652ce4afa999", "value": "5106a05e4a9595ffb603ae2486a5bd04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297d526d-c417-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707131425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131425, "uuid": "7c50d6dd-2df5-4825-93c5-c75415ef346a", "comment": "Malware payload (Socks5Systemz)", "value": "9df4007d210772fc229eefea7f15c06d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131425, "uuid": "7fd963e9-14b4-4f24-8063-91f089f9623f", "comment": "Malware payload (Socks5Systemz)", "value": "1a04a01ff9144cee276994c8a5beda3ebacbc4846afb13b8a700212c1092ef14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131425, "uuid": "1e7a94b6-e94f-4ac2-b52d-4aa896d9ab11", "comment": "Malware payload (Socks5Systemz)", "value": "021ae6bce912d6a3fe9435a307eac6b85eb18865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131425, "uuid": "195b694a-4f39-42bb-a639-2f714dd3cdd2", "comment": "Malware payload (Socks5Systemz)", "value": "970584697e31f454c7817c42ba41e50fac75ae71122fbc491d93df54761bff87cbae8143ac66afccde57b7486b90e87d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131425, "uuid": "6bb4d881-0de9-4156-99e6-b70f01fb5f2f", "value": "T159546C4396D1BD50DD268A73CD2EC6E8BA2EF560DE59777A2218AF1F04B0071D173B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131425, "uuid": "edc2ca86-de2c-41fa-acd3-46cf742d3f36", "value": "6ccd4bc2d35613d37d4776250d7c29da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131425, "uuid": "48e810eb-5c51-4988-b4f7-2a2f33991386", "value": "6144:cwwL+ceqk8AFIYODCl9diUGQHzu3jmtRYEM+:rwqcG8U9O49drgjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707131425, "uuid": "44e7e061-8052-4ba0-8a51-5189a55f82dc", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707131425, "uuid": "2aa487a2-4a28-4b86-9307-a847798a81e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131425, "uuid": "6665d36e-69ef-4797-8823-d042fd4c972e", "value": "9df4007d210772fc229eefea7f15c06d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44988507-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094534, "uuid": "262c0c2e-4ea9-4595-beeb-9db8c6a94015", "comment": "Malware payload (Mirai)", "value": "c2dc6b1307e4daa36d5f553d8602143d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094534, "uuid": "a24d3fd2-a4fe-4b5f-b3e5-bee6a9a2b23f", "comment": "Malware payload (Mirai)", "value": "1b10c33534bcafa3170bdff4f9a3926ee56cdd96dfd3b34ff0b62ce785b6bfda", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094534, "uuid": "1eba49dd-6e6f-4b0f-8371-a37868faa31d", "comment": "Malware payload (Mirai)", "value": "de90c2cebd4e1410a4a69ccb5e66be0a42571539", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094534, "uuid": "dc85febe-fb23-423d-8fcd-66d6d53a0448", "comment": "Malware payload (Mirai)", "value": "85a8d0f01a1ccb71976fa13fe319f239d620df9d1a3513700412c96af278d80d293b192e60ced44317f0fcc74bb50b36", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094534, "uuid": "6dcafc2c-2b65-44e1-bdb6-30d8c276ca15", "value": "T155436BC4F643D8F5EC8715702077FB379B72E1E622A8D643D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094534, "uuid": "aaf88a1b-6ecb-4b26-964f-e3e5e050cdd5", "value": "1536:JeESt/basV2rcZhG6ySN7na/tad1zWOIaEjrqMVs:JeESt/basVTgS7na/QdttXESe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094534, "uuid": "53c1d3c7-1c11-4941-b6a2-9b2fc31cab77", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094534, "uuid": "baa71a69-3088-423d-b49e-76dcb792fdf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094534, "uuid": "abb1c21a-7f20-40c1-b2ae-d2ac1f12e2bd", "value": "x86-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40b2196-c3f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707117967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117967, "uuid": "d754e186-e4e1-4a1c-87c7-89f019299f58", "comment": "Malware payload", "value": "d5447f3ebd70c125eac361338c846c88", "object_relation": "md5", "Tag": [ { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117967, "uuid": "71767471-519c-4130-aad1-daf6e4fb4a9b", "comment": "Malware payload", "value": "1c3e1926a3cffe59c4004b71a4904d69b71bfb3b1c3c76bde9a382a573afcf27", "object_relation": "sha256", "Tag": [ { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117967, "uuid": "3501f573-7296-48e6-8640-d7cb026ac099", "comment": "Malware payload", "value": "83525859a8d5fcfb664bc56ff10d9e8e82baef3d", "object_relation": "sha1", "Tag": [ { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117967, "uuid": "087cadba-2694-45ca-890f-c9a14505c1aa", "comment": "Malware payload", "value": "5fcdb19077d79939cb857e8ddaed4176303d955bbceec72d77cbfd9cf98c134942104b60d1e3451c199aa1d89b174642", "object_relation": "sha3-384", "Tag": [ { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117967, "uuid": "036774a6-dc9c-4d7d-a710-1ff47bffc2c8", "value": "T1CC71DD0693E84267F0B60734AEB347562BB0F8909F738B6A59C4421D7DB16241E75BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117967, "uuid": "90f18776-f210-40ec-a878-a7e820a19895", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117967, "uuid": "63616910-56b8-4552-9e9d-7a920cfe53dc", "value": "48:6H/zxbGQLXK1tgu0OVgJY57ob1ulQa3sq:gJH8R5uK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707117967, "uuid": "16487641-0837-406d-8782-6287dba5ad8d", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707117967, "uuid": "688f8f81-2783-48b7-bd73-44de8ff0e8e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117967, "uuid": "cd1cb049-beff-4e3f-ab40-cf7e7fd877b8", "value": "4rarfccs.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d627536-c448-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707152423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152423, "uuid": "259638f3-89fe-490b-a176-1e6ea3e2a5cd", "comment": "Malware payload (Stealc)", "value": "ed1d287d865e7ad2e988325dfd30724e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152423, "uuid": "d52d3f14-f78b-40f0-9649-251963cd5c22", "comment": "Malware payload (Stealc)", "value": "1cca1e0d2b37b64a068d0d15e53668368011a3809655f40be84034852f4cbbb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152423, "uuid": "2b2afd15-9b46-4dbd-bd45-b8d7c5255981", "comment": "Malware payload (Stealc)", "value": "56e5d28c6b01c9421dc1688aad757df9e6c453d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152423, "uuid": "a39934fb-c6a5-4482-bd14-5284bef4b56e", "comment": "Malware payload (Stealc)", "value": "37db12dad8e8a5b6f39ec651e51ef6048f805b75fd032b370e31e172112e44fe04d13de0b5bc30a23f056d85ae744692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152423, "uuid": "2af493ad-a931-41f6-b24e-07e5c600e50b", "value": "T12D646C03D2A17D50E9674B768E2FC6F8762EF9618E19B76A2218EF1F14F01B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152423, "uuid": "a568c38a-66ca-41c7-9bed-453c5bbfbc18", "value": "6c815e5443ebb604e0afa8caac565931", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152423, "uuid": "cc3009e2-5785-44ce-831f-38da14c4bfef", "value": "3072:E9EULdewjgDGeVshplGpAfrBI1y/JKmJJkf1opUdJXf0WX3jE5ZoxG6+B:MbLtgppAjBfDJCd1pQoxGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707152423, "uuid": "7fabbf99-3db1-4132-810a-0872786fbad9", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707152423, "uuid": "57521d2a-05e5-4594-a041-f41601baec31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152423, "uuid": "a0993596-c8e0-4b0b-940d-3880ce8ea384", "value": "ed1d287d865e7ad2e988325dfd30724e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13fd9956-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121940, "uuid": "9fe0bfb1-8a69-4074-8ee4-38b7238acb31", "comment": "Malware payload (AgentTesla)", "value": "d1d2f64bda55547822e55dfd15ae1b3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121940, "uuid": "69aa90d7-c3ab-460a-a8f5-9aff18e31447", "comment": "Malware payload (AgentTesla)", "value": "1d1d933ba1432df605185af5aa5b7c962566d5a92bd55cacdf32fb84acb1b7f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121940, "uuid": "cbde80a0-8544-402e-bb0d-8332ed2cf378", "comment": "Malware payload (AgentTesla)", "value": "5abca9bde6c595a4a91eaff7ffcd9a2d62253916", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121940, "uuid": "c4664e17-286a-4dd5-b05b-ae2a8f0a9ce5", "comment": "Malware payload (AgentTesla)", "value": "194a2f66704ecdaaf61c32b3b00b861ae2c53b89166415b97c35a92a15a4c9090d10b1b9d4f041b59a3e3ce2639881a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121940, "uuid": "a194d911-530c-419e-9bc3-b9cdf82ec257", "value": "T18C34FE037E48EB15E1A97E3782EF6D2413B2B0C71733C60B6F499BA618516825C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121940, "uuid": "456c8d22-93f0-4bca-b474-dc9df7260551", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121940, "uuid": "e9a9f2b8-8526-4258-8626-90462d149108", "value": "3072:plScUaQZVUznA/bmTNai6Cwl+l9nxw55Anz8f0:plScHQZVUznmbG0Vl+l9nCYzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121940, "uuid": "277e6c7f-c0cd-4db9-97ed-83ace4354c53", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121940, "uuid": "639c67a9-98ba-4802-ad05-0a7a6e8be464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121940, "uuid": "7c23408b-2b5a-4013-bbf1-e51d98afc353", "value": "1d1d933ba1432df605185af5aa5b7c962566d5a92bd55cacdf32fb84acb1b7f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc47908f-c3cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707099996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099996, "uuid": "1d97d868-d6b6-4ecf-8ff4-043d74aafb1c", "comment": "Malware payload", "value": "de66c82c039f65e81fc787ed6f055a9b", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099996, "uuid": "6575b6a9-068d-4c5d-a11d-b2d740a84da9", "comment": "Malware payload", "value": "1d60712286972a48b34428d6d8c318baa0e5db59908a1d84bd88de4fe92689e5", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099996, "uuid": "def0550c-eb9a-4bb5-913f-c25930f9d947", "comment": "Malware payload", "value": "d3a35c2c0695dfcbbabdd13248181a185e267fd6", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099996, "uuid": "6f5ddd3f-8874-40d1-8ef1-eb144f4d9a22", "comment": "Malware payload", "value": "5652b847be3d150747142f2df3ab88640126ef178c62c03a575967e72317fbcd1165602ffcd142e8ace8445c7068262c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099996, "uuid": "193aafa5-760b-48f3-be73-38d382fa10c3", "value": "T170B633D216A78D02261BD5D53A82734DE7F7B3A4F4EEA03D19C507B0759A103C6E8F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099996, "uuid": "33777658-5037-4ebe-82d0-99f1487c3b0f", "value": "196608:hlPwRIaKrWpITokHOtvODhO1wAnXjg6fURbZFoynisKaYUtYB+giL72:3oDKrW2TopOIVn3faIyniDaBtYwLLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707099996, "uuid": "24cb990c-bc7a-49b6-a4aa-0af996952928", "value": 11084354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707099996, "uuid": "3a111d31-f338-4b85-860d-d35369dab1d1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099996, "uuid": "18a9ed9c-8f8b-4d3f-9f05-8e8475ca076d", "value": "Everlasting_setup_file.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7c438d-c415-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707130843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130843, "uuid": "73aaa31b-c43e-4186-8ae9-ca43150eeb5c", "comment": "Malware payload (Stealc)", "value": "c4580e8db0c3dbc88891842fd8a31158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130843, "uuid": "ae7bff1e-0190-4112-a907-b8d279ae694e", "comment": "Malware payload (Stealc)", "value": "1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130843, "uuid": "a05631c0-f9fa-4b7d-8789-00db67b08574", "comment": "Malware payload (Stealc)", "value": "744f03fcf10db1459d3f40beaea2bfe1b000582b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130843, "uuid": "772f5ab0-702d-4499-8f45-89e0c94be7d4", "comment": "Malware payload (Stealc)", "value": "ce6cd2b07fc65f51bc3181fb12cb3da1c46d35a4ac01a77e0ec3516fef257101828dc964f6facb8b8c6206e4345bb524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130843, "uuid": "2f403de0-e1f3-4d73-9d14-14c88d39a7ed", "value": "T1BD46EFB26967316EB18317B58DE236E5851EE7023FC212FD030AB1261C72BFD857295E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130843, "uuid": "f883e106-3b75-4cc1-bb95-f7a823ef4971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130843, "uuid": "990a082e-fc56-40b9-a3d8-c6f4b14259ce", "value": "98304:Fs9EI6sZJrf04Hr3VvPkrcRizJ6krK4JLQaEHlXU+vG9G1jMaZQRrkp:W+I6sU4HjZkwkVJo1+G1jMaZQpk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707130843, "uuid": "34ec7910-d515-4496-8bdc-5d21808052f0", "value": 5804544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707130843, "uuid": "6bded38f-75d6-48c2-a8bf-c05e3c040d3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130843, "uuid": "5da9937c-b6b3-4ffa-961d-a204a2d32806", "value": "c4580e8db0c3dbc88891842fd8a31158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f922c209-c430-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707142511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142511, "uuid": "1e1d60dc-e4b6-459c-a3aa-c5134eed7c58", "comment": "Malware payload (Formbook)", "value": "963c07fa57ed7ccb385b3bea6b317de2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142511, "uuid": "96dede84-bdc4-4457-96b0-fcf11cde5c99", "comment": "Malware payload (Formbook)", "value": "22113fd09b6b4784c8ae2f8448389458386c89f1100208f66055902998b3de02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142511, "uuid": "506a57f3-93a3-480e-a97d-d1501c5611b6", "comment": "Malware payload (Formbook)", "value": "a50cbfd8866f296e7e87f3960cb2d4d5850ac5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142511, "uuid": "5c8c85c9-cc8e-429c-8aea-63627b9070ab", "comment": "Malware payload (Formbook)", "value": "3eff125a040fc3a39f7ed59f697497b079d3143d4d9c42a265b5ef71b348e14a04634b6d708a81998be5ae583b2c9084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142511, "uuid": "c5998d38-5e9b-4223-beb2-5937dda89a33", "value": "T10F052240B9652B54C6BF1BFA4C99E002C7745063BD27FA5ACDC774D9E912F688B01B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142511, "uuid": "23a16128-888a-4ebd-b7f6-0b6b6528bc49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142511, "uuid": "8bf6e571-6a27-47cd-bd2c-0bde6c960b9c", "value": "24576:cV68yq0N4fh6RQlz5uhpoNTivRf3kwqbwUCJ79cx:cVsqCA6RQlNuhoGpf3kwqbwxJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142511, "uuid": "8efc5626-f2e7-4006-a4b2-f05862a7d74e", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142511, "uuid": "3243aa9b-a78a-4e5b-894e-97022eaed066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142511, "uuid": "b0d8416e-2a2a-4a42-9a4a-ed6004e61779", "value": "rFfwSCu1iQF6FMEc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2cf2bf-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111486, "uuid": "553f0549-c9f1-4469-a203-6dc4a8128d03", "comment": "Malware payload (Gafgyt)", "value": "f01c666894bc6cbb91b82d1a7146fb90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111486, "uuid": "c6f8f0c7-857b-45ad-a2f4-5513766aae7a", "comment": "Malware payload (Gafgyt)", "value": "23a7a8ecc834fa91321f04deee5f2320a6f37f41d37dc484c694350744aee71c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111486, "uuid": "c9987502-0bad-4dbd-8a57-ff37fd33223e", "comment": "Malware payload (Gafgyt)", "value": "db39c08926d3afd94fc60cbeb837c4517258848e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111486, "uuid": "e2586137-0f1f-4862-b99f-b9eba2417e4f", "comment": "Malware payload (Gafgyt)", "value": "8ea8c48728dd37578b56841984ba92eeb5923f8d82d0a750ebdbce62e2bb3780be7f63526d9b871359f0011d70b3a7d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111486, "uuid": "37aa4b9d-8dc6-4ea8-864b-38c62c482731", "value": "T1D6B31877A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111486, "uuid": "5423aace-ade5-4143-9f64-77718e1b5790", "value": "3072:MDVLSItJP+Xsp4JlN3HIjmH1cuEgvniuN/:MDV+ItJH2l3HIjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111486, "uuid": "227ef82d-f667-4f6f-a427-dcd97ec6a3a5", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111486, "uuid": "b70cd00b-e15a-4564-8a45-f43ade2b0e55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111486, "uuid": "364901b2-8732-40be-ba04-9d494bfd26ac", "value": "f01c666894bc6cbb91b82d1a7146fb90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14cfe792-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121941, "uuid": "92ba165f-5831-4f69-808c-b4d9661a2d94", "comment": "Malware payload (AgentTesla)", "value": "2e7a20060649f0eb1d1a6603b777605b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121941, "uuid": "4e532f81-469e-46eb-9f33-83e00e7380e2", "comment": "Malware payload (AgentTesla)", "value": "24c63430c734b2757ffc94a781ea84208b655d1fc07c56def4fab1808417429d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121941, "uuid": "9a992369-64b0-43d2-88a2-eee4c36b07bb", "comment": "Malware payload (AgentTesla)", "value": "8b6d229978954acf8b64aeb05740715da8723a1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121941, "uuid": "2142d86a-8a0e-417f-b976-c6e932d7de4b", "comment": "Malware payload (AgentTesla)", "value": "8c13423248ea0ca4df16021b1fdffd5d37520d63ee37863201a4bc72b5a61238acac9d132039a9baf68b03fe5fee71e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121941, "uuid": "77bf1d3c-c297-4dcf-8300-a22838214ac5", "value": "T1EB34FE037E88EB15E5A83E3782EF6C2413B2B4C70633C60B6F49AF6518516526D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121941, "uuid": "8bd06b49-ae4c-4253-a3b5-77566c01bf77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121941, "uuid": "2feed86d-2d43-4057-947b-f31638181a8a", "value": "3072:XmyuyGCeZ7fbQ4rJDVjGH+cAfrrzEY9Jo5M5oAgGfp:XmyuyGCeZ7fbdDjGecAfnzEYkAg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121941, "uuid": "d9c00382-24a6-494d-8aa1-31d3ab4c4a54", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121941, "uuid": "27dd214b-7c59-4948-bdbd-8fbbbe009102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121941, "uuid": "96f6f641-d30b-4dc5-8ffe-b5d0c8860b8c", "value": "24c63430c734b2757ffc94a781ea84208b655d1fc07c56def4fab1808417429d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f359c0-c40f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707128246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128246, "uuid": "9901e8f0-6648-43c4-aa24-20113186a0a1", "comment": "Malware payload (AgentTesla)", "value": "6b1dff59a593f5757d96775ca50e7205", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128246, "uuid": "a3b19bdf-7f32-457f-99e4-e3fb80bab5d4", "comment": "Malware payload (AgentTesla)", "value": "25241c7c866e6b65d14222f6519d6bbf9c1d964f1df81cd25f1ad2823fb0f440", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128246, "uuid": "f3de350e-7460-4d94-b817-197e5e841d3b", "comment": "Malware payload (AgentTesla)", "value": "6c2b75b917f868b9eeea4d3ea318539e202e39a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128246, "uuid": "f3c7c9a1-9910-4f66-b99e-2e25213ebbc7", "comment": "Malware payload (AgentTesla)", "value": "0f35f55835b5abc4d31b9117abc8eebd657fc8cb4fc308989a64ed8d86d332a146ae0aeb5eceeae33d154ba4bb3bdfb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128246, "uuid": "f3d10e1d-4d26-4490-95c9-c35f35c5561e", "value": "T1EE052288B5AC1B47C2BF0BF45651A11243789223D9B3FB19CCC778D9E9A2B944B01B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128246, "uuid": "122389da-abe3-4e3b-b2b6-0c0ff41601b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128246, "uuid": "75bfd1e6-72d3-4c71-aadd-b06b5d96d927", "value": "12288:0Wh868yq0Gg4ryx+6MnWFOdlgGujSegNvLForiBP4/hSr6jPNZ9LkD9c3h:0V68yq0N44wfgMeyLFo8Pd6RM9cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128246, "uuid": "4c23504e-1aaf-491a-a4b7-0254fb87ef5e", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128246, "uuid": "3d7e8923-52be-4e04-9b5c-cc12eec5876b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128246, "uuid": "84ae88b8-2957-4335-a5e0-3da7f4f45d43", "value": "Dekont_html.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcb9a00-c414-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707130228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130228, "uuid": "e98ff214-047c-46a0-8c9a-bdcfe4eb8525", "comment": "Malware payload (Stealc)", "value": "9c6ce24a5ff45b882abb5ccaca3cf63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130228, "uuid": "80ff7ef8-a9bd-4f10-8657-050cefbe197d", "comment": "Malware payload (Stealc)", "value": "254d94f6404f2c42199ce1c02c405c5ace05fa77cf197c688516a7c2fb61081d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130228, "uuid": "d06d7346-dcd0-4e71-b91d-48023c79d993", "comment": "Malware payload (Stealc)", "value": "5f3cafa1ca674e671849502b4f4b74b898a7702a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130228, "uuid": "1a1707cc-9811-4d45-bb97-05e1adfeaec1", "comment": "Malware payload (Stealc)", "value": "7266b0827158c551862308f13c6c0fd65a2d49e198b5fe3743878fd4d64292a0a5709aa6a4d0622c2e0f08576b211518", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130228, "uuid": "41ea3c05-b772-4ca4-9dd1-858765fa5d69", "value": "T1B7646B2066E4B561C003F4334F7DE8EFA73A6512AB166DFA09C607B0BED5E986B35704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130228, "uuid": "5286ff43-7fb0-47a1-a1ec-af67e1ac30cb", "value": "382a4d7b99200ee7e9686d1f1cde0258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130228, "uuid": "b86eaf85-bde2-4c6a-a4b1-8f1ba3bfffcd", "value": "6144:pvpHLJSJh10oVJ4C3CO2uWGcTATRsYQiANCpUxEJKWc+T5omu7Uk9NTeeqK5+06K:pBrJ80K4C3CO2uWGcTATRsYQiANCpUse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707130228, "uuid": "83100418-5359-4dbd-abb5-fe7eefd60986", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707130228, "uuid": "d50efbe1-867b-4ab6-abd2-b8dd733c9604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130228, "uuid": "0fa441a6-426e-4ef4-bbba-1ac8f5e8c15f", "value": "9c6ce24a5ff45b882abb5ccaca3cf63b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a473332-c443-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1707150512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150512, "uuid": "5275dcc5-0f7b-4ed7-9d93-8b7a36998c5b", "comment": "Malware payload (LummaStealer)", "value": "1995a54dba0e05d80903d3d210c1e3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150512, "uuid": "9a3fd620-42db-416f-a704-43e7af21e14a", "comment": "Malware payload (LummaStealer)", "value": "277d7f450268aeb4e7fe942f70a9df63aa429d703e9400370f0621a438e918bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150512, "uuid": "eb3f0ef5-52e8-40dd-8a8a-4c3cc02acab1", "comment": "Malware payload (LummaStealer)", "value": "c43316ddcb51e143ab53f996587c23ea4985f6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150512, "uuid": "e5f4a883-8654-4bce-89d2-328ba5e7dece", "comment": "Malware payload (LummaStealer)", "value": "3fb656a7f042514e1c4ec09edb522151ca9081ac05ecf8e410a124a019692f3e685a8fe9a9cf49557af3a60eb8998321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150512, "uuid": "432268cb-adc3-4636-ae51-4a959d2ee154", "value": "T11DF36B15B5D1C031E5770A3205F4D670AE3DBA302AA25AEF2B550BBE6F316C09724F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150512, "uuid": "1c324faa-8bdc-42ff-afcf-9ec1e06702c3", "value": "635c15b66e88a1fa7fca2c7e4ca14acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150512, "uuid": "d5626069-152f-4870-863b-64c7907b61fa", "value": "3072:7ZEsdw9MDdPyebt3JM0sknMIYIAsfJJ4MfehihzynMT0bLbF9OTwSG:1Esde4JfaIV/4KehQznLwSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707150512, "uuid": "5d94665e-6286-4bba-a971-135b46484ecf", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707150512, "uuid": "060d2a1e-72e1-4347-8eec-636bc5bbdb7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150512, "uuid": "e766248b-5821-4328-8d7a-c7552b74dd41", "value": "277d7f450268aeb4e7fe942f70a9df63aa429d703e9400370f0621a438e918bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87eda993-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1707144039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144039, "uuid": "6cdb7294-a6a7-41ff-bedb-87e465b77a8b", "comment": "Malware payload (STRRAT)", "value": "b11d5575a0e2ce232e779eb0d287c190", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144039, "uuid": "b5e7bb2a-2cd7-4379-a755-f99b720ff63f", "comment": "Malware payload (STRRAT)", "value": "28c5f3f967c94fa02ddbcabae45ee8d4908744503176d540463e84d8dfc76385", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144039, "uuid": "700411e0-8718-426a-b13a-a148a5a72d1d", "comment": "Malware payload (STRRAT)", "value": "834c8af930b52f32afc9ba87c53236b19f7675da", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144039, "uuid": "82e56d8d-e740-41c5-8eb7-7dd2abb45e22", "comment": "Malware payload (STRRAT)", "value": "982e4df60acef96e69ab7f9c27d4c4556ae1b1fe83a57ed3ed79d614fce428ec4a1a8475e5dd46d573704a57d10405f5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144039, "uuid": "b759a296-bada-4251-9b73-22ebc3d1e56c", "value": "T1EEC3DF6E3AEAD1B2E123743265048132B61C0098E558E46F75FCD9871E3DC6D7762ACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144039, "uuid": "2d3fdc7b-1c66-45b0-bf4e-d2aed8e792cb", "value": "3072:NZwhKvKvdjDNlUCLAJylvpyEFPlKEf5SmDv:sFfNlHL2KvpHFPlKC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144039, "uuid": "5a5e47ea-bc41-4903-8df7-b592cd695225", "value": 129805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144039, "uuid": "7f31b9ef-ab4e-4fc3-9378-9d91d578fc74", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144039, "uuid": "5a845986-ce8f-4431-99ce-f1b9bd050578", "value": "0098203000.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1789a3d5-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121946, "uuid": "0a1420f4-bf40-4040-8f5e-2c8cd9f7a202", "comment": "Malware payload (Formbook)", "value": "a0bce9b502f012415d609b26cd3d8527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121946, "uuid": "162ca332-4131-4943-b4a7-d0b1e270f2c1", "comment": "Malware payload (Formbook)", "value": "29868ca3320f3847355fda298c9bd5930631d54e234b26f4fbba95956567b3d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121946, "uuid": "b39ae1a1-766b-4256-8cf1-6eea5b840359", "comment": "Malware payload (Formbook)", "value": "c8af591964eaa8b46490e2dd7f71114324694b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121946, "uuid": "d1b241ac-15e1-4088-bbf6-a6fc89a0032c", "comment": "Malware payload (Formbook)", "value": "cd0b24c8d39c6b1389407fd80c9c788c9f3cbdae8ec6437371fab574adb7794a1811c14f78c361cfa131d81bf81ac1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121946, "uuid": "af72026a-4e0b-44cc-8ecd-e0cdbdc36319", "value": "T1CEF4122473980A27C5AE4BB8CC7542DD47718F263E86E3CF2DC4709D95B2396AB92707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121946, "uuid": "125da2ba-1d1d-4bd5-9e1e-4316735b0b80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121946, "uuid": "b3919bae-0af8-4d02-83a9-33c85191be95", "value": "12288:Eo29SCF1O9jsLsE0ohteVS5r16RF6USn4Qt/c:D29ZzLLhteRRzSnRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121946, "uuid": "a2060607-5c17-4800-b075-ef2a5588c336", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121946, "uuid": "f2e9e3b8-e4a5-43c6-83d0-a489dc2f9a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121946, "uuid": "d8a8b26e-988d-4d57-a0e4-18dd8ce2f2fd", "value": "46705XXXX6001_ChequeDeposit.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b298aa-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707094529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094529, "uuid": "fb705682-fe2c-4ff8-8254-e9518b11fce1", "comment": "Malware payload (Stealc)", "value": "ed6cc7a333a220b9ae5462894b49ff2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094529, "uuid": "9604a9a5-c8f8-4425-8570-cff15ca04804", "comment": "Malware payload (Stealc)", "value": "29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6ca601c1bb197f73a712", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094529, "uuid": "04001bcc-63ce-4593-9f30-1bd9cf5012a1", "comment": "Malware payload (Stealc)", "value": "f0612fed471943d529a61b1a2fb38867deb19439", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094529, "uuid": "a4b2c9fc-3286-416c-9094-8980a125dd51", "comment": "Malware payload (Stealc)", "value": "f45785b199b2ad60c6cfb893c65b172d4410c4e11d9e572e5913e3177c6ce787ad5c0ea6699b03fb495875803d3abfd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094529, "uuid": "09402af2-2983-407a-b024-f914386fb23d", "value": "T19454AE0067D0E431D15325358962C7B64A6B78627963AFBFFBD62B7B2E34390DA2430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094529, "uuid": "5588f1d5-85ca-41cd-aa50-3fc2781bdf3c", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094529, "uuid": "489485e9-0e0a-45dd-8f5c-5d46d14aa405", "value": "6144:94AzlTq8VH6iZMwSp/AwO025v3fsTkHd1s:94AzleYH6ISp/Awr21PsTk92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094529, "uuid": "b90eb6d0-1756-4d7a-b7b5-e3cb495bf5c1", "value": 293376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094529, "uuid": "d21aac2e-78b1-4ee8-8912-6fa1f9ea82f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094529, "uuid": "0c33d303-0ea8-4e71-972d-195ebf61e6a0", "value": "29fabd2edb0606ebd3c176c967d040fae12acb6f3b8d6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0707320-c3d5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707103331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707103331, "uuid": "670aaade-c99d-4f5d-a4f7-7f1f4dc2b78f", "comment": "Malware payload (Amadey)", "value": "74f5c7b65aa17fa191f8611ed1a156e6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707103331, "uuid": "fee1e93d-6370-45bc-8f23-cbbca72b95f0", "comment": "Malware payload (Amadey)", "value": "2a03f9dfaa3f1f2d8f17c4dbb46723d77439e6f3eeae78f1597ce78de8ade90a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707103331, "uuid": "4a239153-0ed5-4fe7-9879-f576974d14b4", "comment": "Malware payload (Amadey)", "value": "9a07533a8942ddb436c5348da445b5aa1187cbcc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707103331, "uuid": "b5c5d7b4-748f-4cd1-a282-2204c1ed6bf0", "comment": "Malware payload (Amadey)", "value": "fc87d4b22e611a48f12460e3e6620cf53fdbf81cf7000560ff6e73092c311aaeea8edbb5a2a3f57bbc775c85260b78e2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707103331, "uuid": "3d13d2ab-07fc-4768-be50-05a13e8117b4", "value": "T10AC533013037707CC84B283E4B5D2FBF8DD6A989B23B4F3769611F4A99AD6487750DA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707103331, "uuid": "affc58b5-eba7-449f-97e0-d083454e81af", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707103331, "uuid": "0c405d84-dd2d-452d-a613-5b4c81391ed0", "value": "49152:4W6VJ6z5a3VAuEJ5wKAcs4dMnlov2TfQVXAcT/LVn1:P6VYrzvbdMKv2T4VXAcTxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707103331, "uuid": "7952d2fd-4465-41d5-a858-fcde5d11ff96", "value": 2639360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707103331, "uuid": "aa943c3b-be37-4e41-907f-15d9b2d890eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707103331, "uuid": "6c30f983-18c8-4ef9-8eaf-4e8df2c803f0", "value": "SecuriteInfo.com.Win32.PWSX-gen.18465.17543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75990df-c427-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707138642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138642, "uuid": "61a0380c-10dd-45dd-bd37-633a735c2e6a", "comment": "Malware payload (RiseProStealer)", "value": "194ca9c99db91216075ecc9f80828395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138642, "uuid": "6272df7c-8ef7-4bd4-a746-55f424156700", "comment": "Malware payload (RiseProStealer)", "value": "2d2f656317223a5ecdfc5378e5db2b4268b08917903d3a6d03691943fdd96819", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138642, "uuid": "c56c09c2-0845-409a-913d-a21a36cdc5c4", "comment": "Malware payload (RiseProStealer)", "value": "173d798683d10e64286fae1f4c49608f5e706213", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138642, "uuid": "6fc71514-2c3f-4c49-92db-fa8acf1130a0", "comment": "Malware payload (RiseProStealer)", "value": "d340ee174bdc40c2eaff01c2fecdd9de19ef1634eda0dceb3a1b207a799697df8e49339d0269146ac5c80c419a12c600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138642, "uuid": "9558fbfa-a6f7-4661-b42f-5258b7fca566", "value": "T1BB66AD52B7958F53C62B1A32D497501443F2EC976B23E787368473AE29333C95E1E38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138642, "uuid": "693c5c0f-1633-46d7-b2b3-1e7e037a7e21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138642, "uuid": "735ca029-5870-4898-afdd-200b697da7be", "value": "98304:TQ273m5JxeeGfb6Y8znwaZVwZiQm525bFZTzFOW19aKIoWADMux0W:TQ273mEefYnmcid525vpNyAWAD3x5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138642, "uuid": "7247cd2a-3036-4f41-9dbf-8e848473a4d7", "value": 6916608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138642, "uuid": "85ccbf85-8a2e-4c2a-bb6b-f4a835928672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138642, "uuid": "b5042690-97da-4c95-83f8-26657e98a8c0", "value": "194ca9c99db91216075ecc9f80828395.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "692e2171-c414-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707130243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130243, "uuid": "81855518-2441-4068-a2c8-c10a31f798e5", "comment": "Malware payload (GuLoader)", "value": "eba98b0adf1a44c13c639dd03474e6a1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130243, "uuid": "caa2f69d-11f3-465a-96a9-caffadfa7a33", "comment": "Malware payload (GuLoader)", "value": "304a88c799c1bdba4964bb3dfd6e94da817fb2bbb844526c7a78916345c09a23", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130243, "uuid": "602baa42-e280-4a4a-90b5-13a379cdccc6", "comment": "Malware payload (GuLoader)", "value": "bdf6aadf40fc71532d392227a81f11f2cc1cc905", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130243, "uuid": "407816c0-972a-4512-a53b-ef0966b14ba4", "comment": "Malware payload (GuLoader)", "value": "6d603fd1e3d44c409f1a44d7bfeade73aad77329462bd65bc9e7ca9ae7905daacc086bc7579272b0993ad6a6ec561425", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130243, "uuid": "6d86c08c-3acd-4ff0-a6d9-4bd4c847fa8f", "value": "T1AC23B361DA95133A0D7BEEC4ACF0497DF1E9AF33510E136DBD88165D100689CA2AF23B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130243, "uuid": "db8c0389-00cb-4552-a293-ce40bb082522", "value": "768:4XfCvSiyvpqtEw2PEr8wcZRJX0WK6mWTT3M1a0wIRak:sTv8uccZzTnmusa0zak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707130243, "uuid": "42d63f55-3d81-4c53-aa0d-37a0a4f119b4", "value": 48342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707130243, "uuid": "80525ea8-fd31-46e0-a0be-672bc8b8c013", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130243, "uuid": "73fb5682-ca6d-47cc-8780-2791007c2e1b", "value": "Richiesta di citazione Progetto GR78558 240129.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd8c655-c431-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707142811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142811, "uuid": "b28ce372-a87c-4e1b-9069-6af5e0ca561f", "comment": "Malware payload (Smoke Loader)", "value": "83864af43140066684a26b419c8c04c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142811, "uuid": "c4a03de2-cae3-459b-aa0e-36cde231d2ed", "comment": "Malware payload (Smoke Loader)", "value": "30647636b3bff8dc2e7ffdd191cf3b75e43b1fc3d4793b7ed5edc8a9d512b54d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142811, "uuid": "71469209-5638-4450-b011-0da520c53a39", "comment": "Malware payload (Smoke Loader)", "value": "4ab83864e7bbf8cf8ba39b10a0cb93c396e69e84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142811, "uuid": "2dfd209f-9c98-4f3e-b045-34faf8f47bd3", "comment": "Malware payload (Smoke Loader)", "value": "2bccf671fd9135afac366785db319c3aaee2a77fe8739b6bbd431f714b1a085076a5ef5443638ae687038fd75f70e0d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142811, "uuid": "01d45256-7265-4a26-b72a-fd5146c40773", "value": "T1A704BF213AF2C072EAA785309A75C6B45AFF7C637BB1818F3744176E5D313918A2A353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142811, "uuid": "ce43632e-37d8-421c-8c11-ba9a2add2f8f", "value": "e1f06156624c8e8748c883d42e94f8bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142811, "uuid": "7ea21288-e7fd-4611-b294-2d328f5ca48f", "value": "3072:5fWLta7bijBKClAo9ibz+sD+WYBZIbd7/c5Ad8:gLtiG8oIHzYBZoFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142811, "uuid": "6613a80c-c1e9-495f-8c70-4bd096c66e84", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142811, "uuid": "d050f7f3-53f6-4888-8b49-72f6cac89da7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142811, "uuid": "9ff1fd7d-b408-4035-92a4-d196720a43b8", "value": "30647636b3bff8dc2e7ffdd191cf3b75e43b1fc3d4793b7ed5edc8a9d512b54d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f28c2c-c430-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707142502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142502, "uuid": "858617f0-e760-418c-bbd7-db91776e5b71", "comment": "Malware payload (Formbook)", "value": "3f6cf61db641a481003d5a609890eeb5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142502, "uuid": "614a937b-28ea-4616-93f4-9f256aed3641", "comment": "Malware payload (Formbook)", "value": "312929ef4ccb52ffaaac4ff12ca9211446283c5a09ea444bfb2d1c1af7b31151", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142502, "uuid": "7a550d4a-844a-4437-be14-3c612603c9f4", "comment": "Malware payload (Formbook)", "value": "e69794a943119d1ea42299078cfc4e4f01adb967", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142502, "uuid": "6bf26a3f-375d-4399-a6ea-88b867737ad8", "comment": "Malware payload (Formbook)", "value": "b1b1f3658582ae28c2ef29f8d6d1407dbf55172047f079c768912cfd507921d9a579bca50f41e752c3570511877d3fe1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142502, "uuid": "866d3e54-0a16-433c-8326-16bedc4479ae", "value": "T1C7F423A48077D8A898F3D48198A0C6B7219D1AFF285D5AF91BDEC4C1B6F0ED17285DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142502, "uuid": "05a00abf-12da-42c4-aa1f-b13deff4cb8d", "value": "12288:HTmPkY4bH5g5ZeR2Alhqz/hEpifzSzZfZBYsls2ccOYnK3iG+qb+kOV2K6TNI32S:zmPDqIZM6bhlfuzZffTs2cc03ixwOAZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142502, "uuid": "95008f97-b74b-4e82-a873-fb58a4aa966e", "value": 784897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142502, "uuid": "5bc8f7dc-dbe6-4743-a389-f2274157ec69", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142502, "uuid": "03ffbc2a-254b-4467-9e0f-aa3316ba06e0", "value": "nDHL Docs.pdf.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242ddfeb-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707120249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120249, "uuid": "2f9d8fb2-4002-400c-ab3c-f7331c02847c", "comment": "Malware payload (Formbook)", "value": "f6ba03826286e89b7daf8ae2541650a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120249, "uuid": "368f7ff3-15db-4aa6-b4dd-0fdd44bc5efb", "comment": "Malware payload (Formbook)", "value": "324b3ad2c4b951638dbcbc37275a86ed94325e1a9e5a528826aeb2172d47d97e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120249, "uuid": "56f978be-f3a5-4d8c-a281-7b1834de77eb", "comment": "Malware payload (Formbook)", "value": "73f54931531a22e10a27c739f74bd96a4e8b883c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120249, "uuid": "cc59439f-cfdc-4e6c-8657-892f3a0b8350", "comment": "Malware payload (Formbook)", "value": "c091d2a26524cd944e7009341d00d928caa8cb7a5a5ad748491bec0898b202a6f62a24df378dde9742d6974ea9802196", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120249, "uuid": "2bbf7944-bf11-4bb1-bc1e-993682b12cb6", "value": "T19305129436E9AE5FCA6A06F0D184680137BD699461C3DBEA8CE4B1F689D33D6CD0314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120249, "uuid": "796fac5d-ddd3-40c6-b242-318c4f86a5c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120249, "uuid": "35eb87dd-69c8-46ff-a46f-13eaba6dac03", "value": "12288:qaakD9c3hOKuiifhyMNcvclTv9gkRFy35x9vAWS4SeEUoyTYdXg67TsN+u/dCVwu:P9cx5MmuvC35bvHmEbTY1I+u/HxI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120249, "uuid": "3a4e03ac-ad96-4d96-a5b4-6b12263cdedb", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120249, "uuid": "79646d9d-024f-49ac-9dc3-7179f2bb6b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120249, "uuid": "367166b3-5bf8-4638-a582-2d1f720e1529", "value": "Zaplata,jpeg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1598d0bc-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121943, "uuid": "64f8863a-c53d-4153-8492-5c4ed9a6c981", "comment": "Malware payload (AgentTesla)", "value": "13ee73e67cd02b7ba6b44dd4c43307ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121943, "uuid": "cf0b43ce-de30-43aa-902b-2c92b931b678", "comment": "Malware payload (AgentTesla)", "value": "328dfae489d4cccc3c6bd00eb4bf87351ddeea9b3a0e064e8f88059c449b1657", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121943, "uuid": "a8c4febf-9804-48c0-8c1e-d0aa906c8389", "comment": "Malware payload (AgentTesla)", "value": "d9d8ecf9a6892b683f67def89c85ed61f2037344", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121943, "uuid": "d219d252-1a38-4c52-a5bb-47b8a939d8f8", "comment": "Malware payload (AgentTesla)", "value": "01db5138718e8fb6516aa38923c559e5344b63061b789a7f53ebb1d11997277381d2f4b147ed23d09549987f86eb2096", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121943, "uuid": "6c996baa-a735-4208-a8a2-e40cf78fc320", "value": "T1E2340E037E48EB15E5A83D3782EF6C2413B2B4C71733C60B6F49AB6518516826D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121943, "uuid": "6f1060f6-e066-4c66-9046-e4d2ebd56e30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121943, "uuid": "dc3db16c-2ccf-4660-ba76-bbdf9866f27f", "value": "6144:mSqUI84UVMIYsTbj/INicF8YDXv83R8t:gUI84UOIYsTb0rZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121943, "uuid": "973eaade-eddb-42aa-bac9-ef9169f099e6", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121943, "uuid": "7e8481a2-127f-4a06-ae49-1aa0369cb3fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121943, "uuid": "1a320f70-6b83-463a-8faa-e85bf6d4296e", "value": "328dfae489d4cccc3c6bd00eb4bf87351ddeea9b3a0e064e8f88059c449b1657", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e66e9138-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707128735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128735, "uuid": "2f812296-1d0a-4d4d-9aac-00d278707676", "comment": "Malware payload (PureLogStealer)", "value": "370c09bf58037dbbc84bba4e1ec38d7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128735, "uuid": "7f5b5d50-d33c-4336-9f1c-19d7dda05edb", "comment": "Malware payload (PureLogStealer)", "value": "3298664374264a54bf1478c665c3d1bd92042a7bd41c60c8374ac88a9e5c9123", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128735, "uuid": "a3135d50-4dac-4d1b-8ccc-e1029a7e36d0", "comment": "Malware payload (PureLogStealer)", "value": "1d535bbd0cd27a647cff1c49347da6f212e0e0f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128735, "uuid": "e5b90e95-2fbe-41c6-b621-cbc66d6228d0", "comment": "Malware payload (PureLogStealer)", "value": "bc942b7d3d402a033b64ebfa2b2740f2d8b616c68db63903baa09d96c24eb1fbd4fdc0b4c5c245417d3d7b8eaefe475a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128735, "uuid": "f5f2dd3a-c566-4105-b66b-321993ea7b57", "value": "T1F322723977FC4626F9BA0B318CB1025576E9BFA5EDA0C74FD099010F4D22AD01DA1B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128735, "uuid": "1bccf623-445a-4747-bbc4-718dd93ddb2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128735, "uuid": "9803de4b-e0ac-485d-8f93-7cae3f747870", "value": "96:/2f9VtieiJRbsU1Hnl+wC2ZP4vO1zV7p0U08Tde3bCz/kXmGBzNt:WIe8Rx+QP4kJ7k85YWz/k2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128735, "uuid": "fb8b953c-5ef4-4bc1-a73e-8b3d439f7c67", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128735, "uuid": "d553bc84-f25c-493b-9799-6826df05d390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128735, "uuid": "6f43f41a-4e85-4f41-a1c8-845ad04f69c8", "value": "Purchase _ Inquiry Rechnung_0103737.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87d9031-c41d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707134215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134215, "uuid": "10ee3c4a-8183-42c0-9669-77941ed7dd28", "comment": "Malware payload (Formbook)", "value": "550bbb41b416d8dd95f97508ef27a032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134215, "uuid": "98b26ca6-a3e2-4194-b2fe-115535f20191", "comment": "Malware payload (Formbook)", "value": "335e5608a5d0a6ca0e2b36a8ab5a3d1405780221b40c85d8e64a004ddc125a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134215, "uuid": "b974d536-e4a6-4c33-8e24-c22f7797ed7d", "comment": "Malware payload (Formbook)", "value": "c7cdda6894edf4a3ce73d7623b2a9f9919d8a963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134215, "uuid": "0a2632f0-47a1-4473-b9db-6200feccbb1a", "comment": "Malware payload (Formbook)", "value": "a6990b1aadbb489d7d9f6673fd7210a9d9e70f39317a85239745ef286b6e5a2660f4d23c00a7c029058e645775259f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134215, "uuid": "1b940959-1f3c-405b-b2e3-930ef9977790", "value": "T16D84231631D04877EB879BB2296B623BF33E9C58929D7FD34B00BD6312716E6062F251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134215, "uuid": "50c9cb3f-dd27-4af7-8d09-0b179f741847", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134215, "uuid": "44601b4a-a9a6-4f4e-9aaf-752a4b936ea1", "value": "6144:P8LxBhqK5QpzL8BQIUtskhfLWmqE730wS0P4MWlX37O66JJCkAb/fMH5UJm1lwDj:RKaL8IbzWWunlnyCFDfFcsDd02ak7UG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134215, "uuid": "63eba0b0-b751-4515-9c08-d708365a96f5", "value": 405685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134215, "uuid": "afdd292a-15eb-4673-947a-58af7ce173cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134215, "uuid": "3e60d22f-7cad-46c2-a7f1-4d2ffc39b382", "value": "RFQ 8168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b7d359-c41d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707134187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134187, "uuid": "db12e0b5-7192-426a-a5c3-f1b9859e9e46", "comment": "Malware payload (GuLoader)", "value": "c06783f062aa19a36d2a1dda9350672d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134187, "uuid": "be88294c-031a-426a-b70d-c7630fc9d26b", "comment": "Malware payload (GuLoader)", "value": "3371587a2fb2b6f7e515392941a6bf429391fc5b57f7aa0a10a7bada662497bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134187, "uuid": "21c0f185-2b86-48e8-b5c4-2f855941d3db", "comment": "Malware payload (GuLoader)", "value": "88388ef661ae5e1843d4b836b25b1f56619f1381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134187, "uuid": "8d1bcbff-aa37-4edd-9b4e-8a190923b1c3", "comment": "Malware payload (GuLoader)", "value": "5c1f8f341a3e03ddc51f1dcf2fb9155481332665a08d33b862af68574355c1869977d6b640b53d0f2b92731400b1e981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134187, "uuid": "1fd9642d-d2b3-440b-abd2-306bffc48978", "value": "T1BFD4F1F2B940C046F82F20BF547A9D5693E43D7959DC160E324CB76EEAB30E30866A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134187, "uuid": "cf05aeab-927e-4a30-a0e4-f9450a01e0c5", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134187, "uuid": "2fdaf853-d441-42d5-bfad-96170489a545", "value": "12288:khNMKBSfLJ0/AbMESGZa50IxGIrWyiAg9pbjB:khaRfKAbMEzZaK+Pib9lB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134187, "uuid": "e1111d35-98e9-4a33-a642-8462075e55a5", "value": 615632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134187, "uuid": "7c187e0b-d259-478f-8177-6bc7a6e1d222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134187, "uuid": "faa875bb-0b73-4e02-b1a1-68a17b8fb8ec", "value": "Purchase Order PA056223.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdd92075-c41c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707133848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133848, "uuid": "192f9d5f-50a0-4652-b2e4-cc48af27124a", "comment": "Malware payload (AgentTesla)", "value": "107ba13f9aea32a53905a5602560843c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133848, "uuid": "791ff956-3572-436f-a675-f35991150e2c", "comment": "Malware payload (AgentTesla)", "value": "346a9410b7d654bad7e5cd015da8e8b4b96444581963a881b9cd88184437c045", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133848, "uuid": "2a265e33-105e-4bc8-bdfb-80ddce84ec38", "comment": "Malware payload (AgentTesla)", "value": "74b917fa8e15b343cee795b168151ffc258e4711", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133848, "uuid": "ba866a80-9b4e-4271-a72d-6dc36834bad7", "comment": "Malware payload (AgentTesla)", "value": "2c931b86a66aaa6ce10bdd886e8dda564ea15a938342198c34c62d3dc239633b15912b655a5fad9ce27a6e2539649493", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133848, "uuid": "226c07e8-f5b5-45ae-891e-68c8d391c1de", "value": "T1D905125528AC3F9AD9BF4BFD6D8981029B349633A547F96E8DC638D9E813F140712B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133848, "uuid": "479aa742-cfb6-4436-a3b7-623616165b11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133848, "uuid": "7d144821-7825-4eee-9ecf-de5e3eeb3c96", "value": "24576:58V68yq0N4biozavco055fJ+5INWCn9cx:58VsqCY+vcnfJ4In", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707133848, "uuid": "c226d67d-23a5-46e5-b938-d358f44cb7b1", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707133848, "uuid": "540ea414-6403-4ad9-99c7-0d42c5d92e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133848, "uuid": "0f1be461-4a0e-4deb-a0d0-cb88b183ccd7", "value": "Arrival Notice - S2304118292..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ac182a-c411-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707129140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129140, "uuid": "3f83c093-68ff-47ea-bcfa-67d4872b986d", "comment": "Malware payload (GuLoader)", "value": "221ae3e9f67df2b64e80f6df397ecc4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129140, "uuid": "34deebc0-5ea2-405e-b1c9-5161c5373bf2", "comment": "Malware payload (GuLoader)", "value": "356fe04e7dcc147eb22503cbe5027dad910eef2c123a58e9c5a29b54aedb716c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129140, "uuid": "a3c0f192-a1e4-4c04-ac1d-532893f36e0b", "comment": "Malware payload (GuLoader)", "value": "63026efd32913e091410382a7199c64949fd398d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129140, "uuid": "3f79ccb8-d1ca-47ee-8635-1b2ed73afec1", "comment": "Malware payload (GuLoader)", "value": "8086ad3f40a3a2bdb8eb214d66969fcc8ea15e0dc11fae99215e22d0b19324e34f7908305be96f3389324ca00a61e81d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129140, "uuid": "30ad0ccd-779a-4c9a-a526-f9d92fe9f35c", "value": "T1AB0512817BA0840BC817527888D6CA712EB5AC24F7569F4B7710BF3F28756B19C1F68E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129140, "uuid": "d748f6b8-49d2-4e37-99cd-4f263d24fa5e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129140, "uuid": "6a5d03e2-e950-4093-b63a-ae61f0cfe568", "value": "12288:ObtcVtlrQI/abzC39aDGwNx8P5O8sY11DyxUQDGKKT2uPMZd/hl+fEVVt57Vb:Obmt5QoabWNaDtaP5N10UUqEl+fyjfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129140, "uuid": "52e909cd-eecc-4592-96c6-19a2e7176188", "value": 871360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129140, "uuid": "7469da6c-8a21-4e38-b6d8-67cb865606d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129140, "uuid": "92dd874a-0a0a-434c-9bee-df2dbc91582d", "value": "R #53091652.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f45b90-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707125413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125413, "uuid": "bf3222d8-8387-48d0-84ae-ac28ad118179", "comment": "Malware payload", "value": "1e72ee7b2f01cb4a68adeb708f932ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125413, "uuid": "8d425cf7-a98f-4388-b680-7c493cde061e", "comment": "Malware payload", "value": "361c5436043c2b04014934b719e0e8c2d44be1a901e0290f7d7ac1d64b6b9472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125413, "uuid": "12b81aeb-6174-49d6-ba01-93993458aef3", "comment": "Malware payload", "value": "f2d1602d6ab41d538a027a90447413fcdd3c9cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125413, "uuid": "e2d94377-7a94-4985-b5ca-5028c70b42ad", "comment": "Malware payload", "value": "4d04073bb6df501167ee89740f7c8ed71f4e1c3c9c83541f43157ba97cb04c590a2398f1c0d5e9aadf93c359ba18c51c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125413, "uuid": "eca4072c-050b-433c-b7f4-06e642749c8f", "value": "T144C6FB2CD901A727E2B7C17480DE0A17F1A2896AF2394F0E60DB5B5936476433E85FDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125413, "uuid": "bf07d1fd-767d-4e9f-9fd9-8dfc7221c9b4", "value": "6dbf27f4c70fe2c8ed3e0122ba75d641", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125413, "uuid": "890b15ec-0099-487e-be84-645c2362c31f", "value": "98304:A9k0ZZzXJDntBksKY+ND3WyA4+TLVei10vMzPv8/4C8B5XVS49Xzy83IiEcJMrCV:Ae03tnJ45/9iD54+V11bFv4za3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125413, "uuid": "1c38a4c2-79ff-4be8-800e-ea69147e93be", "value": 11534019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125413, "uuid": "bf85aa4a-3b21-41e2-b57a-410b25f1f920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125413, "uuid": "1a3ddc12-6f53-459e-a7c7-cf7a5f20c77b", "value": "SecuriteInfo.com.PUA.MSIL.Dllinject.24099.1644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8431e0-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094552, "uuid": "c5b2d667-9567-42da-85dd-3938d84a5f21", "comment": "Malware payload (Mirai)", "value": "fb711cfeb4367ea84dc377535556d3ec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094552, "uuid": "50ab2cd4-60fc-400f-b802-7eb64529a556", "comment": "Malware payload (Mirai)", "value": "37399ae28a2a1553d840e220aea37c8be251018434d304cd9d49a6833062376f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094552, "uuid": "f45cda7d-b3b5-4ffd-9383-08ed8034ff6e", "comment": "Malware payload (Mirai)", "value": "288f12a932952c7f1bfbfa8f0c4eb6caeb48a3e4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094552, "uuid": "bc1f7178-ae0b-4939-a933-07924dee539d", "comment": "Malware payload (Mirai)", "value": "a8097bbe54ec5cc5d5093e6addb8d559f19f72adafcd2686df49ee6d0a9940cdffcd3619878edc7a66faf18c811d1d7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094552, "uuid": "554839b5-69e9-40ae-a292-71b1ebd1d64b", "value": "T1D8632951BC819A13C6D1127BFA6E028D3B2613E8E3DF73179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094552, "uuid": "d364bf08-b0f4-4f12-9383-dcd50b891df3", "value": "1536:qNSlxYmii8N1U9uO//kWEjFjikg/QA83NRuxAvjWL:qNnK7kthjikg//29jK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094552, "uuid": "39da8535-a70f-4117-9ce8-e456925bcca9", "value": 66924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094552, "uuid": "1e2153e9-e1ad-4fa9-88a9-5fd5c7fa312a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094552, "uuid": "fd76ccda-93b5-45bc-94b2-d96ae2041975", "value": "arm-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf077a53-c433-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707143729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143729, "uuid": "908c5474-3f8b-428d-a7b3-7ebda4706c95", "comment": "Malware payload (RedLineStealer)", "value": "4ee60c6722bcce37fdd901bfbff058fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143729, "uuid": "5bc97561-6851-4e3f-836e-c1bc1ef4bf4e", "comment": "Malware payload (RedLineStealer)", "value": "3a134837e2603fb96e6096f6d804472de18bc8b78bc7264d766a02c363ebe8f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143729, "uuid": "77b200f9-a512-4a0b-86ca-ccfd23b3c727", "comment": "Malware payload (RedLineStealer)", "value": "b7579547eb1eb9d9520e4f367c42e1204dc9ad1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143729, "uuid": "9dc3fcb6-2369-4223-a449-4994741a821c", "comment": "Malware payload (RedLineStealer)", "value": "a9fa9f9239cf1065ba65c9f0a7d171dfc7ccc595948d39d2bb3b2b1e7304011c34fdbf676c9601990eedaaea66a3dae8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143729, "uuid": "07f03ba4-c97c-4523-bb6d-1b472b6ede33", "value": "T14EC533A76A35D010EBF9673C8ACBFCE0419D3BAA46D404121387F931B32756737968DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143729, "uuid": "e8bc2180-75e3-45e2-980b-5f8604e34b36", "value": "0980a5bdf7b225ee6a859c0ebee6a4b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143729, "uuid": "4c916e79-454b-4ff9-914e-286f1b32c11f", "value": "49152:jPfhe3bxwpBz5ZtYYnY50pu4hzRcjb2hjzCgWeIjWDu9aq3vKvq:ThZrLnYuu4hyjidzvWeof9awvGq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143729, "uuid": "bbe9b539-3995-4527-ad4d-c724585dd18f", "value": 2610688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143729, "uuid": "ea9233f2-1372-4b7d-a928-a5b08f732cd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143729, "uuid": "673c6d6a-8569-4f6a-a2d9-2be0bca060d5", "value": "4ee60c6722bcce37fdd901bfbff058fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd5e5f1-c3f1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1707115460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115460, "uuid": "11fbc02e-528d-4b71-bdf8-3cdd4811e7fc", "comment": "Malware payload (GCleaner)", "value": "f779e5ae1e645159dd8a32a97af250e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115460, "uuid": "420f429a-cbe1-4cf4-af4d-2d56121c49a9", "comment": "Malware payload (GCleaner)", "value": "3ae256bd9d09585de07c9d835987d4aa525de720609a85097e6190c72f78750c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115460, "uuid": "316884c3-531a-4899-8dca-262fbedc8dc0", "comment": "Malware payload (GCleaner)", "value": "23d3aad3c85b8e08effd95aa03cca72013888587", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115460, "uuid": "61ba455b-86ae-4b96-90c5-5346d78adf3f", "comment": "Malware payload (GCleaner)", "value": "729506863f088f98e40e533f0c00d00524e2f9caa14756a6c2d08f2ab9c54405614cd9bb0bc7a1dac345b45634b33417", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115460, "uuid": "802b08fa-d3df-422b-9931-2e0b7001cefe", "value": "T18874CE1063D4D035D1572A358A25C7B24A6B38667A635BBFBFD12A7F3F302D0DA29309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115460, "uuid": "946bf1e8-8ba5-4deb-a9f3-f0552c71529e", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115460, "uuid": "07d658eb-a605-45e6-b90a-b54d89a74aa9", "value": "6144:9sAMU+zT3fbjlFNvQF6ku76G8l2ng1UUCrlOvl3rirCxtmfN1s:9fMU+bfbpvQ676GE2ngyFi3rirItmfN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115460, "uuid": "8885a911-7ec9-4227-8f0a-2161841d9fc4", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115460, "uuid": "145eb21d-f5cc-4b2b-9cb4-88ac05a1381b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115460, "uuid": "4e0c1d09-9031-4735-9b0e-7fcb55bb2c65", "value": "f779e5ae1e645159dd8a32a97af250e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1656be52-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121944, "uuid": "5e05b9fd-d0c4-4c18-ba53-00412f0d5260", "comment": "Malware payload (Formbook)", "value": "526442c384589a56832965d6f187d4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121944, "uuid": "8615ec80-7266-4d37-b393-5e6bfc7915b2", "comment": "Malware payload (Formbook)", "value": "3b54bdf77855d975a3653b1c8c34fdba0c8a3d97853d3d4e1a62a1fc3be7b1bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121944, "uuid": "04cd338c-1bce-4b1b-9282-f53d515636af", "comment": "Malware payload (Formbook)", "value": "aec5e78058bd8b2aa2f9675ddeb5c85326e186c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121944, "uuid": "bada2e02-2ac7-481d-b91c-c6ffcd737c5a", "comment": "Malware payload (Formbook)", "value": "b33164c8f441d38976b82b6dd99d705a7c5a6d3f5397a18155ec62eee6d0246df6e21bf72720b47213f4d146c0fa3329", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121944, "uuid": "acae6ede-0907-4ffc-b987-c04c084528c0", "value": "T1A704AE36D602C070F2B215B5B66D1B7B883D0E357294A4EAA3E12AE05FE48D5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121944, "uuid": "643183f6-baad-404d-9254-46842ae97c08", "value": "3072:ih5MEfXo5Fwd38wi8kHaJ47Ixp00CABkW+ALRYpnz:ixFR8b8QaJ47ep0BGkW+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121944, "uuid": "29f3c638-c875-4d54-b949-81eadddc018d", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121944, "uuid": "8eaabb21-85cb-4a2f-8964-65c8155a6d52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121944, "uuid": "4090657c-b142-4238-bdc8-7c1b413efb1a", "value": "3b54bdf77855d975a3653b1c8c34fdba0c8a3d97853d3d4e1a62a1fc3be7b1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348fe7ea-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121995, "uuid": "9b4478ed-71d7-4a0d-8782-4658c8effc10", "comment": "Malware payload (AgentTesla)", "value": "cd7657049e05a846a1a54b4520b53bd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121995, "uuid": "d8e0d1dd-8185-4b92-abbf-cc02c47a1a54", "comment": "Malware payload (AgentTesla)", "value": "3c31946c3a2b8f892b5d6ead9bc61399c2990c280a6d6905dc45e3b4ac0f3f99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121995, "uuid": "aa4b9969-e821-4b42-9758-3acad1fc7345", "comment": "Malware payload (AgentTesla)", "value": "aa9463a0c182c007b17b67c85ed60a820a228894", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121995, "uuid": "cb5fb100-e25e-411a-8d98-26b777f4cfd4", "comment": "Malware payload (AgentTesla)", "value": "a99f4d097c851096552200023d1e771993548c24bc6d7e57ef74e7e9d6a02cecbe3156af010c37daa33b9ca4b24e43e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121995, "uuid": "1b6c59d8-db77-4102-9c62-4e35a3e43470", "value": "T17915129472F45B06D9BF4BF6E5350641437B366AB463E70C8D80A1CB7E92B918A07B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121995, "uuid": "49e2b345-5880-49d0-b776-d8480f450f16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121995, "uuid": "27e5002a-bdc7-4df1-b94c-22562b31e207", "value": "12288:Loh/FJkD9c3hUKuiifhyTwkOcEUs04I5cJjOjAuLYgMwrgyN4tl+SThujGeZHDQd:LiO9cxju6II5M+AhA4uST4jx1D2nHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121995, "uuid": "342bc6ed-1431-4c8b-9b60-9a40d4a30107", "value": 881664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121995, "uuid": "ac71feda-832d-4d93-8795-e2b39f93f687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121995, "uuid": "24e89c08-709e-498c-b1e0-0d7e27b1e413", "value": "Quotation Request MV Southern Sunset V.100392-Home_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d03e84e4-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707144160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144160, "uuid": "43e2593b-596d-4d9d-b30b-e6564a9f4d1b", "comment": "Malware payload (SnakeKeylogger)", "value": "7de27c39cde5845fd7174f3c4a985e88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144160, "uuid": "59ceb8e9-0cec-4e53-bc35-9d58193a4808", "comment": "Malware payload (SnakeKeylogger)", "value": "3ce21097dd06b2c3aa3d813c1663d3975be963f8bdca625bb11beee0bd4076bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144160, "uuid": "6a0c2829-a2b2-4aca-b543-5c71befd3f6d", "comment": "Malware payload (SnakeKeylogger)", "value": "81f8058f4100b48d480f6532da5cf5e2eb9f4300", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144160, "uuid": "622fd875-cc94-4a16-bc80-bcfe633f86c6", "comment": "Malware payload (SnakeKeylogger)", "value": "6d0bbc08f2a27fc3dfb64506c49d2b5cd1e0aec3786c6b3cf0c3d908f381904c0b8681ae9653479b34ada2b8e549f96b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144160, "uuid": "954372fa-d59a-4e83-9716-130e6d097ccb", "value": "T1E435AEC4B150A8DFDC6B49F2AC2A6C3020937EAD4569C10D559B7B1A7ABB343604FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144160, "uuid": "22a9b34e-a252-4c17-80a7-314afa1abd19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144160, "uuid": "e0cba408-4185-4e76-aa9d-297b26c022e6", "value": "12288:BnXriqWh868yq0Gg4rOanzlgQV/pLBsEClDTMJcd0OxG2BKkD9c3hDpWWtKvUzAv:BX+qV68yq0N4h/pNIRTMg82R9cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144160, "uuid": "67c9324f-c7ef-424d-83ac-19a2e3cd49f6", "value": 1083904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144160, "uuid": "16ce103d-c03b-4cae-b145-20d436206cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144160, "uuid": "45ebfb5a-f329-4f90-8ef0-a67ff72047da", "value": "VergiOdemesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a2808f7-c428-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707138781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138781, "uuid": "26fc41e7-8f6b-4c2b-93e0-17348dee1279", "comment": "Malware payload (AgentTesla)", "value": "bc6e57bb67aae0fd6518b7949aecd385", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138781, "uuid": "273e5d4c-d9d7-4065-9966-4fa0f7e11991", "comment": "Malware payload (AgentTesla)", "value": "3d6b9fc139589e7473ba609a4fb62df54086b5b2cc7c56e6c873042d22c8d16d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138781, "uuid": "55ec1757-bb4a-43db-b99f-9025011b7c0d", "comment": "Malware payload (AgentTesla)", "value": "60b86212e63193a0f68edde167e3225624de3562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138781, "uuid": "4f5cd2d7-4ab4-4a97-a120-b9938475df4e", "comment": "Malware payload (AgentTesla)", "value": "5adb26c76fc2d209b26117475e7e9672f70a69bd59182b20eb8238c6c3a2379d5eedc9b211e17897cf127b49c7fbd1e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138781, "uuid": "a51491b8-4b7a-4122-8484-db66290ad224", "value": "T12734C4D2D25501A9EEA84F359C771D2E16676F78A975F20D085CB0322FB33E201B9E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138781, "uuid": "73c16685-636b-447a-9340-9565afedafc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138781, "uuid": "fe644298-89a3-4404-8173-7187a211d420", "value": "1536:An3ZtwRuoeQK3NOKR8nYJL1TmIlulYvLnjNNokelsKJK6pWS6fWYQPPsTuH+fTLx:goeQK3/8YXfrrjXoVHKI9F8TZbhbYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138781, "uuid": "8ec9afe9-45d6-4679-a6c3-4b53877d3bc7", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138781, "uuid": "80b5f353-1bc7-4e96-af6a-03e1ebf0c337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138781, "uuid": "edaba5e3-6564-4751-ba41-23a81ab8e5c1", "value": "Nuovo ODA OF179_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff2f2e8-c430-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707142227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142227, "uuid": "c624f3f7-b454-47c6-be15-b22d93880c28", "comment": "Malware payload (Stealc)", "value": "6c7eb67a30f3c2a6b3a8689898abc568", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142227, "uuid": "00743b80-8d3f-411e-8447-0678303a1151", "comment": "Malware payload (Stealc)", "value": "3db4774fa27835aaa4c8236a9d12284aee79ea5608cbbf62a97b73bdc260d324", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142227, "uuid": "9016424a-1926-468d-a203-ea1aef9966e8", "comment": "Malware payload (Stealc)", "value": "ed0392486a722109c7f0b9f8f0fa473f3a006083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142227, "uuid": "8bf10f5d-7054-442e-b317-772c4b4dcb31", "comment": "Malware payload (Stealc)", "value": "d0030faa6d3fa307858d6cae3566cde1dc1457b41e341de0520a662f8b004c96f1500d02b7df5bb10bbbb04fc649df64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142227, "uuid": "af6397d3-df6e-4194-90c0-f94b37e1e45d", "value": "T1C0645B0392A1BC50DB574B728E2ECAF87A3EF5618E59776B2218EF1F14711B2C263711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142227, "uuid": "fc9743c9-fab3-4379-8e2f-5d344bd15b33", "value": "b585adb193cc73047fae4142a994b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142227, "uuid": "daa06b2f-073c-48e0-abe7-eead5c2544cf", "value": "3072:sOohLQKwbiEALFaJnj2DeYVlC2nx2+HyX3Tw53kceSfvaD3XA6+a:XuLeiEALFaljhSp4+kfSqD3XAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142227, "uuid": "77ac0a60-28d8-469d-baff-f1f419a09b24", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142227, "uuid": "4082780e-5d87-4018-9791-2ba875f0a2bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142227, "uuid": "5a85b000-932d-4194-8c58-ff2bf4de5c7a", "value": "6c7eb67a30f3c2a6b3a8689898abc568.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35228fb-c432-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707143306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143306, "uuid": "0b9bbafe-2bcb-4d3f-9c68-c5d88ee2140e", "comment": "Malware payload", "value": "b5bb6281c6ca47ed0702297380de7786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143306, "uuid": "0cfb33e4-3f04-4680-ba1e-ed858fd4085d", "comment": "Malware payload", "value": "3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143306, "uuid": "5c28d569-4f6f-4b6c-9292-e0ffd6849be7", "comment": "Malware payload", "value": "e7ac51f08b8dbe1307a95adf5b7cdb52db1adfad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143306, "uuid": "2d2ff4d4-8daa-4e2c-a8ec-80ab8e9ce6da", "comment": "Malware payload", "value": "61746bfd03a02f1361794c4b4d7d0d09ca1d9a576483a29ca9d39677392dc2c8d776e1e7b008d4d4ea0942cc3a18232d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143306, "uuid": "7b4a2031-e18d-47e2-815d-304b56cf7563", "value": "T1E8D613223EDD507AD47316328FEDB3B8A66FBEB06635025725903E3EBE717414918923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143306, "uuid": "0bc0a8df-e997-4102-8664-5e50aa79173f", "value": "0251e6664db616f9371719b21e982f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143306, "uuid": "cf793524-f462-40b7-8016-59c4be28de9e", "value": "196608:xwKQggItK4DBVcjTQMj8Bs33cPQ3gnnx00TADm/qUgtXeiq+Dncy4/z0ynFLOyoh:1Bdk9sRQZ9mgleiq+DrMz9F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143306, "uuid": "534050a3-ba18-431f-a452-1d67387a5bd7", "value": 13325768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143306, "uuid": "32638a42-adc3-4c91-bbaf-9d86b45f20ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143306, "uuid": "166c2221-40d7-49c1-8684-473e40bc2905", "value": "SecuriteInfo.com.Win32.Malware.KillAV.6KOMSE@gen.22946.22832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bca652-c428-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707138876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138876, "uuid": "e3104e7b-e2d2-48c7-9bce-e1f88b688a39", "comment": "Malware payload (Socks5Systemz)", "value": "e0e1f0c8d9c8980ce5699f1b3a58af71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138876, "uuid": "2ba4f503-5cfe-4882-a886-64b71a2c2224", "comment": "Malware payload (Socks5Systemz)", "value": "3f08d2c8287d6618e8ed9ce0bb83518a22b6cb0c39f55fd8c7d14273e79f95ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138876, "uuid": "78cc64f6-7c28-47e1-abd0-a1554d5bff9e", "comment": "Malware payload (Socks5Systemz)", "value": "ba6a7f378f66e7b1d04795fd12413476b7cd802e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138876, "uuid": "2f1502e0-22ce-45f4-b088-3daa6b8a24a6", "comment": "Malware payload (Socks5Systemz)", "value": "2bfb7823c7339f1e7223a75913aa684bee6927f3ba60569b68984a7a40edb336b2bf0331351cb5fac77052aa934638e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138876, "uuid": "f64f08ca-92d1-4b05-a422-09d1ed9826de", "value": "T1E7563366D5CF4CB4C9B7ECF36E952364961776022C9B60A874BCC6343D36407F6892A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138876, "uuid": "ab650e8a-4934-4a8b-9388-45411548d7d3", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138876, "uuid": "a327082e-3d79-470e-ba0a-ea75397c1665", "value": "98304:5iiy8ChG46DlseTM/L6+YHKkccFKHRwajP+KgZLeV8+Fpw2KmOThi/cykV:oN8ChwlseTQxYqT8KHTjGKghePzbO9iM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138876, "uuid": "bb5b1e3c-eac0-4b37-8ebe-f7e108d3a53b", "value": 6276769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138876, "uuid": "e6c1704b-deb8-4213-a606-f9962481082f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138876, "uuid": "a8cd84eb-fc4a-4e3e-b68d-64bc07e9998c", "value": "3f08d2c8287d6618e8ed9ce0bb83518a22b6cb0c39f55fd8c7d14273e79f95ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece021f4-c3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707107701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107701, "uuid": "398a438f-6bdc-4123-ae79-ad06a3d165cd", "comment": "Malware payload (Mirai)", "value": "f0ef3c6170c5c315a5e2a937809bde98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107701, "uuid": "ec235aa6-e97a-4ff2-9be6-41ef138f38d0", "comment": "Malware payload (Mirai)", "value": "3f8ef3cc521399c8c30707220e59ea365bcf7e02e281b342a707e5903b70dcc1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107701, "uuid": "59414645-8044-489d-a169-271b4e1c1d6f", "comment": "Malware payload (Mirai)", "value": "e798668df0dfb2bd1ecf125ded1746a2698af72f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107701, "uuid": "ba2c6af1-2ade-4d6e-a444-22b99beccd1f", "comment": "Malware payload (Mirai)", "value": "a67a4e111ee9f238b664e71e5beba0468f92b8ccbb4153dc13c7f9d92f51d43b346430b02ed2ce27fc84c077ceda1f3f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107701, "uuid": "6343c73b-6839-4ce2-9a7f-8a27d5cc34ab", "value": "T15C73D91A6E218FEDF76DC73147B78E21A39833D636E1D685E19CD5001E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107701, "uuid": "5bdded99-9640-440e-9a4f-b2405354fde0", "value": "1536:r1U9rDMaWvs8IwXE6xW+UW+qk+X8cjHwl8xJ5e773ZD:CxDdWvspwVjHwOfu3ZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707107701, "uuid": "c71869ac-6bc0-4b20-b281-7f3addcbf869", "value": 80608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707107701, "uuid": "57f65b28-5d7d-40f8-be77-9a6487fc9bc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107701, "uuid": "72d833e2-4b12-4801-87dd-40b6198f6b41", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceb195d-c41d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707134276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134276, "uuid": "6c9358f7-a7c4-41d1-a2e5-dea03808bb67", "comment": "Malware payload (Formbook)", "value": "1ebaf3b76099ba3304334f51f126f66f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134276, "uuid": "c627d8d5-70fe-4d4b-bbd6-f60f9be0d473", "comment": "Malware payload (Formbook)", "value": "419c9e8672e6e28770e4659653ccfd2ae85b480415708bdc1fb3af90589830ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134276, "uuid": "9f5af8f0-9e40-4132-aa0a-2e32d177cdd9", "comment": "Malware payload (Formbook)", "value": "716e931bb1fe85ee2a4b6dc14ecf1494ad8f203e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134276, "uuid": "f5512f27-acaa-48a0-b398-015183a2e1af", "comment": "Malware payload (Formbook)", "value": "bb5c3b2f0319e1acc1a376531085acaae6d3963c9452fb0db17da2665a1a26dfcbfe11d4d6ffa4bdaba498e35c63f0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134276, "uuid": "2ee4b3b0-e0d8-444a-abf0-84e177cbb625", "value": "T18DC402289A799F16F93C0FF610B4B951E3F222972506D7B95CD920C52BB3F250B44EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134276, "uuid": "6810f136-b934-4693-8ad9-1493274153b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134276, "uuid": "a861cf91-05e3-4c79-9ff1-a412b9baeec1", "value": "12288:w2Z+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:wTa6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134276, "uuid": "90ff62fb-27fa-4b5b-96f7-66b4ceb62672", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134276, "uuid": "38773f9d-8419-49d0-823c-8dc8b7610d83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134276, "uuid": "b99d6efb-4ec6-4014-a192-407295a42102", "value": "EFG Payment Note_0093746573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614ad919-c40f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707128083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128083, "uuid": "d3a6273b-cfbb-484b-9194-32a4dd66c08e", "comment": "Malware payload (RiseProStealer)", "value": "d08e21ef739bcb9d74508790a6e6238f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128083, "uuid": "7714c609-21bc-414d-88c1-b5e95fedc7dd", "comment": "Malware payload (RiseProStealer)", "value": "42c24e5ea82db961c718b4ec041202f85de3cdf6d35dd99d83a753f9a175945d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128083, "uuid": "fbb4164c-e0af-4713-a1c5-bd594aeafb07", "comment": "Malware payload (RiseProStealer)", "value": "74576503141f26edab05ce2da89b66cb3bcf293b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128083, "uuid": "1658662e-1deb-475c-9b4e-6c6f286ed1cc", "comment": "Malware payload (RiseProStealer)", "value": "9c201b030861a7cb456be98c62d54e4912c8b1287ecb8b9c25f847ed3085c63119f9c040183676fdf727454177dbed90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128083, "uuid": "ddf17498-a8c6-4b84-9d9a-bfed86c4a5e5", "value": "T137562347EB92F4DCD44171B85B22BCDC78F4A960011AF83ADCACB5C642B65A952BC3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128083, "uuid": "a0878713-e22e-411c-9993-8558b5b12c95", "value": "930dd563daeb0071b0a2e064c8e3b25f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128083, "uuid": "407f3ef3-e943-4fd2-a9b5-1078e1a225af", "value": "98304:eImo/NRpwP2DkKA+Ga5q73V41AmcR1Miq465iU7Fem+KOd8PbXLgKiOvG6ZB6Q3H:Xm0Rouq61i1U5Um+J+jkjEG6Zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128083, "uuid": "62a613c3-903a-49be-b4dd-b5e6eea8d195", "value": 5914112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128083, "uuid": "7a34a2f8-f57b-4cb4-86bd-ce5e5035d383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128083, "uuid": "f833346a-dd61-48d0-9f1a-12448bd20fc8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd69ae47-c3cd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707099998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099998, "uuid": "7e809d97-2769-4a47-a556-62a2096a1049", "comment": "Malware payload (AgentTesla)", "value": "8f2ab75550ddb60dba7c5860ec761974", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099998, "uuid": "7d8a04bd-e480-4378-b504-2ae4f95deee3", "comment": "Malware payload (AgentTesla)", "value": "4395c99fa35afdb0521c7ed730f6a66bf427955f145cdfd40cc5de6986f5acc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099998, "uuid": "d05a2ff0-e049-4797-8960-4672ac11f724", "comment": "Malware payload (AgentTesla)", "value": "9414b5c6b41f182f29b1bfea252f79f54482dd9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707099998, "uuid": "bc8bbd80-5ebc-4ddd-95e3-2106744fffc4", "comment": "Malware payload (AgentTesla)", "value": "3b120ef20c1835ba96ca9b5d26afebad392887a657441418fe291fb7301552d14855fdb9400e69cf99bb04a42cfc20db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099998, "uuid": "a23c1412-070d-4670-a20c-e6b4cfa0fd68", "value": "T11115228837E45616E9BF27F299740182937B7966B913E34C1D8060EE6C72BC1CA07B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099998, "uuid": "331d35bc-5de7-4ea4-815d-03c5810b4c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099998, "uuid": "4107fa02-f502-45e8-ac58-480f02e37704", "value": "12288:LOh/0JkD9c3hRKuiifhyTwkOa4xqbFQ2S8iGrlVdNRR7Cdq+3mNVdOe3xn/YuYVm:LjO9cxkua4r2PrVrCvDkwuYV7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707099998, "uuid": "f85826e0-2f36-47ec-950c-df2997cdd606", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707099998, "uuid": "bc42f433-5100-4ebf-aa64-0c7bfb36babd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707099998, "uuid": "92af65e8-07f6-49d7-8be4-ffa2f919a07a", "value": "SecuriteInfo.com.Win32.PWSX-gen.18909.19215", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fadde6a0-c3e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707111160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111160, "uuid": "2ba1944c-bef0-4208-8f23-062926178a7e", "comment": "Malware payload (PureLogStealer)", "value": "c227e22771466226949f8c53af85465c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111160, "uuid": "d74fed89-4d82-4f86-a14a-4d07c9315eed", "comment": "Malware payload (PureLogStealer)", "value": "440a17e8dbd0bfad5f1587fe8c758e9461106eb7b04235477d4b7cab156fcfbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111160, "uuid": "ec5e87c9-ac55-43c6-b590-0feb4d63fad1", "comment": "Malware payload (PureLogStealer)", "value": "725a95a7ef0a2b5cccaffe3d8bc1ff12190794d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111160, "uuid": "91b43c8f-415e-436e-9664-50c7e6b6dd69", "comment": "Malware payload (PureLogStealer)", "value": "b0761e4826e8ea8306c440703af5144c1aece89258b9c73ed6f44202cd1b03c46a37b0277727cfaed5138b02abe56f10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111160, "uuid": "d0698d8e-b238-4d99-b5e5-0b4d550e6ba3", "value": "T16F35237D93DEBD53C1FD097B84E6AB408B3441BBA71AF3DB19880AA45C437E60545783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111160, "uuid": "ae1821c5-5322-4748-b390-08489db16c34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111160, "uuid": "86e981f9-d325-48c0-b3a7-99afe7dbe1b3", "value": "24576:BdsWuS7fCW3x1gSoF8uEC+YMj9x+9Afg090reI5:BaWuS7fXxklWljtfO1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111160, "uuid": "b09e72e5-3854-49b2-b325-607a7dc7a724", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111160, "uuid": "05ded59b-2d87-4165-971c-b885be90e687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111160, "uuid": "560e684f-0a71-4ed9-8d70-8422cf96d6e0", "value": "c227e22771466226949f8c53af85465c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7037ff-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707142010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142010, "uuid": "952968cf-c166-439c-a46d-20ce807cce55", "comment": "Malware payload", "value": "fa80f72fc8e2be3eb320f259e2ace5d1", "object_relation": "md5", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142010, "uuid": "add1f132-4643-482b-ac1a-d7af7c9867b5", "comment": "Malware payload", "value": "4598c0da57964d4b655a32ef1fa3c77333aa4bb6ae64c884139e6d23ca20aaff", "object_relation": "sha256", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142010, "uuid": "8f02da00-a170-4b3a-82ff-353ee66955b4", "comment": "Malware payload", "value": "201e048e9e6e16de10d17db6a50877d4555fe47f", "object_relation": "sha1", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142010, "uuid": "54f51cbe-93b3-4006-89cd-06e694a56aa2", "comment": "Malware payload", "value": "d5fe9bba6ab209548876b1a868fc6bea2d6e3416c1ae436fb85572b7bc46fa5707168388a34e609bb36e35c16f648197", "object_relation": "sha3-384", "Tag": [ { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142010, "uuid": "919927d8-ecf5-4412-a3ca-59aa051f98ac", "value": "T1E7373322A2C7C221D56D0277F9ACFD0E0574FE77472041E773B87CAA59F58C1A2B8A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142010, "uuid": "cef1ff94-13da-43a9-be9c-d1534341be3e", "value": "393216:EtVGthUltn0e+57DRVKeWM/Mzckk4XNaJPQlbSqDO5hOhwk/ytS:EYhUJc/RV5WM/Mzc4XNaJPQlbPO/OhQt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142010, "uuid": "4bc4a07b-f0d4-47af-aa23-c02319d11ed7", "value": 23262720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142010, "uuid": "1ca3f3fd-45ed-4b12-8373-9971e82ec92b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142010, "uuid": "de963507-89cd-4500-8588-9cf910a5c664", "value": "Nf - Eletronica LTDA.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d459124-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707141927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141927, "uuid": "2339a4d8-b31e-40f3-9c06-e43018901349", "comment": "Malware payload (Stealc)", "value": "28b72e7425d6d224c060d3cf439c668c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141927, "uuid": "45008a84-04dd-47e2-99f1-14741865698d", "comment": "Malware payload (Stealc)", "value": "460ba492fbc3163b80bc40813d840e50feb84166db7a300392669afd21132d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141927, "uuid": "9b074ef1-47e7-421b-8088-9b75ca8e5423", "comment": "Malware payload (Stealc)", "value": "a0a14c90e32e1ffd82558f044c351ad785e4dcd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141927, "uuid": "7220cb6a-4d5f-466d-8161-bad3205a651a", "comment": "Malware payload (Stealc)", "value": "91aecf1db5790cc36ddbf88692885f4fcd9c3153fce00d6d1aed1cf5b333fdebaf952703f03705f7c93cfcd0659dea0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141927, "uuid": "a0b638fa-c2d6-40ef-9ee3-63244a820859", "value": "T1DAA5334DB5578F32E8B94972A5312BFB67BE8E7845D435187734B7C8387002B229FA42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141927, "uuid": "bf1c2288-6a8b-45ac-9587-7a4f3425a508", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141927, "uuid": "d2c00826-1902-4035-a303-99e551ff0e06", "value": "49152:ChrF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAuw:ChFdFWINS/NF9gpMR5oEfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141927, "uuid": "12dc9749-75f8-4eeb-8ab4-b819fbd34417", "value": 2123218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141927, "uuid": "e00d6182-db0d-49e2-9bef-7232ce98e622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141927, "uuid": "31636a5a-5b39-4341-9aea-70a62570df8f", "value": "28b72e7425d6d224c060d3cf439c668c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfa650e-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707128530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128530, "uuid": "622b52fa-b949-40e7-a14d-94b1c78e05b2", "comment": "Malware payload (AgentTesla)", "value": "bcfd6eec5416adcfefd6f78e3f1e0d4d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128530, "uuid": "44a69433-66cb-4cac-874b-f2a1256febcb", "comment": "Malware payload (AgentTesla)", "value": "461e04a7a51622bf0a4c8f44e7d00cffd1f761bb67c27fc6f43b410ee6c9377d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128530, "uuid": "85e0ab5e-7939-4a85-ae23-1fa0981f6b9a", "comment": "Malware payload (AgentTesla)", "value": "650e650aec302aae483644a2cea43a841ec87432", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128530, "uuid": "9d7d51e9-d0de-4ed8-90e8-191942ba5778", "comment": "Malware payload (AgentTesla)", "value": "3ac52b8d8e1e6ef29f1475a8f1332c46ea4b3fd855d94ebfbb21a1eaab1272f9ec00d53399768f1d2378b88540775368", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128530, "uuid": "00bcebb2-a54c-4ae4-845a-7482918e0403", "value": "T1CE25DF852AB44F15F53EA7F540351100E7717A6B782FEB4D8EC0A0FA1EBAB414E46B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128530, "uuid": "2219f6aa-8833-4300-ade4-afc18bbad301", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128530, "uuid": "9af1f339-4a84-4891-b862-3cccc0deeefb", "value": "12288:8mMyUol8d53rD22ee3EWGcxto+lYtKK/O/Y5oZV+W7SWESf4FjpxsfOLpP/P6dGf:3MyUo+rDsWtUd56EW7TYj3s2Lh/P6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128530, "uuid": "3b1b8c6f-27bb-4cec-8d6f-c65a9faa0f39", "value": 1038848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128530, "uuid": "c448a7de-a45b-4a2d-af26-3d73ecb9b36f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128530, "uuid": "6d041791-7f42-41e0-a307-70736dac66ac", "value": "RFQ_6356636.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabe4bf7-c416-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707131266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131266, "uuid": "6447a855-692f-484c-837c-1f87dbeb1a2e", "comment": "Malware payload (RemcosRAT)", "value": "8502c1a90d20a66129406c0948d29bb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131266, "uuid": "9007a0ab-01b4-4ab9-9d5b-f7ebea4984b8", "comment": "Malware payload (RemcosRAT)", "value": "4825130874211ed97c196e14606ba2e10e4924f4108c61d8b1b65c43d0a59d2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131266, "uuid": "842769c7-edfa-481a-bf33-71dbade5cbf6", "comment": "Malware payload (RemcosRAT)", "value": "2c0fbd79e02c797d2394e27e03db25d601336ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131266, "uuid": "fd59119d-709c-4f8a-860a-9fb088c5533b", "comment": "Malware payload (RemcosRAT)", "value": "2b735f7bb39b725a9f8fdab736ccbf424d7c556187f788439f5f20de72d9bd4e68b5e0b7bd5ee950d57708ed897b04e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131266, "uuid": "d6737b05-13d4-4407-a4a5-7d7c8d113ba5", "value": "T1853412A42F26EC55F1C460F45801E1F072DA1C7A1EA36A4D07E4BF57BCBE650BE96063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131266, "uuid": "a37dedec-9d35-46ab-8d33-d63fa9127cad", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131266, "uuid": "92f6d4be-b546-4303-ae7e-20d0f74697b3", "value": "6144:emvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j1:rvlX8i8RB5JvADGGnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707131266, "uuid": "d7b694fc-109e-4240-ac00-8a6faa88bd2d", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707131266, "uuid": "b13657e8-6cc6-412f-80b0-83ed1e88d50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131266, "uuid": "3d71e477-dbc5-43a2-a4b9-e3bac0579ebd", "value": "bTxe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2380ab-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1707144454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "f4a40b24-bf44-4573-85e8-0928c72bf2a9", "comment": "Malware payload (Fabookie)", "value": "8dc1f88ae1fcedeb3983c5f5c3d486b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "ecb54aae-9197-4b9b-8d75-8d35327494cf", "comment": "Malware payload (Fabookie)", "value": "4a15d91920a4da9a64935248c126fb60e8302198df8e5759da8129ac1841beca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "18790147-57c2-4f6f-812d-61530d61e12b", "comment": "Malware payload (Fabookie)", "value": "d40e67ba5558d90cb11eeca04d213322159336fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "c5b03094-3f7b-4aa7-a42f-2fbd257fcbe8", "comment": "Malware payload (Fabookie)", "value": "596b4bdb4a7d3f08de7cc3f526632c0690e8cce98f18c1b57075ad83fd628eaab6c136f3de62ffd69869914cef5b8a90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "4c09e0a3-3c66-4444-b03b-18a5467b41ca", "value": "T134F42B56FBBD4272E061C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "82eb4009-f586-4d01-a2e3-ab3aa8463a29", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "346ed628-e9d0-4ef9-80db-5b33035da189", "value": "6144:nA01Nd5uvxQWQSYYaE5CinBdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2EWf7xLUnw+V:ndo5QWJnnBIShtdGxTC2k5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144454, "uuid": "6e245837-3934-4efd-ad95-289c1819c2d3", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144454, "uuid": "027d20cb-4c2a-490d-8638-63a8b3c39d40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "9155d718-4170-4340-9b6b-eef95c9ee895", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf482f0b-c46a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707167324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167324, "uuid": "4baa4d7b-cb04-4da5-ae40-8c2868143cfd", "comment": "Malware payload (Socks5Systemz)", "value": "7b7297cd1771d6a30d7b0d0d4475e22c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167324, "uuid": "f01c1168-cbc6-4991-a0a1-d38191b9bcec", "comment": "Malware payload (Socks5Systemz)", "value": "4bb290bdbc196bd7da81f049b62eebbe7c2160b9f17766f14b4c1bfec4f0b3aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167324, "uuid": "e9340a46-085d-4062-aee0-b15f1e5139c1", "comment": "Malware payload (Socks5Systemz)", "value": "0aacf0ac31c8bb70953cd850bea8a36b946222d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167324, "uuid": "8f21cc42-776c-4f08-abfe-c8099d1807d7", "comment": "Malware payload (Socks5Systemz)", "value": "520c41743c245de54167bf6f3d38c7a023bec3825c5a87aaeda952b14634376a0768f0e42450cb853f16f1bdde4bb708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167324, "uuid": "4881bc13-d1a8-4ce6-8716-8fe50066eb9b", "value": "T13686336845C5237DC98FDC726C258301817A78AA1EEDC4E1B59A8F463F5E7B0305B3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167324, "uuid": "8176fcf9-c429-4bc2-8753-7964481e46da", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167324, "uuid": "7207ef5f-2660-45eb-b880-947fac41a387", "value": "196608:halWMdYDAlJ4Cxu0WVPdxHa3kG9wihtC6PmNy5uyXKI:1i8WNuPH0X9lJQy5ukKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707167324, "uuid": "dc1b6fb1-9ce8-4f82-9f97-ee97ec5daa35", "value": 7954718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707167324, "uuid": "a8a67e0f-9bef-4223-b680-81711b39e98d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167324, "uuid": "f740097b-2fc8-4f72-a4a6-d50d6f7409fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc50abad-c3b9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707091299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091299, "uuid": "aac462d0-9577-408f-be23-8b4216b9da3a", "comment": "Malware payload (RiseProStealer)", "value": "d78c1a6328d37bcf1224ce8657be5670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091299, "uuid": "84834b26-04e3-4bb4-a1bb-7d6b0db177f6", "comment": "Malware payload (RiseProStealer)", "value": "4c0569987796d3110811fc320ea039fd5bf826a5d149d5be8ce60f2917776c8c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091299, "uuid": "8f80900a-b106-4ba5-b62c-5364962d9bb9", "comment": "Malware payload (RiseProStealer)", "value": "c46fa47abf960d6c22ebaf8078a5e25b561e3401", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707091299, "uuid": "9a847237-9bc9-47c0-bd4e-f6c984a30b3f", "comment": "Malware payload (RiseProStealer)", "value": "c99117594cb95dc5c3259eec8e5b986196842b9347d12864587779c07bb426acdd6312b02e56cde6abc377fbdb276120", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091299, "uuid": "ab39534b-e5ae-4062-8805-07dbfcf92f84", "value": "T1D4B533D1B8BAE2E2D90B4738306EA089389FBD5755C21AA81835FB71CB7F3355741D82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091299, "uuid": "92b4783d-d1bf-41a4-9041-651559d946d7", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091299, "uuid": "e6775107-948a-4130-ba08-4c79d2d7dde9", "value": "49152:lhpJrNv/9AcsDm9wiBtUdsp+z9BEGHtDkUBgpZp:b3BPAm9wfzHE/U8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707091299, "uuid": "6d1b49ec-994f-48bf-97d0-f319923d11d6", "value": 2333696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707091299, "uuid": "7e375c8b-42c6-485b-a643-0302502e093b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707091299, "uuid": "6d3b62cd-7996-4e43-8fbc-5bd751e5bb8e", "value": "d78c1a6328d37bcf1224ce8657be5670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f113a02-c43c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1707147353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147353, "uuid": "bde088d0-b8fa-4288-97ad-18a16176d420", "comment": "Malware payload (njrat)", "value": "52b074e39e4f3ba00c230ba82eb62499", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147353, "uuid": "4c83d9cf-c193-4322-b4b5-986a584dfcb3", "comment": "Malware payload (njrat)", "value": "4c75f91c9974d712ef96b2f6bfe99edc15f110dea80065a59e161e639d08e74d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147353, "uuid": "5156ce66-bfc1-406d-b8b7-71194e44b214", "comment": "Malware payload (njrat)", "value": "054a51bf0c25309a728a8bc14c77262168f134a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147353, "uuid": "c43386e4-0395-4e3f-b40f-8639868cd29d", "comment": "Malware payload (njrat)", "value": "2a6b9a2d592e498af1944b9ae9e8f1db9cca51f6b4837eff4771c47e6717f0882863d8608ecfa36378e267919c0ae070", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147353, "uuid": "00bbefb1-ad47-40f0-b666-beb9d84f9057", "value": "T156F31245973C0152D022A67EBD66CA4B3246FC7B8BDFC60B0B9DB00B1F565144BDA63B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147353, "uuid": "2200e8c6-20fd-4fe8-8192-bb1cd5f5fc96", "value": "6bac3cfe8acb6c6c4a30aaa022de2388", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147353, "uuid": "078ca9bb-ce5f-4616-b9e9-b79e1f9edbb3", "value": "3072:tf/J2ULiTehI8FrkZqFMzVg//AY30OKalUPRjejXrcyrD:32UL2i9FJkg//r0OKYUPR6fTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707147353, "uuid": "722933e1-05d9-48c3-9746-39b6ff72b8bb", "value": 162146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707147353, "uuid": "43681e3d-7e61-4afe-8201-a4eb87da2dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147353, "uuid": "6d763444-23b4-42bc-9611-62602a962f5f", "value": "52b074e39e4f3ba00c230ba82eb62499.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1858d882-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121947, "uuid": "6b83d4ff-f69a-4b82-b4f9-093e4c854758", "comment": "Malware payload (AgentTesla)", "value": "11df7cb2571c6c9d54061b03eaf5db08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121947, "uuid": "d6417e9a-6efb-44f0-9c3a-8410bc809b1a", "comment": "Malware payload (AgentTesla)", "value": "4c9992f294bc88aaab3386f5169a3605cdeec546366392c2aeca92078b9d95bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121947, "uuid": "5983d7e4-5c4b-4055-b828-0d441b5ad49a", "comment": "Malware payload (AgentTesla)", "value": "0c4696bddf50e472f714507e0f7c3eb7ac929d5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121947, "uuid": "6c66d604-5f37-4dfe-813e-008d4384711e", "comment": "Malware payload (AgentTesla)", "value": "7eecec8a33c7e2807df73e0b0abfb73dd73bcd61496c3aead0b7f37cc567e8fa67e901ab82f0ea0eb29fa70422df01f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121947, "uuid": "ccdfb1ee-1220-41b0-895e-f3c44d37c996", "value": "T1B83410077E88EB11E5A87E3782EF2C2413B2B0C71633C60F6F49AE651451652AD7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121947, "uuid": "ec3094ff-f410-4715-b970-720a104fb5be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121947, "uuid": "727c36d0-db3d-4c01-b451-7888300dd6f0", "value": "3072:c4I3/hpZm8OHzfqQHPdCjS28T0FyBT75/nY6XzTu:ch3/hpZmNDqgFCWV0FyJdY6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121947, "uuid": "1bd71a1c-0b53-4514-bd84-311d7f95ecd9", "value": 243200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121947, "uuid": "1209be66-281d-42c0-b853-70d48aec2493", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121947, "uuid": "1adf4e6f-84a5-4390-99de-977892c08f16", "value": "4c9992f294bc88aaab3386f5169a3605cdeec546366392c2aeca92078b9d95bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72547d5b-c413-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707129829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129829, "uuid": "6b16ceb5-1525-49b1-88c4-07f3b6c93ab1", "comment": "Malware payload (RiseProStealer)", "value": "3355e8cdfa1a9dbe0b51468287da4ca2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129829, "uuid": "56b84bc1-a2a5-4a0a-90fa-34839df55dbe", "comment": "Malware payload (RiseProStealer)", "value": "4e4d4e52ad156dc7b32a4010134ba2b0fb56dea2d47c8bf562e5cc587a165faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129829, "uuid": "3fc93206-e3d7-4081-983e-f79772e26d28", "comment": "Malware payload (RiseProStealer)", "value": "518afba92088cf9228cdef4fb1d4c94c74ef4e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129829, "uuid": "55a62611-09f2-42e5-b132-f843f629a605", "comment": "Malware payload (RiseProStealer)", "value": "9355309b11af83c746ca2b7e4f0a12308c046a016551639963734fcdbbfd96ff5fdfec16ac4a77c6cb0ffec85c864281", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129829, "uuid": "3286ec54-8780-4417-965a-3f6252284f50", "value": "T1BF56330A7C8A68C6C085AA780129EEFF31BD6E281170C527A2742F9FC9F76F51F35546", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129829, "uuid": "bf63f5f2-8d07-4c91-8473-fae9daa32113", "value": "940b3a5d63813005f48f6ae4f0c3b75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129829, "uuid": "6bf8c6db-1c26-4db5-b769-6147ce0a99a6", "value": "98304:wIZh0xSrUhq023L2QwR8be0eaQofwXwN9BMRUSPW0TA8zOlLdPj9OIQf1xSAzeBk:nKSAhH9i/x8waPeXBLdb9OnSACBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129829, "uuid": "f8de72be-0796-48f4-a3de-33b3134aefe7", "value": 5923328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129829, "uuid": "395884f1-8c06-4dcc-a8f7-59cee585a74f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129829, "uuid": "38a80919-d8db-4c49-8abb-7e52f1b2271f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378fcfc5-c432-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707143045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143045, "uuid": "69286e46-4244-4be0-aefc-84c5920ceb10", "comment": "Malware payload (AgentTesla)", "value": "adf0abc00b93a8814b0a1eb75f1d22ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143045, "uuid": "2473f1ff-a2ff-4f5e-b60b-647eebf20067", "comment": "Malware payload (AgentTesla)", "value": "4ed9be9db41627b4511f5568a48e1815377488ae802941622d30664dd386b6e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143045, "uuid": "4f47566d-8f80-4db5-bb5b-8e19a8422fd4", "comment": "Malware payload (AgentTesla)", "value": "e9308ca7fa076aaad27eb6ed42727a626647fcbc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143045, "uuid": "c2b563dc-a388-49db-a560-c1d1d513f56a", "comment": "Malware payload (AgentTesla)", "value": "aedbe9971779a255b673ef337f5b6790dd2db5796d8b90c8ada408c41643ec1df0ebfeb7692682c88ebd949302bb27ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143045, "uuid": "09e480e6-94e0-48f4-8b0b-c25203a79f53", "value": "T122B24A26B3E80B37D9FF5778A9B321002775B22B5902CA5F6EC9549F4873BD40612B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143045, "uuid": "44ba10de-497b-4be0-a8c8-d18beb169ad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143045, "uuid": "8921ee62-262c-43e4-9d89-109a2c8e1b65", "value": "384:vm+noQOmpqRUy/u7IvWbE1Uv0wumhpWetvm6iDEEAT/eHKwCOrCpZOVUAj:OqoQ5pqRUy/u7XEynp/hLGHyXO7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143045, "uuid": "629dd21e-28de-4cb8-83b0-1f03f795ebc2", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143045, "uuid": "6f3fb813-40f5-4d4b-ae56-c6650986583e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143045, "uuid": "3c22a565-c34d-46b7-86f9-8feebbef9944", "value": "Quote.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e8946c-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121586, "uuid": "cfb586b8-5373-43f0-936d-63e960d4e06e", "comment": "Malware payload (AgentTesla)", "value": "2ef143ab0ae318a69ed3d6bbbe81f79a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121586, "uuid": "c29931d7-2cf5-4d0b-945b-3db499cf4c1c", "comment": "Malware payload (AgentTesla)", "value": "4f077994ed6160657a8de78edad255be2b427fb4d458835a1d6046ac3beba5de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121586, "uuid": "83fe1cc6-5b8e-4171-ae44-19682dc8d249", "comment": "Malware payload (AgentTesla)", "value": "38083a984b5652d58c7115b58489c447c9b79a8a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121586, "uuid": "942e96a6-fe2e-4727-8521-9d1679dfc326", "comment": "Malware payload (AgentTesla)", "value": "66048159606e71ef84372557ce4d482e28180b597ed038bbabfa84873c27e40e353150c17af64b868c230895fe01040a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121586, "uuid": "7dcc339c-fb1f-43ee-be54-4fe5bb6bfad1", "value": "T16225DF84AAB44F15E97FA7F880251100D3B5B99B791FE34D8EC0A0EA1EB6B414E47F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121586, "uuid": "16fe1528-38e3-4233-8416-8570b49c63b3", "value": "24576:PMyUq8GPQOWUOoxaIKRLFCjm7zQPkRDXlZah:1WhJCjmHyk11Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121586, "uuid": "00f502f9-059d-43ef-abab-1ab5f120adf4", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121586, "uuid": "e085cb6b-0f72-4a7f-bc3e-2d4c941254d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121586, "uuid": "39ba2495-07ff-4af6-a0bf-6c2be569da77", "value": "ANFRAGE AUF VORSCHLAG 02.01.2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac340ad-c40b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707126622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126622, "uuid": "c763dd10-9f5a-4e94-8847-5e7387ed3dd4", "comment": "Malware payload (Stealc)", "value": "999e757ddf0c0ec7adfe2f93c2397af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126622, "uuid": "173b74de-f542-4df2-bf97-ecb66c0e2b70", "comment": "Malware payload (Stealc)", "value": "50451b758fd6f0e5df748dd53ba05f414e4fdfa81527c36d994b8d1cce6235e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126622, "uuid": "a8d0c550-ee26-47a8-9062-721cb55b89d1", "comment": "Malware payload (Stealc)", "value": "c5f12a7521ee195a7e7bce267a42ce249aa3114c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126622, "uuid": "d6c41bbe-27b5-4104-88b4-31fab2e00ad7", "comment": "Malware payload (Stealc)", "value": "90d91c3384d8d2fe6d525cc9d0e4678162f58a38d37185320b19a85ff510ef8a4ab7fb855e7c7020d16b9326ba2d69fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126622, "uuid": "af520ebb-4caa-47e5-9e46-b11b3b004537", "value": "T149349D1033D0D071D1AB253589A5CBB24F6A786266739BBFFFD51A3B6E34790862830D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126622, "uuid": "15a77516-3e4f-4865-bb4f-26c1b7e9bc4c", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126622, "uuid": "909f9f86-ed7c-4e19-91b1-64bb48bd4da5", "value": "3072:9ruOsKcdFdzR/9sA+cqRO7nNIugL29EcF5Zi3EY/87jO5GRo6P0s4iNx:9hcFdzR/9sbLoF5IB/8HOqo1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707126622, "uuid": "ba0233e3-799c-44aa-9d07-7a2d419e0203", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707126622, "uuid": "a5234634-8244-4135-9041-389e68482cda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126622, "uuid": "21f6efe7-6d3e-4fbd-8837-edc280108bac", "value": "999e757ddf0c0ec7adfe2f93c2397af7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc6d1e4-c40e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1707127701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127701, "uuid": "305f1f22-e205-4560-87d3-7fc60095bb17", "comment": "Malware payload (QuasarRAT)", "value": "6dfb3db98ac25d50d4b27f9c8096b33e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127701, "uuid": "3ed6571d-a887-4ce7-b1e3-4fca20aa95f6", "comment": "Malware payload (QuasarRAT)", "value": "504f583f7c492b845e1cca28fa4eb8d7b2a6268ca72e21fc2d1c4c25a8c597ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127701, "uuid": "f77eea35-307d-4ad6-a9b9-c192b1dd763e", "comment": "Malware payload (QuasarRAT)", "value": "373cf99e89dbcd81cc585eff2c79a37da3abb7b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127701, "uuid": "6fc3cfa8-5988-4bfb-ba99-e43fa6fb941f", "comment": "Malware payload (QuasarRAT)", "value": "497a6fd29e5dbd82cb463c945bfd89e648c457bd8d63b415c1b29ac1f623d8da11d36953dbe60970eb2545d0d58c9957", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KOR", "colour": "#882F07", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127701, "uuid": "e2ad93fb-f66f-4a2e-8bbc-6f068edd77a0", "value": "T178E56B143BF85E27E1BBE67795B0001267F0FC1AF3A3EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127701, "uuid": "6c659edd-a5c5-45d9-bb83-7edaa10fc3f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127701, "uuid": "ad18369b-b291-46fe-8c3e-5d680ae16cbd", "value": "49152:uvbI22SsaNYfdPBldt698dBcjH+5Rm6kbR3LoGdXQUTHHB72eh2NT:uvk22SsaNYfdPBldt6+dBcjH+5Rm6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707127701, "uuid": "228009b0-f3d5-4203-b9d5-6539662075af", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707127701, "uuid": "e6041cf0-0ce7-4d26-a734-b5716c8ddad2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127701, "uuid": "d96195d8-f765-4e7c-853f-132f253256d5", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7d720c-c3f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707118572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118572, "uuid": "e98dd708-c1c5-48eb-a4ea-05151a68cf8a", "comment": "Malware payload", "value": "e86471da9e0244d1d5e29b15fc9feb80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118572, "uuid": "e15d3ea3-c94b-482f-930d-975a647df64e", "comment": "Malware payload", "value": "50dd267b25062a6c94de3976d9a198a882a2b5801270492d32f0c0dadc6caa81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118572, "uuid": "19893ab7-e271-43a0-9cbe-ea13420fdbd0", "comment": "Malware payload", "value": "5e237538eb5b5d4464751a4391302b4158e80f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118572, "uuid": "442ef1d0-13c0-4809-8447-78a9c55ecb2d", "comment": "Malware payload", "value": "74ac811b5834d45ae233c9c92b1ef9bc6290459319444cad88bccb6b7edd09d0e6b186e403ef54f8837a31e97fbc2f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118572, "uuid": "704d40c5-1831-4bcc-9ef3-777f1597cff8", "value": "T19C545C5A73A41DF8EDA7923CC9424906E772BC064771E7CF03A0466A2F276E09E3E751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118572, "uuid": "cc62f623-2d80-4bc3-9cc2-0383b95c0a61", "value": "40af1e49b65d53dc40867a6689c30c0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118572, "uuid": "e012b615-21a9-4f65-b9c0-5c97f9c0241f", "value": "6144:Q/oAW1Fn0OjeJQ5oj4IaobX4+sDug70sc09RZF5zN4xpS:Q/oAW1FnuJFBaobX4TD4sc0zZuxpS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707118572, "uuid": "1162c589-b0a6-49ec-9c23-bc0485454827", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707118572, "uuid": "f839f17b-66d4-4dec-b1d9-0becddd7008c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118572, "uuid": "ea996728-9729-4817-afe6-69e1e6d472cb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b397404d-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111470, "uuid": "0ea50974-3836-4a37-b646-794b2385ecb3", "comment": "Malware payload (Gafgyt)", "value": "b2655b80e9247e269000258c8459cd23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111470, "uuid": "9d72fc0d-23a4-48de-a7fc-0df33f669987", "comment": "Malware payload (Gafgyt)", "value": "529ffd0e63f232efee15b1c8b679276a2b71d271e6b3443ed1f3ff6f0cecf3c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111470, "uuid": "cd449696-7d00-4adc-b074-7b0132a2ec40", "comment": "Malware payload (Gafgyt)", "value": "380ec8a9a0d548d8619185957f5e9b23670d0acc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111470, "uuid": "4be13b8a-ccb4-4089-a974-d03cb2c9d7b7", "comment": "Malware payload (Gafgyt)", "value": "aa48312abfacca7965da54e82f0b518bb038c2470e36ba8bf1544cfaf2ab4a4ab2ccd1e6a867a34c84ab18bcd9a9bf85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111470, "uuid": "79abbd32-b047-427b-ae62-5a3b6540cfbf", "value": "T172E38536B7619E77D81ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111470, "uuid": "fae9443b-1d79-43ef-b2f6-6376b54ea34d", "value": "3072:dgZc9h1jlnLA2PiXYeyCcOVNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZOVWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111470, "uuid": "f066453c-78b6-43b0-9275-f68e772116b3", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111470, "uuid": "b3b2afda-c7dc-41cd-a684-5e4409bde734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111470, "uuid": "f19cb5eb-4be9-4db4-8b35-b310b398986f", "value": "b2655b80e9247e269000258c8459cd23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852f1a51-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121700, "uuid": "ca3da894-faf3-4c4a-a012-3bee2dd99fb8", "comment": "Malware payload (AgentTesla)", "value": "fed63f9a4a1b148e773c42eb5670cafd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121700, "uuid": "b2779eb5-e6e3-4f1a-aff3-ed462487b090", "comment": "Malware payload (AgentTesla)", "value": "54da131199557e9b9da77c7244dfbca61fc1db6c61c5faad802ded5ff5df4843", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121700, "uuid": "4ff2a06a-543a-4b69-8df8-efb98b381a38", "comment": "Malware payload (AgentTesla)", "value": "f9e239ce53833da90de8f9da9ae0e703d810a040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121700, "uuid": "664ea91b-3a27-4bbd-ad13-208a62a6521f", "comment": "Malware payload (AgentTesla)", "value": "f5d04b3cfda0da1bb77add9342a184d628e8ffb950e285aaacadf792c120c6956ddf9d88acd94b95ef3579c77160edc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121700, "uuid": "095431ab-7fdf-43cd-ab17-63d16dd989ad", "value": "T1E0C423E6C5091FFC0ED62E5F9442978036DD9AAC05C15DA85C2786B37DA71FB9E202CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121700, "uuid": "fdd268ef-0382-42dd-9404-728f1ad91877", "value": "12288:U1qaQf9nz8DxJsRpzRqYSTUZjvLERVxQK5wYdiMOnEqBCDZHKyoy3Zaq:2M9nIwR9RqYSYZTLERR5wYsv5BCD9V7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121700, "uuid": "c1f2c597-27d9-4ec6-9e74-6df0379f15d2", "value": 570655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121700, "uuid": "b3c8d784-fb7d-4c3b-b204-9967042d1d94", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121700, "uuid": "a0049c48-d8eb-4de2-96ba-5f725646c08e", "value": "Request For A Quote.b2z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45c8a10d-c3fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707120735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120735, "uuid": "9908bb35-839a-4fcd-8409-133e1f0a250d", "comment": "Malware payload (Formbook)", "value": "a0d91733ef9cba5af20723258f6ba2b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120735, "uuid": "1d12e548-6984-4e46-a251-5d9960da4fd0", "comment": "Malware payload (Formbook)", "value": "56186e8da853b2cabf3e4679d54e6d0218230de21949efbbd46744d1c241e6be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120735, "uuid": "78619c9f-f584-426c-8a24-e9a0c5590661", "comment": "Malware payload (Formbook)", "value": "e5cbe4fe77985c67d8c008050f82f691c3a7edc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120735, "uuid": "6b6cc346-2ea3-4bce-923c-a99d040d2a09", "comment": "Malware payload (Formbook)", "value": "e120967d8b13c4c248eda5069f949a62c0ea6442a71dd377fa14722160e7f0dbcd95535dd26bf845d2bd44ccd86569d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120735, "uuid": "ddb08b82-2547-4e65-8177-df9571944974", "value": "T14205120536A8EB1FCDAA0AF19144584023B9995460C7EFC9DCD271F59F937D6CA0368F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120735, "uuid": "99957fac-c2ff-4f76-a51c-55df038fbf47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120735, "uuid": "9ca31181-a71d-4fd6-8cc7-8955d771cf14", "value": "12288:x6kkD9c3h1KuiifhyVhDm4dfFqUXm55GzlIKE+h+OaOLLYWktsq4xa3GSESF3wkT:c9cxoVF19FqUXXlinO7Lnq4+cSYnXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120735, "uuid": "81f605bf-9bd3-4026-bd1e-4030cf1a2b21", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120735, "uuid": "f4874e30-46ce-471a-a843-beef203d012a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120735, "uuid": "9c4e7bef-6618-44b2-8ddb-d9f4a6d499aa", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb83139-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1707144448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144448, "uuid": "6ba7a302-5b78-4b53-a20f-5b21e2a88292", "comment": "Malware payload (Arechclient2)", "value": "a541ea929a2de08dd736ef41ee59dcc9", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144448, "uuid": "94ae2f7b-630e-4f13-909b-06f87957d929", "comment": "Malware payload (Arechclient2)", "value": "58442eff264bab05ef4bdd9e99e00a6931eb5bb54fe85e00b44c126ae41513ad", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144448, "uuid": "e52201ab-bcbc-4942-adc4-64b88d3efaa8", "comment": "Malware payload (Arechclient2)", "value": "fb749890f4d70a9e63ea36684178dfd8401d2564", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144448, "uuid": "b95ef10c-6899-407c-8881-18e334d5c185", "comment": "Malware payload (Arechclient2)", "value": "c49cbb2d3c45227e328cba5559c2ac82c0ee4ffa596cfcf9d70f0c3e8660f473d57bd5edb5b38d78a2fd46ca358e8ec7", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144448, "uuid": "05ba96bc-8e40-4a7a-96be-44f54f600f88", "value": "T13256D0C5B7E58E2AD79E5B36D0B11018A3F1E4835393F31B1BA676A97C833054E8A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144448, "uuid": "96ccddfe-6fb3-485a-88a3-e8bc555fa3ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144448, "uuid": "543cc540-80c1-4f46-8e98-0741b1969b67", "value": "98304:HwKPbJ/qiCsf+XpaKA708WFqgsf7V/zwh9mag8Lt:H5bJ/qiXf+XpaKA708WFq9TNu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144448, "uuid": "a39262a4-c921-434d-80c7-f5cc8a781329", "value": 6036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144448, "uuid": "f04bed70-d4d6-4729-9c36-da7d0d6ed13c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144448, "uuid": "7712a236-f28f-412f-bf33-add28ae0bfb4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a01d039-c428-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707138754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138754, "uuid": "45e0fad8-1546-429d-aa6e-c4afbb48c692", "comment": "Malware payload (AgentTesla)", "value": "ee20c4a2ffb6fcbfa1ae052d411a0947", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138754, "uuid": "929f360b-e7ce-4b16-874b-bc88d692d95b", "comment": "Malware payload (AgentTesla)", "value": "588f52b0c10d46e8aaf9e43b4e4af18a6e9d798fe1c20db78dd83595de80f846", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138754, "uuid": "2cadced6-af39-4bc9-8048-7131e6c39302", "comment": "Malware payload (AgentTesla)", "value": "f29f20eb852cfe6a5a717b8e78acd9b3db3189c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138754, "uuid": "9c6a2784-0283-47a6-800c-2dba9db7361a", "comment": "Malware payload (AgentTesla)", "value": "dacbb24d6e192770e1dec9ba1cba370a4530150d4facfc8c47df5b218798dfa712b62ae438995bfaee71390d51a7b246", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138754, "uuid": "183fbeb1-0a9b-4f39-b218-d0e05f23de94", "value": "T109F3CE2DC34B02598F620377AB1B1E5142BDBA6EF38552B5346C437933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138754, "uuid": "fcb59566-64b0-4381-a45a-5ec80ed6a15a", "value": "1536:5wAlRkwAlRkwAlRa6fyQOGPWAEjwGevgJw:5wAlawAlawAl86nOoWAEjwGevgJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138754, "uuid": "f5f5d0d7-a849-4edd-935e-4247cfcdf3f3", "value": 160875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138754, "uuid": "7b71e353-c4fc-4793-8be0-e3f3a193636d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138754, "uuid": "d1309c18-f796-4e7d-ae1c-f12d6b0bd67c", "value": "Payment-SOA.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260ff717-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707141727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141727, "uuid": "2504c32b-62a6-4f8a-a09b-a4fd8a3f2f62", "comment": "Malware payload (AgentTesla)", "value": "67f44950ffe70f92397e1b1f3447d9e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141727, "uuid": "3b54e7cf-5f31-4bb3-8d04-4fa873acac46", "comment": "Malware payload (AgentTesla)", "value": "5932d82e19bc8b6ef0b3c97e99e747ac4c840eb2966df4215ded42e443cb5b14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141727, "uuid": "95d16ca8-a4ef-4d49-8c41-410cb3928a55", "comment": "Malware payload (AgentTesla)", "value": "25ec665cbc4105f526d5acb82b34d057e54e1e70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141727, "uuid": "726db4d6-5072-4930-909a-26290c679386", "comment": "Malware payload (AgentTesla)", "value": "f956476530549b5c9eb0b06394a05649fe5f6baab35cc07c91e4754cd6f5a33f0c89336067e23c772a0649442c8109ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141727, "uuid": "26f10a56-1c7b-4f89-b9b4-050adb4c2544", "value": "T1B1052240BC6A2B82D4FF9FF91592400293B98113A973FA5F8D9278E5D803F548B12F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141727, "uuid": "b5e6eaad-5db8-4770-b96a-9aa945172b08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141727, "uuid": "cb73114b-8bb0-46b1-963a-f4aa3d2b326b", "value": "24576:KV68yq0N4fp9eBMsES6m5m062Ji7aVCsYJoy8Z9cx:KVsqCrBMl46zaV0kZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141727, "uuid": "21f7f482-7fc1-4421-a8fc-f61eefa196f2", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141727, "uuid": "24333dd9-b7c2-4443-b946-da403c640269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141727, "uuid": "afc8424f-fb25-454b-832a-a7a45a939771", "value": "rF\u0130YATTALEB\u0130Y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa9b0cf-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707125414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125414, "uuid": "2b736a71-3aca-419a-8d52-f9c60eb39d82", "comment": "Malware payload (Formbook)", "value": "d31320890ca13a1caafe2f45673254d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125414, "uuid": "b60b86f1-55a5-43aa-a5a1-ce65be3a9309", "comment": "Malware payload (Formbook)", "value": "59a8ba303c83a39175e8cc12646b5cd59ba5bba2a7f9ed6f652abb51237f4d16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125414, "uuid": "29c1b43a-ff75-4eec-ab52-a3838109b324", "comment": "Malware payload (Formbook)", "value": "c3827368e4441dc2fcb2f067c0874af94698e6cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125414, "uuid": "0f9d50f4-5fa7-41b2-98a2-906b33de9024", "comment": "Malware payload (Formbook)", "value": "47d5d94660b2f1d84e1b0c2e2a1122483a0eae5b0f237e2d9b7d45282810ae4fb4423bb1af05bce55ed2aa837ee38d86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125414, "uuid": "ae893a97-99fb-435b-9be1-7ffb360c871b", "value": "T175052240BAB81B16C6BF0BF51CE1A152CB7596236D33FA0B9E8278D9B015F658E01B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125414, "uuid": "efbee13e-6aa7-4ac6-ba89-21ba441abdd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125414, "uuid": "79055d1a-ed60-4f0e-aa43-0c79e4b0f93a", "value": "24576:wsV68yq0N4ocTqpBWkzW+W1gLnU3wliMYln9cx:wsVsqCmTq/WKWn19mi1ln", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125414, "uuid": "12992062-415f-4a28-91a2-569cdaf0d177", "value": 815616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125414, "uuid": "9b96d77a-2212-491b-ac44-39a7b1bb2917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125414, "uuid": "524891bc-5a7c-4686-b950-c445995055ac", "value": "SecuriteInfo.com.Win32.PWSX-gen.28508.28121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ddeac8-c45f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707162666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162666, "uuid": "16c5efa2-2f82-49f6-a293-1c79f0eef73e", "comment": "Malware payload", "value": "e2889893d75c1ea7bd8982274873b1b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162666, "uuid": "2ac99539-f54c-409e-86a1-7db89b135344", "comment": "Malware payload", "value": "5a30a9b801943074fc132f20ab5f77cc2c2bd95ccd76a535b3ad7e8fcf6d1cdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162666, "uuid": "2e09313d-5a73-4685-894f-4cc4e4350c1a", "comment": "Malware payload", "value": "9ebedbf8146b9862503bf3c40239e169b09c67a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162666, "uuid": "65519d1d-902e-4074-9f77-17c5ee6d8e9b", "comment": "Malware payload", "value": "9e29f9851b7e0b66790a5a4c4ed566851946021bfddd8fc0ecb627d9e7027f65a3982f10af009afe52326cb683b05ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162666, "uuid": "0c54209d-9ad4-4a57-8b0d-b8bcfad09acd", "value": "T176051207FB6C9B4FD39A49B1797A02B24B98EF530511A80AB3D4FC6D343251DAD0B2D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162666, "uuid": "cd5f7e07-966a-410b-9064-e748169c6e67", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162666, "uuid": "e59512e5-2650-4858-bf17-4c25359701de", "value": "24576:hMwhWpdsQpT6q3tmxUgxDEuZ9WI+spi9iCnqV+:hMweskT6q30x4uZ8dr9q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707162666, "uuid": "92662609-f139-4c5b-a0e5-dcab85ef0b92", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707162666, "uuid": "8bbade3b-ffb2-4243-8551-4a439b123e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162666, "uuid": "880c1753-4bb8-4833-80c7-eb63bd356678", "value": "ORDER#4510093083_POs_NEW_MATERIAL_JAN_2024_POs_pdfs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1983131f-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121949, "uuid": "bd9c89b8-a396-4168-81d2-9de5c554b7b2", "comment": "Malware payload", "value": "2a179eb602aae51b2111c9bf425c285b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121949, "uuid": "ea4672cf-991c-42fc-b898-ec09d0501c0b", "comment": "Malware payload", "value": "5c702d043863b1bdd6e4dbdf89ffde07497dea0570396698509e23637b5558ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121949, "uuid": "baafc7ea-729d-4ebf-9c4f-91d6f04cc081", "comment": "Malware payload", "value": "b43e66fca4050abed61ee5903ea1590b9a91f342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121949, "uuid": "a6c8b79e-3c19-49df-90ca-559f164ca852", "comment": "Malware payload", "value": "cbfa342222096d1893b0b6922bec6c20710207fc59348874bce8e4073784e184ab1b02aae17337fac50f203fb9208a83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121949, "uuid": "728ff76f-e4bc-4ee0-b151-49c73f3fcf9b", "value": "T19E45BE1273D2C03AFFBB92B35B69B2015AB97D250123852F13D82D79BA701B1673D762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121949, "uuid": "cab52559-13c2-4fcf-a5dc-494e5db82302", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121949, "uuid": "ff8465c8-7c1d-4187-b8fc-e37e8a6415c8", "value": "24576:SAHnh+eWsN3skA4RV1Hom2KXcmtcUggR5vyas6tPqL:Vh+ZkldoPKsacLovy4V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121949, "uuid": "913d68e4-3b55-42d8-9617-520873bc420f", "value": 1203712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121949, "uuid": "0c9980dd-d559-495c-b962-3a2b48bf7ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121949, "uuid": "13afa920-ba2d-48a6-9347-0faa06ccea6f", "value": "68052Re Product Inquiry- Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d59d40-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094556, "uuid": "bd4cc908-2680-47b9-aa9c-690f1fcb32a1", "comment": "Malware payload (Mirai)", "value": "71e9c04dd429ae3699cbfa75634c22a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094556, "uuid": "1845d693-3bcf-4578-a1eb-a6ff6ae9e8c3", "comment": "Malware payload (Mirai)", "value": "5c96a566262638cc963a73eca10088e6ef4e34dd5e31c0cc37f4727f94149dc7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094556, "uuid": "18d9bf37-3f0b-4d83-a28d-106a80f60cf5", "comment": "Malware payload (Mirai)", "value": "9dcfc8bdc9248ddb969e4c646f6365eb35906f94", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094556, "uuid": "3ca1a997-9535-4323-b8f2-729dafbfc267", "comment": "Malware payload (Mirai)", "value": "3c1560ff8001b5b1e91e64eb01cc3829986e68c0288b2159ba15c7d7b0dbef93d687975140c6f35a4fd91b79365dd250", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094556, "uuid": "682ece58-cf27-4c3f-adf4-3ec250d4192e", "value": "T15083D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094556, "uuid": "3e4c1c9c-8a3a-4656-8af3-992bc2d9e96e", "value": "1536:iVLyu95K5Ekj752dCexuV/8UZlDwfkJ4MYfWr:iVLyMgPFezxu5VD1ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094556, "uuid": "be7375a6-970d-4422-a33b-07e20bda0513", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094556, "uuid": "36dd951a-6959-414d-a2c8-fb73bedca0d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094556, "uuid": "e90e0dc5-0bcb-44a1-8405-6498149346c6", "value": "mpsl-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d957ed-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707144013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144013, "uuid": "19def90b-4fdf-4c17-81da-d0355c8714c7", "comment": "Malware payload", "value": "d8e268514a9ae51b4a3ed0d0ac8c5ccd", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144013, "uuid": "1fa163e6-3d9b-48b5-9e04-218ef7a16c8d", "comment": "Malware payload", "value": "5cc3d6542fe098f287838617c8088bf3b337e5c74437a04d3fe2d0fc0bfd2970", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144013, "uuid": "8081140e-9fa4-4116-974a-f823af69465b", "comment": "Malware payload", "value": "025038aed70ea80591c4be26ff2db6415aa08a5e", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144013, "uuid": "17813ea2-4c4f-4f64-8cd5-0c4f7397af49", "comment": "Malware payload", "value": "e9892a84f8d0ded1080549d299b4c9d9fd1fd4a605ebf088a8551e08515e413b4df7e9eddde4232433c9097c8e967740", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144013, "uuid": "6086291c-a123-4729-92a4-2ffae1285618", "value": "T1DDC412143255A9FEC0471BB04AE9A4CF625DBC326BC2C017355DF38E03B5BD6EA5326A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144013, "uuid": "e6a238ec-5fb5-40d6-9f28-81a7449fd661", "value": "12288:yFkofnPSh4pvFCssGb6O93H8MWWg0dhTVSWk/IoGp/2QJsJ2f/2yucO:0nPSh4zCssGb6O93HGAXZSWk/IpNJsJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144013, "uuid": "107b545e-0dd8-4358-83de-7f0c14a22b42", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144013, "uuid": "150b6422-1feb-4825-95a8-2459014adb4f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144013, "uuid": "30409b39-afbf-49fb-b255-055dbe00aabb", "value": "Purchase Order202452.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0029f4c0-c40c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707126631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126631, "uuid": "f4445dd2-1b8b-4d6b-8a4f-04cce3a2dc01", "comment": "Malware payload (Stealc)", "value": "c5753bab520f5ae2fdcbe9886d8b5fa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126631, "uuid": "dd767c03-2479-47d4-9f5b-e5bdc963f9d1", "comment": "Malware payload (Stealc)", "value": "5d2d0aadfb9a0f47c7803c207b2f7b5c9efd79261d7f351b367b479788c4d47d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126631, "uuid": "33582eb9-d560-47e9-ac67-d50dcb858e32", "comment": "Malware payload (Stealc)", "value": "11c5aa0c12218ddb1bfea2532b8e53e0017de434", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126631, "uuid": "3006b169-f258-4a72-9832-13cb6fac4b08", "comment": "Malware payload (Stealc)", "value": "ce94bf2aeaba49703823a4eb7804bb6c369a65d69886e2b886343b02201274d63e122e5da1600dcaef3b6d04fcd91907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126631, "uuid": "a810c29f-54fb-40f3-a576-ec29c1554a01", "value": "T1DB54AD102390E071D15725358961C7B64AAB78716A639FBFBFE61BBB2F34390DA2430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126631, "uuid": "a06205bb-0b18-457c-8492-bb0fc9161cc5", "value": "ebe35e0085e613a421d4abea9476d495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126631, "uuid": "5820b994-4c90-4712-8600-836d68123397", "value": "3072:S2IDrkVtFdm6Ks+5fcuzStgrSDb4MVGr+SbfJw8wOf/fseGtI6P0s4iNc:S9Drst6snDbvVoJwc/fse1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707126631, "uuid": "09fecb5f-cf0b-4255-9c72-74b481d405e6", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707126631, "uuid": "1d728f33-d6ba-493f-bcbc-6a3968a36a81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126631, "uuid": "7f119af0-6122-435a-9f48-05d8ad951021", "value": "c5753bab520f5ae2fdcbe9886d8b5fa1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a80bf2-c437-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707145303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145303, "uuid": "b88bc92a-97c6-424a-8a99-d3284fef5e5a", "comment": "Malware payload", "value": "81fec9ad0b6b3997effb7308e40b0c7e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145303, "uuid": "f9041e47-d423-43db-8f62-2457bbac5aba", "comment": "Malware payload", "value": "5e325c39f91d6600656ac4cc8fd98a36c578c3b79cf44952b4362d53583a96e6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145303, "uuid": "e805b4e5-da54-4546-b502-32430d62963b", "comment": "Malware payload", "value": "3f545d22a79ae961c04d9b20e853cf688c168d48", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145303, "uuid": "b7eb9ad1-6167-4d9e-a37a-6e60f4f0e148", "comment": "Malware payload", "value": "b068acbdc1a438d63fa1a1b1fe9925806405de745646ad2d32e848c8ae078df9d385d3af23444ce7b10abd01b150680d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145303, "uuid": "c2046a6b-9344-4084-866c-41969d3930eb", "value": "T19B328E6ACF02F42AD36890FE414961F4F15C81418711664E21ABF6BE4FD0587838F9EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145303, "uuid": "6fc345ca-d4ca-4008-9893-99c4ee8c6052", "value": "192:ScIMmtP+rWqYZoZJM5bv/0kEJ+U3sy0/i+R0Kx50XTSnSwfT3:SPXmCv2JkGJC/fR5eSnSwfT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707145303, "uuid": "a5f03c90-f901-4c1f-b600-b2b5168abb62", "value": 11842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707145303, "uuid": "a6d8cd9e-4279-458a-b6ba-9571f821ca0f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145303, "uuid": "67d11036-84a6-46df-bd5c-1720735fb4cc", "value": "Attn dear.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de61a13-c46c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707167993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167993, "uuid": "1e412f7d-7786-4074-b38b-b04b81c173db", "comment": "Malware payload", "value": "c3ce624146e5a45bb70ab1b9d4586705", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167993, "uuid": "8297ae0c-9b1a-4c8f-8f56-c56cbc392d90", "comment": "Malware payload", "value": "5ed65a36ea4491425ee373cccf578ca5be29c38ad97e089ed82c9b6e9f72866a", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167993, "uuid": "fe62efa3-48d2-43ee-949c-543d44762c24", "comment": "Malware payload", "value": "488466062ee799942ba90cc9cb3f133b9ae6b647", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167993, "uuid": "aeab3c96-bcdf-44af-b5a6-3f550ce14b0f", "comment": "Malware payload", "value": "645b2fbdee39a57c03e5ec007c49a99c1ab42d9ba033817d6f2374f43598ff5b14c3bf64d3cd56bd1294f8b1c28d18f9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167993, "uuid": "4f54b04f-9fea-4f8d-8131-be205627a1d1", "value": "T107F73365F3DBDA66C7A3023A457D2E3323264CD146D39687690B3A744473FE80B46ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167993, "uuid": "3ac943ea-b6d4-4fbd-a941-fea0f2e0fbec", "value": "1572864:3Cn9wVMp0XntKous2ULqcXK2fwsgc4iKKxmhnWgtm7:RV4Ez3LP6Vsaf47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707167993, "uuid": "ff124b80-f358-4b18-af4e-e81d38a179f1", "value": 74437459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707167993, "uuid": "43eee59d-366c-43c8-b3aa-e2d0bd5d27e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167993, "uuid": "eadd0d00-a3af-46f0-aea9-bd59a47e3e41", "value": "metamask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc06a605-c3ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707121363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121363, "uuid": "85f9d2f4-0038-4717-b12e-479c6bb6b860", "comment": "Malware payload (RemcosRAT)", "value": "a176af5a627fe57f9f3bd1b185a34a7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121363, "uuid": "dc22eaf7-5889-4a81-b00f-88f8db79f7c1", "comment": "Malware payload (RemcosRAT)", "value": "5ed9f86af46087b32298003361cf0e038d618051a9a9f11b025add39c2fe453e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121363, "uuid": "e145d9bb-c79d-4326-8b77-5029154128b3", "comment": "Malware payload (RemcosRAT)", "value": "ae22a73551e95a683c761765ba502c5dd461cf2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121363, "uuid": "b300fcc8-52a0-4e7c-b520-4f28a73c0e75", "comment": "Malware payload (RemcosRAT)", "value": "9a1ba1c8e793b6a4f78541c4a9af3a345fb080d437c841a2af44ff43178c85241908dd76882e96809cd0d752e0cd2568", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121363, "uuid": "fe807709-839b-45e5-bba4-4580c519daf2", "value": "T197836D15278DC52FCA4F06BCA821A114277093725503E78D5F98C9AD305FFE99E0ABE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121363, "uuid": "2fceb598-79a1-4ab5-b728-adf7ee1b2487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121363, "uuid": "593da2e6-69d9-4059-a6c7-de8a621d2386", "value": "1536:gD8NQi7vOjG3amCGtqHV+3GQnAXlcS8cwBtFRPWyg9Je6FS8+TwyQu0CvmVos:u82ibOj2aQgHVCulwXbWygWU+w/ubv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121363, "uuid": "5b911df8-e553-4c7e-a085-776417184913", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121363, "uuid": "41c87d5d-9b2c-4c11-a533-abcbeb6ab28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121363, "uuid": "7b4a2fc3-19b9-4c8a-a73b-5ab2f6a82453", "value": "IMG 276894907432.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31de4df3-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707125426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125426, "uuid": "836776fe-fe52-4d27-a610-0bef8c6d0fad", "comment": "Malware payload", "value": "d8819cc4aaf60d681c0970eadd768721", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125426, "uuid": "b3f95f7e-a3d8-4b6b-803f-d935687cf2ca", "comment": "Malware payload", "value": "60c72d1018810d6c96e4f22ef9f373b1fa8888b657a8b0e17cc7bbb352ae204f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125426, "uuid": "a9d9aa68-e8c4-48ac-8b33-11a703684b35", "comment": "Malware payload", "value": "49ace463c0a61d47acf588e28b0daeabbe67e27c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125426, "uuid": "a29c72f0-232c-49bb-96fb-708a81be1202", "comment": "Malware payload", "value": "18e37c514c08f882243229880b20570f720868e8caa3ce85ecaa8a0207dd16c63ca7f549d17f4d68b6d152acb47b55a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125426, "uuid": "5fb1ebbe-40cc-4e4d-b3a8-e7b27d36db03", "value": "T1531833DA7FC3B14AF1D38C7C99548E200F29EE721ADC5EE34A5C1EE4A09DDB0518A593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125426, "uuid": "ac9310ba-2efc-46a1-9960-3ff47c2db657", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125426, "uuid": "e8b39b62-3a08-4e38-81b5-ecf577466ad1", "value": "1572864:kejOk/37AvqSKH/fgt0qev5QGda7g3WDhNu1rMjwBnGZDBajwS2Lovq7:kEkvqSKHgyqeBQGgwWWtIIXvq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125426, "uuid": "14a1260c-6aa6-45fa-ba84-29751f78df5a", "value": 92911570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125426, "uuid": "e6444e28-777c-4e96-b205-237d94461c88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125426, "uuid": "e04c5fbf-2853-46ef-9dee-58a1a47624bd", "value": "SecuriteInfo.com.HEUR.Trojan-PSW.Script.Generic.6891.7419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682572a8-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707125517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125517, "uuid": "d9c87b55-b48f-492e-8a21-38e95028bb14", "comment": "Malware payload (AgentTesla)", "value": "e9bb1d3538e7fd41e6f586059f41c31e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125517, "uuid": "82583ff3-fa7e-4066-8ca3-e4b2731fafe4", "comment": "Malware payload (AgentTesla)", "value": "619d7d255a984020cea92bd0bdae82aafcb10d8415f18a70313d660c338ff1a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125517, "uuid": "b26ce788-bb7d-4e94-8082-d360e1b619ce", "comment": "Malware payload (AgentTesla)", "value": "794c48028550b7087990c89aea4d47da33265ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125517, "uuid": "e402e321-f5b4-4c06-b747-104c2c23ce52", "comment": "Malware payload (AgentTesla)", "value": "04c1939c5e8f31f5bfef64d4223710b644b2df331af07f43fbad9be3d7caa5a528a90ef708c92925cb27e7208fdef8e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125517, "uuid": "6313fc7d-db60-4577-b1ef-0220e1b7f6a9", "value": "T157B4013847E45238E6768B74FCF58762D67EFE566EEAE74D0658320C287338005F26A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125517, "uuid": "660e0898-ead7-484b-90b0-a6b9e4e4c676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125517, "uuid": "6c2d1ffa-708d-49a9-a765-93a86fa5bd86", "value": "12288:XOiMGrpHV9Ep29vS0NYIOJ4w7L5DYtXfvuMU:XOiMGrJspwYD4mLIvu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125517, "uuid": "3ddf6e31-160c-470a-8578-27bb6e9898aa", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125517, "uuid": "0fd3e8d0-e0fa-4e7a-8e40-168fda2c6fa3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125517, "uuid": "422822b1-4235-4505-9e46-effecbbb5347", "value": "e9bb1d3538e7fd41e6f586059f41c31e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16675cb-c460-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707163087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707163087, "uuid": "b9030f75-9740-49fe-b7ff-c3263272ab36", "comment": "Malware payload", "value": "e9ded16b5ba05aaf1918fa4e1041cdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707163087, "uuid": "7ec4ecb7-086d-4c17-aa4e-57e4b3d321cd", "comment": "Malware payload", "value": "6311cdb88633aed8d6eb1279f717eb510cde7ed24af6312656b57bd1f37cf591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707163087, "uuid": "6b7bc859-04ea-427b-a5c0-92be9261d823", "comment": "Malware payload", "value": "4c6ad246b167aa56b2ddfa1508225db41a0a4dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707163087, "uuid": "060ba985-93e5-44ac-a4cd-c81ed7e743c9", "comment": "Malware payload", "value": "329b255a52f0aa32e1fc3e04da3d28d0c133a7d66bf5fce18914f105958c2069389b81f81ee2811f682467d6eb47b8f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707163087, "uuid": "833ea4e3-d641-4f98-970b-4a4458f72a1b", "value": "T10BD42311A7AFD9BCD0181A7184E31B9C53B59384D93BCE07595773E8CE897E79300ACA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707163087, "uuid": "6b3444cb-50d9-45f8-a9fb-93383a9806cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707163087, "uuid": "2d888404-a8ca-4d52-b0a5-9715911dd11a", "value": "12288:ITwFkR3PVdsbjoKO2m1DN4zSg7i1ZRlC+j3ekgeGC+zZE:IgMPV6RC6zS6cKAGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707163087, "uuid": "fac3f2e6-f065-4682-ac47-801289d0fe46", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707163087, "uuid": "a3df34f8-a407-4865-b8d0-16ccfcaf9474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707163087, "uuid": "79cf5cd5-e8b9-4731-9c05-0b50ae0579e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7811ce9-c3ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121463, "uuid": "9ee43d0c-b44c-47cf-87bc-33d781c14c8b", "comment": "Malware payload (AgentTesla)", "value": "a7b27b3e7a05d341e7f3125ce9dc14e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121463, "uuid": "bb214c41-a49b-4edd-91f6-25164b0a0072", "comment": "Malware payload (AgentTesla)", "value": "652bea988a1fa3423a289a5a667848489fa5b786cc1cec9dc4e040d562734216", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121463, "uuid": "c9a6713c-f9fe-480f-b632-b520a220d5ee", "comment": "Malware payload (AgentTesla)", "value": "2e8ae870312bcad0a68e617037823f3d2fdcb9c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121463, "uuid": "3af3ceca-f501-4fb0-a232-ab09ff2738aa", "comment": "Malware payload (AgentTesla)", "value": "f12f6dfc10a94b35fb281bc46908ca49f8bf596d81c846ace9a96777fa27693ce185848aa1c8e7efb2aadf4f6fa51a94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121463, "uuid": "b393be14-f637-45ec-9e50-a8601b110424", "value": "T12EE4121627F91737C2B983FE10B2464407F975ABFA01F65A0EC991DF66AAB004D44BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121463, "uuid": "b38eca1f-408e-40e5-aaf8-9bd7bbc99bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121463, "uuid": "50d60f1b-0f23-4c83-9d64-dfd5517bc7d3", "value": "12288:nNOOx+7agIpiAkZalzPYYcGoH2ch9bCnKBKRKfegU+Ga+2d53rD227:NvmagOZlzDDehXFoKfeGGa+SrD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121463, "uuid": "d63465cf-0e01-4669-9261-fa21c8ce70a5", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121463, "uuid": "70ec3383-9791-4ec6-89de-f3a4653d8df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121463, "uuid": "d5584e27-c5e2-4a15-ad63-a27ac01feb13", "value": "BG5Hqhper0CTtro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434de346-c419-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707132327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132327, "uuid": "23c967e7-d66a-4ffd-908b-3fbb2ba5038f", "comment": "Malware payload", "value": "78d72652abfb0a28b9404becddbff3a2", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132327, "uuid": "9c274317-5479-4636-9bbf-6d394ce1a138", "comment": "Malware payload", "value": "656403bc2dccc7a2fcda90e5347a5765859249de78ae242a0568adf8af6ca001", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132327, "uuid": "340a4c0b-c2ec-4cb1-9539-aea8ff5e1c46", "comment": "Malware payload", "value": "0ef3fd4466616422e7b4aa6cadf92bf58f9909ec", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132327, "uuid": "05c80b74-b436-4bd5-b480-fd52dcf9ebe1", "comment": "Malware payload", "value": "82d23e3f4a380d93c631d6505ec491d535536cc60cb733c3c0e5be1292c64d34798ef946407b7a90156799ac83b32c05", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132327, "uuid": "2909a91e-cd9b-43ff-82df-7b1cca9550fc", "value": "T163230113EA08A4BFB4BB87AC2A395F21FE0C8B44D67B47D81BF6C056E2B81195574770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132327, "uuid": "a0cdc079-6849-49c8-8101-638cd50119f4", "value": "768:FD3alANj3c2oJclLBSWtF6GGtqtACajHLW/8s4JImzh6Wiz1/yOAXtQpVjdW:h3oSj3cbJcqWOGGYtAtjHc1Yh6Nz1/y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707132327, "uuid": "7bd2e0f7-4ba3-4cdc-9d8f-b2247f87b330", "value": 48215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707132327, "uuid": "ec82cde8-5ca5-4eb0-9388-3267059b80fe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132327, "uuid": "4591a18c-9471-45a1-a858-8e89b0a05aa3", "value": "Transferencia 09799007678945.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51221484-c43b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707146953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146953, "uuid": "6b766546-3bb5-442d-84e4-6e21724afa0a", "comment": "Malware payload (GuLoader)", "value": "4b808e92ccc7b0ccd3070e6b3b120b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146953, "uuid": "666070bf-1fc9-45bf-a4ab-3b1364b9b997", "comment": "Malware payload (GuLoader)", "value": "65f51b0d7a7d581b0f870819ca591ecda3f99c1848d5eeaf8d18854753fcea3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146953, "uuid": "7bd11b24-5fa7-4ceb-83d7-8c173877d0ef", "comment": "Malware payload (GuLoader)", "value": "829718e98c0037d77815f0a8927c3e8be3baa42d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146953, "uuid": "f10c8f7d-5541-415c-a0cc-eb8d7ce5794f", "comment": "Malware payload (GuLoader)", "value": "e40f262564031b55f956ef498f020e6b3c65077fb470a67b1fc84c7b5fec372613d8f6249a5d5ffbb0717b2848993246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146953, "uuid": "2abee67d-41f2-41d4-b61e-57dfd859de85", "value": "T174D4F2F2E5508096F85F24BF553B9E5693D03D3999CC264A324CB6AEEA730D30D23A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146953, "uuid": "8b6fd516-1743-4b61-bcff-41577ac64b3f", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146953, "uuid": "a763b94f-bfb2-46d3-ab23-81b069f9015d", "value": "12288:XhNMKBSfLJ0/MXB3OTj8e3yvraejdNDd0EIsu3Vg3Eyuz9bUrN02:XhaRfKgJOkIi/mxpKoar1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707146953, "uuid": "9a5c227b-9f4b-40fa-8846-e18a32708c8a", "value": 646560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707146953, "uuid": "759bb559-ac03-47e5-9533-77caa989f72b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146953, "uuid": "ebf9a60a-5dcc-4003-a85f-68b9ceb1fc59", "value": "65f51b0d7a7d581b0f870819ca591ecda3f99c1848d5eeaf8d18854753fcea3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4519084-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707128732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128732, "uuid": "6544328b-0c64-42d8-ba04-c7b55087c3a6", "comment": "Malware payload (Stealc)", "value": "cbf42df596dfbddc2d1dcded5018b5c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128732, "uuid": "f0922f09-6331-4af0-bdb4-0db5259c6297", "comment": "Malware payload (Stealc)", "value": "66154c5b8e0c5b1efeb07331e240f71a1df15b6e42de7f03198fc313bf94bd20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128732, "uuid": "5e7f9fdd-115a-47db-811c-1c3c20a80ea6", "comment": "Malware payload (Stealc)", "value": "fa0e193bdcd4e482e5bca7205b1bec4b81c328df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128732, "uuid": "5761ae9e-53d8-4156-9d59-3ef50972418a", "comment": "Malware payload (Stealc)", "value": "0642ac3e4b6a259a1883e11a18c4a46f6c40f2ba1c2dcd8829b8d5f688aea7981fcda4e9f10002de2c83341b52dd736e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128732, "uuid": "c607442a-cc41-4f6c-9ec9-27ecceecc132", "value": "T186647C5396A1BD50ED664B739E2EC6E8BA2EF560DE0977762218AF1F04B01B1D173330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128732, "uuid": "2598bf04-9cc7-4cce-8063-6d10a059e30f", "value": "6f6e66c83b55c41c6909219f9159d382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128732, "uuid": "b7cebe22-ef5c-41d0-82a2-e019bb1e6692", "value": "3072:wwURLDZj6w48xM4w6bR3ZsjiilUOqd2olQO5oEvDIC7OBm1X3uXF5JFtRYMupIM+:wHRLDkKM5gdZmlVi2oWSvv2FtRYkM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128732, "uuid": "598eccab-0e78-4f6a-8501-29b5ce7a2cf5", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128732, "uuid": "cd1f2a47-e437-4d8a-93a0-b9aa05c3b026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128732, "uuid": "19460b2a-bc37-4533-9fda-c22e4c92bf3d", "value": "cbf42df596dfbddc2d1dcded5018b5c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f3f426-c3ea-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707112043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707112043, "uuid": "3b60c7b7-0b96-4416-b7ad-35b06a236fb7", "comment": "Malware payload (AgentTesla)", "value": "c9b8700a203765f2bfdc179e378eb6a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707112043, "uuid": "4508b918-a28f-4a53-86d7-f07bd29ebac8", "comment": "Malware payload (AgentTesla)", "value": "66336423d2302a83c86c1eca1dc87487dcd66dd85cfdf9e8e4c74fd3daa9d11f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707112043, "uuid": "f473d05f-1267-44f0-8f58-8146dd286641", "comment": "Malware payload (AgentTesla)", "value": "ff7e6fa2adffd43c1a52eeb0483ebe978da3dc63", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707112043, "uuid": "01c5e9b0-b996-46d6-9478-d66c64ca44cb", "comment": "Malware payload (AgentTesla)", "value": "fad834d86b770ab3828a5c708cc4eeff0537d102b3e212365208d3dfbf44ebc37f6ad590ed3006b0282a27ff749a3aca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707112043, "uuid": "dde7c47e-823a-41c7-844a-fd1107547e3b", "value": "T12FB24919B3E84A33C8AF57793DB332001738B5475A12CE5F6DC6548A49B3FE44A12F62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707112043, "uuid": "4cdeefb0-ad56-4b18-8b16-0f36f36e04e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707112043, "uuid": "0b5da39f-fc8f-4b97-8fed-a7f6edd7411d", "value": "384:EFnK+C+WqOU9/h7IvlcpkvJI1RzqZO34JLg1XAZaHjGSX14VP6ik6bcjZOVUpj:mK+dWqOU9/h74BOwZOEg2MDGSF4V/bo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707112043, "uuid": "42d58638-5284-454f-b99f-dba04cad0ae8", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707112043, "uuid": "a3448ba5-b563-469a-86ee-5fa522083f96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707112043, "uuid": "86f305b8-91f8-4de9-93c9-cc771b17737c", "value": "RFQ-20047577Q.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b86f52e-c3fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707120798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120798, "uuid": "26edde6c-c80d-4bd1-b978-37c1eaba26ce", "comment": "Malware payload (AgentTesla)", "value": "56cd61296335552ad1f5f72494ec2ab1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120798, "uuid": "c2cc5e87-7143-44d8-af52-225c595bcbfb", "comment": "Malware payload (AgentTesla)", "value": "6924fb2d19d5a349c884509451a5f30c4404360ddad9c203e8e5ed6f89820305", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120798, "uuid": "4777b4e2-6114-4635-8eea-0e86bf23725f", "comment": "Malware payload (AgentTesla)", "value": "d3cfe76237e27b0ca4970608ce2b3a7a732fb00e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120798, "uuid": "661485f2-291f-4093-b526-713f0a682cdd", "comment": "Malware payload (AgentTesla)", "value": "a5384abf00e20a7be15d4295a60fd86c54927dbf7f8cb0ae65d71a6be0d03a3c70411c52402a01cd6d598e13d7078ad3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120798, "uuid": "1ba6143b-a3ca-42d4-b394-bea0f65887c3", "value": "T145B24A1573C80B32C9BF57766D7221041774B6178E03CEAE6EC654875973FE44622BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120798, "uuid": "62dc8d9a-097c-411f-9f6c-202948e3e359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120798, "uuid": "244c041e-5648-4e15-9ef7-b334f12b0324", "value": "384:wAjnxtLqXUB/F7Ivwl4HHryJUPTFpVIbIm/sCoAo01GGyLkyZCOVQ9:FjxtLqXUB/F72WUrFpVVGYLJ4OC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120798, "uuid": "dc35db5b-6e19-42f7-bb78-504899108102", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120798, "uuid": "ebbca811-09d7-4ddc-9564-a5bcab826905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120798, "uuid": "663c9b3f-7332-4bb1-9426-d7243ba73d48", "value": "AHMED CHEM CO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bf5d21-c423-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707136787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136787, "uuid": "4235d910-8e2f-4e39-a234-efe036eb78dc", "comment": "Malware payload", "value": "9a929e07041c7f73f38addf39099738f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136787, "uuid": "b12a8912-1f9d-46ee-a8ff-7e84d6c2de16", "comment": "Malware payload", "value": "6b2e51f4c3cadfd3441d843a96ebb56c50cb132ced3083bbf2f0ac760aca121c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136787, "uuid": "c086cdd4-dd17-4e50-b0ed-3859443ec3de", "comment": "Malware payload", "value": "f35be99d9b50bbddd3e8af3fa955e1be4401f894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707136787, "uuid": "71ae7e4e-23d3-4548-b045-0072e551c558", "comment": "Malware payload", "value": "b097de18026cd5fb270e2920d6556a9814003c01d579ea54e133e43a113964da96e55e85d80479a3465a6801ef91c708", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136787, "uuid": "aca28ba1-7649-4f45-90ec-77661d9a5c36", "value": "T1BB0833AA0A45311AF0E933FA3F3E6DEEF634C0012B5555F3AC955686CC83CE66C6846D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136787, "uuid": "fe2c3984-a2d7-4380-8311-3b0ca4d13830", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136787, "uuid": "e39a0f2d-7cf5-40ec-ba99-ad651551cdeb", "value": "1572864:3D6LBYYcLL+oX5YQxwhoZHBFdNYZvpXm6IKEp:36upnX5RxGozFC3IKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707136787, "uuid": "dcd41779-43a2-44f2-b71a-ca53e6f4a094", "value": 82587443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707136787, "uuid": "fa706d5b-050f-48f5-b42e-faf45ab18cc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707136787, "uuid": "3eac99b9-d163-459e-94b6-c054cfc2a879", "value": "Planets Therapy Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6312c1-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1707144078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144078, "uuid": "dc763d22-6f72-4c57-914e-2677ca782814", "comment": "Malware payload (zgRAT)", "value": "b01be8ef39a8d997bf0e1ca1bc36e9cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144078, "uuid": "0602c915-0b98-42eb-a744-837be793604d", "comment": "Malware payload (zgRAT)", "value": "6d9463fdeeaa97e29dbace69e8ed261d858b47b9bf20e8d7b68ee862b9ae3218", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144078, "uuid": "e7c7fae0-60c6-4c9c-9b80-3be5c5d1f5e5", "comment": "Malware payload (zgRAT)", "value": "cb92df80b4767179cdebb244f04144d2900c8edb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144078, "uuid": "b6c2fd72-386d-4c30-bf0c-3a5062d9585b", "comment": "Malware payload (zgRAT)", "value": "0f7f91cf361fa95323480f4e7881980fad51a1b856950e31b0348c472ce73b620c9ad7ed649bc5555e4c9c5864b19eab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144078, "uuid": "9bea12d4-9ee1-4aad-929e-f40511a3854a", "value": "T1A27501567B260A32C769AB35DA7B9300071AF6B2D163D30B73D8623A60173BF1F95742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144078, "uuid": "853b94f4-1fe7-4e04-b130-8cc0013608ca", "value": "24576:cN4DYDuGXDq7cmQ7FoES42ODcd9+2SuYsHgyWVzK9bN+8C9Gkh+p+UQQyfIEKI01:0YYDuPcmQh9COQ9NYsVszCTirBQyhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144078, "uuid": "935ebb28-91bd-453a-a361-e4a6fd41f33f", "value": 1574400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144078, "uuid": "aa1ff48f-c0c4-449b-b71b-3da001dbb6f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144078, "uuid": "19b45612-0705-4be4-a624-29333e8c4540", "value": "Hsbc _ swift _ 103_ copy 0382328364891237 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "497144b2-c41e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707134485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134485, "uuid": "b453e67e-cc8d-4869-b970-60e1a0cb858b", "comment": "Malware payload", "value": "e86c451fb54d20fb54c99ccadbcd265f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134485, "uuid": "594f4642-268b-4abd-a151-fd4da699904d", "comment": "Malware payload", "value": "6e19e51b601177e842d8b09b8e2f01e16431a4472d848ee22d7f8cd585549608", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134485, "uuid": "6fc05af9-128c-434d-abf9-4fe43ccdff0a", "comment": "Malware payload", "value": "6e33999e72a1cecbc46a7198d614a2cd547c9e09", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134485, "uuid": "da494e04-0fe4-41ee-80ae-2f0e8bcead6a", "comment": "Malware payload", "value": "3c077a100cd8bb676c2d384cb833f453d1a9e56f6ad583f768a8a3af8d9c5fc2fb1a048e1f2c9cd1f083a8432e14fbe3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134485, "uuid": "cb929b4a-c538-4db8-b51c-853dea05df52", "value": "T18BC3046DC34B02698F624376AB171E5142BDBB6EF38552B1306C437933EAC3DA1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134485, "uuid": "4adcfbcf-979b-4c66-b730-74aac237977c", "value": "768:0wAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjgdN7kqyhizLeUwyFtxZ:0wAlRkwAlRkwAlRX1rF/33FoySZuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134485, "uuid": "5b5165da-f9d2-4b0a-8257-002cf7e6de36", "value": 120604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134485, "uuid": "299a3b28-e774-478a-8dea-0621857a5680", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134485, "uuid": "6e445917-ff2c-467a-a97c-0dc9b963b606", "value": "RevisedXPI.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8d0e41-c475-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707171746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171746, "uuid": "ebfbc789-7af1-440e-8b13-7789fefbc05c", "comment": "Malware payload", "value": "8863f719bc767985bea52947194297d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171746, "uuid": "360ca070-9936-4e6c-a2dc-73ded2bda427", "comment": "Malware payload", "value": "6e3c515bbc85c113a50cf5f145f28275bb1217cc5c321cc8b2fa87c5dbd603c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171746, "uuid": "d8f35b15-5c28-4f6d-a2c1-1e3c5009d47c", "comment": "Malware payload", "value": "2f6bf1f542b0ad06b78d8e3b4efe14b8e2b80c9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707171746, "uuid": "69c0b145-4560-41eb-8582-e8f225ecf4b0", "comment": "Malware payload", "value": "c02701e8854c3e412c61fe6858b1c211cdb1c22e5781a9aba2cfbf844edf570d60cefd7ba1666c71016fb4e3dd2a53de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171746, "uuid": "dee8491a-273e-40e6-ac08-39149f3aadf7", "value": "T1DB244C4271C4C032D5BF547344B2E9A3BAAFBC3539638FB7239416AE0F116889F19976", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171746, "uuid": "7cb5e195-6ce3-4ac9-b13a-dca74dd37398", "value": "e1ed1b87d365b2ea75670bba09649dc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171746, "uuid": "17de804d-fbaa-4326-80ef-c94da3b8b14a", "value": "3072:8mLd2f5yZBRE34J8Quhn0o2lGPetr2MV4y3rIXygDYnm9EpcoP40AcvdWPrTNphi:95EOb38QS2/Zd7lpcT0hlUXNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707171746, "uuid": "b582228a-885f-49b1-95cc-9f3b16a5003c", "value": 225752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707171746, "uuid": "f3853305-25ef-4c06-be41-6c084807ae6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707171746, "uuid": "e1e42944-86ef-4906-a567-3f37c6765ec6", "value": "SecuriteInfo.com.Trojan.DownLoader46.42360.25391.2939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4784ab-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121950, "uuid": "07c4153a-8ded-43a4-b025-75355541386a", "comment": "Malware payload (Formbook)", "value": "64ef207b0e5956385403d00c93791c4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121950, "uuid": "1975783b-8c99-43ae-89d5-8609c6f3bd11", "comment": "Malware payload (Formbook)", "value": "6f98f835077102018cdc2dab07b6c11f7681ca2e2dee2776ea578ac311f4aadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121950, "uuid": "2cc40edd-2f3a-4009-9238-551591fcc384", "comment": "Malware payload (Formbook)", "value": "620a178255044cb5e0508a03b79b323e922c103a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121950, "uuid": "ad7ff3e5-e45e-4685-a23e-043823a62600", "comment": "Malware payload (Formbook)", "value": "5788f3361c40f67ed350c5914943705f58774e67b09b493c2333658311ddc5f40f55fc0d1d148c14650442228184a7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121950, "uuid": "4a3bb1c4-b145-4368-8334-46dc1edfe3f7", "value": "T16004AE36D602C070F2B215B5B66D1B7B883D0E357294A4EAA3E126E05FE48D5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121950, "uuid": "54ab413c-1e5d-430f-8bab-b731dda9e4ed", "value": "3072:Ch5MEfXo5Fwd38wi8kHaJ47yxp00CABkW+ALRYpnz:CxFR8b8QaJ47Up0BGkW+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121950, "uuid": "c676aa98-eb5c-42ca-a67b-ab9792024595", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121950, "uuid": "75fbd3e4-596e-4ec0-9030-aa59bebc2bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121950, "uuid": "e165a989-c2ba-42d0-8ccc-9e58bb517439", "value": "6f98f835077102018cdc2dab07b6c11f7681ca2e2dee2776ea578ac311f4aadd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa17a4e-c46c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707167961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167961, "uuid": "9c335d1e-cbcf-42df-862d-f509b08e6bbb", "comment": "Malware payload", "value": "89cd525b58859263d5ccae6b4940dd87", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167961, "uuid": "960c5d07-75c2-4a83-bfb8-3de8cb9bd91f", "comment": "Malware payload", "value": "6ffeda62c9981ce544b0503ecfdaa4c0347746254836b3a0edab65e5355a9b89", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167961, "uuid": "fd3bb6f9-77ab-4aff-88c2-335224c13215", "comment": "Malware payload", "value": "b10a3c6baa9ab919931fc452e42c729f1f515f04", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707167961, "uuid": "88d295a7-9680-4090-9d6c-600a4342bfd3", "comment": "Malware payload", "value": "467b30343c0c14c39e2fa80c00ee73f0905165076eae68423f14eeba1359395866f92f32271ee426b87d53214ecb8a91", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167961, "uuid": "a599c27f-9163-4c6c-9a3c-d0b6315ab3b9", "value": "T1B0672303EA58CB96C0BA43F16A230E992D174F198643AAEF15187BAF3C735D50FC958D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167961, "uuid": "cf32e5a1-51ab-487c-9b44-d4cd9f0f337f", "value": "786432:bG5ryiGMntKous2UwmLqb9wJoPEHiAfmThkYUZAUPZ9yU0voq2z:bG5rylMntKous2ULqJ/6EhkYUZ9ad0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707167961, "uuid": "98a03f0f-737d-46a3-8eb6-ff3cb79c2d71", "value": 32129274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707167961, "uuid": "a5c9f688-eddd-4b72-a970-5842161d8dee", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707167961, "uuid": "8ac66bb7-9be1-45ae-a2f4-5ccdf4f7739f", "value": "metamask_v3.820233.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fce07eb-c40b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707126335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126335, "uuid": "725a79ed-969e-46f0-a7f2-ca6290e731d3", "comment": "Malware payload (Stealc)", "value": "5fa7ad590c3cd426256d9d566a763d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126335, "uuid": "d95271f4-a711-41c4-babb-0b71a50d9ead", "comment": "Malware payload (Stealc)", "value": "705efe0949189673f83b5853e8fe358a4eb96d28e778194a36125edcd997cd24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126335, "uuid": "eab512c4-4424-41cb-93ba-d70611cd7989", "comment": "Malware payload (Stealc)", "value": "6256656e428c7cae579165d5be254493257cfdbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126335, "uuid": "e53776b2-e57e-4f7f-93ab-715550137f59", "comment": "Malware payload (Stealc)", "value": "b8d39bc4011a2385707d1aafa7d73ec7f9d553a7b5eae1c45ec277e3cce0b79d7886589e68526d0c0e305aabf5647aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126335, "uuid": "393fb250-3183-4bd6-9084-fca7036c1cc7", "value": "T1CA647D93A6D1BC50ED264A738E2EC6E8BA2DF560DE5977762218AF1F14B0171D273330", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126335, "uuid": "1f0d41a4-e67a-4bc9-9a1e-25a070014552", "value": "6f6e66c83b55c41c6909219f9159d382", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126335, "uuid": "303f9112-dd9d-423d-b32c-b325c882d704", "value": "6144:WiRLDkKDijJm8CR2ftW+2UcRTJyrtRYkM+:WcPkKDijJmH2ftW+d8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707126335, "uuid": "35fcd400-0eb8-4830-98dd-35a9ef6d8326", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707126335, "uuid": "13b9f15c-f3ed-44b0-9a1a-ba7f18736bc2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126335, "uuid": "cce8d599-1a3f-483e-8959-816b5b38e0a2", "value": "5fa7ad590c3cd426256d9d566a763d82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79a9c93-c476-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707172466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707172466, "uuid": "e771970e-e64e-4511-b309-7632be08ab5d", "comment": "Malware payload", "value": "321c93ddf124cb1b7f4463d5b4479546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707172466, "uuid": "9f619bf5-016c-43c0-b817-dd657ac21127", "comment": "Malware payload", "value": "72aa3b6f49cb6e40559bcaeec0a209959e55a6b47671b45581acd2e718b76dc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707172466, "uuid": "9219f5cd-0384-45f2-b4d6-e47c3610a67f", "comment": "Malware payload", "value": "b6d023703f6272c8e558a804af12418df5b7ab5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707172466, "uuid": "24197a9e-af0e-41cd-816a-9d8fada33690", "comment": "Malware payload", "value": "f683f6e8a95a886921f4d08745659e1f079fc8b186ea24954372da879a96c97b169c3e3b9ca8775ac2838d044960f921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707172466, "uuid": "68175267-94b4-489c-9525-0b84cc9626ae", "value": "T1583309B9D39A6923C65D073AA8B72F23CB74D5519726E35F1A801E2D0DE7FD0CA40E12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707172466, "uuid": "0ac65a20-d5d0-4001-8ddd-f13658eeb0bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707172466, "uuid": "b1e08215-5318-4a84-b46a-bb20427085ef", "value": "768:+X39Gtq1ZcNixoNypja3JL4R5RZ24bmFWnB02aLLLygo1WvWtMTzWsoDXP3w:+X39Gt42caM3hBzB02aLLLygo130Efw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707172466, "uuid": "98766539-870a-4c76-8d5d-46157d7dbe16", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707172466, "uuid": "d80cb1ee-f97e-4e71-ac18-9d3e4491cd67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707172466, "uuid": "0cc6cf1a-f337-493e-8f19-943556cde133", "value": "Factura Proforma-Asesoramiento Bancario.Pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849a0d7e-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Metasploit)", "timestamp": 1707144463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144463, "uuid": "7ed08957-13a5-42cb-83a6-b20722f91758", "comment": "Malware payload (Metasploit)", "value": "a16c3e4711c591850a5fcc3f3ae8c4ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144463, "uuid": "6fb59174-1db4-4218-8564-4a8f7e3990b5", "comment": "Malware payload (Metasploit)", "value": "7309ae709c50e41ae67fbfd96abcbf91d7a3b6341a8cae8b51b983cf64e94b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144463, "uuid": "10e86150-b79e-495f-b736-18b6b5d809f1", "comment": "Malware payload (Metasploit)", "value": "df54768371722578e17eba0f0dde0e637c49f03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144463, "uuid": "049fdf08-6079-4d4b-bdca-62ba3d2eb20a", "comment": "Malware payload (Metasploit)", "value": "81fcb3c566899a34c155e59d9a6f1761a77fe1d2ce72549a7271f4530d1c27c5a29cf2035a4f1b43e1acbbd8d21a5819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144463, "uuid": "6303bdb3-72aa-4edd-b1e0-c3d2174992e1", "value": "T1AD73C002E9C41435D272117E5BB53AB96A71F5BB3202C19A768CCDE6DBC1CF0661B3CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144463, "uuid": "9ddbb5a5-6717-4f68-b1fe-ee545b2b6178", "value": "481f47bbb2c9c21e108d65f52b04c448", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144463, "uuid": "ca7b1f11-413a-475a-bc4b-e42041573b1f", "value": "1536:IDdOkM5IXTzdBUYOE4FIJQDZ4kxx7gbrwU0CJgJkcwMb+KR0Nc8QsJq39:adhvXTUYHUIE4ccwU0CJgqe0Nc8QsC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144463, "uuid": "fe0f07ec-8e68-476d-a176-47e4885edb62", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144463, "uuid": "e3f12352-6d7e-41c9-96c9-5469bb092cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144463, "uuid": "b49d6391-38ea-4d98-9461-9df275e045f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c1ae4a-c3f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707118829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118829, "uuid": "2d07d86d-4d7e-492a-90a4-1bf7602c8311", "comment": "Malware payload", "value": "c7a306ab1a5aee3972c22a8c699362bd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118829, "uuid": "a1f262b3-b7dd-4621-8e6a-9df8ec47745e", "comment": "Malware payload", "value": "74713e39a859874650720e651276774b8a7bd8575c98089d57ae2a47fe702552", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118829, "uuid": "1ca043c7-62ed-4150-bd19-43633c35ca71", "comment": "Malware payload", "value": "5a37884c629cfa7643d1985b436815f25d9e714f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118829, "uuid": "a8c70d90-95ba-4097-8c5d-12e89fbcf729", "comment": "Malware payload", "value": "44e733b55efc5c9d45fb373ec40cb96fc3e0c76887eeb1f473804f536cbc8dc488d959a1ddce2896061248693ec0c009", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118829, "uuid": "deecf6cb-93d5-4020-9b7e-4582a2552f3f", "value": "T1E8A733D27C410101ED2F6F776279695CF52FAD312B75A6CA7238B22223B72948538D2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118829, "uuid": "bb91f49d-3b60-4bbe-9263-3722287bbad8", "value": "786432:KDj/y9fAm6SXOHiv5PktegNVvBuztwGkQMfv+7rdLtArx:K3y9fQjHihMggNVvEmGkpUrdq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707118829, "uuid": "e1a52c43-7abd-4795-87b0-f55ef5cdad0f", "value": 45335040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707118829, "uuid": "a16e07de-42d6-4952-b4dd-dc0de2bfb254", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118829, "uuid": "9437315d-294c-493e-a83c-877b0b4c2b62", "value": "SecuriteInfo.com.BScope.Trojan.Wacatac.27894.31333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec14a35-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707144023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144023, "uuid": "aaba9f38-eb95-4000-b46d-874bd46148a1", "comment": "Malware payload", "value": "02eafc283dedb694c4039321f782520b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144023, "uuid": "34e143bb-cd28-43f5-97ed-8f856c9e1a14", "comment": "Malware payload", "value": "74abdab10bf19bbb9ccd3758bac9e623c308b5a997e7ca4324267f93a26b4e7d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144023, "uuid": "c982495e-0752-4372-9d38-e0923591fc42", "comment": "Malware payload", "value": "2772cbef15a12063a5e7506e74c02cfb0f27b941", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144023, "uuid": "e9dc61c2-63ec-4722-9a1d-48777e7fd0f8", "comment": "Malware payload", "value": "2005271b46d665155098959f2b8a83587ff23a38d1ae1a7a0ee0bb0ac41d9947df051f73554aa345db1607beac0300d7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144023, "uuid": "6a20a41d-e924-456c-bd18-baf002b5bee9", "value": "T1901100A947281E7FD4B342B1CC39AD4C89BA8CB30A4FE04EEA233584C9655E11FC564A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144023, "uuid": "00131056-cdd4-42e6-8181-4dc5832dab4f", "value": "24:8rBJldAhWXaAIC0IEgadEEq40uTSITfPuain:8VJzAhWXHad0cTfPuaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144023, "uuid": "3f62960b-b087-4f08-959b-144a17e04713", "value": 1074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144023, "uuid": "e2dce406-bef5-476c-90fb-0ab404102cfe", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144023, "uuid": "b79900ac-7c15-43d4-905d-3bb8eef1b6b4", "value": "RLDTLLRLDTLLRLDTLLRLDTLL.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd2fbb3-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1707141737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141737, "uuid": "9d57d4e4-924b-499d-aa1c-1df00c7debe2", "comment": "Malware payload (DBatLoader)", "value": "0c5525fcccb9b819921fc714c98e0460", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141737, "uuid": "121f31e3-0043-48af-b720-685fb578fe1b", "comment": "Malware payload (DBatLoader)", "value": "77b6a9e31888920135d15d6effe45649e760897d42191d6f64d87d1bb20a4249", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141737, "uuid": "5ff872ba-dec1-4479-89ee-e7a7e62d4438", "comment": "Malware payload (DBatLoader)", "value": "a9a22637ef82021db488bb2473f2ddf8ddb36ad7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141737, "uuid": "81c30b0b-f1ad-4089-91e0-ea88f7e5e554", "comment": "Malware payload (DBatLoader)", "value": "a8430ef960e371480f6ddeeb07fb6aaf688af9510b70be99d0a9adcdaa426085632bd8879969082167b46e49a4ccf1f8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141737, "uuid": "b52ba365-43fc-4528-98b0-afb49085a90f", "value": "T116A5DF7572908479F236AD36CF0763F9467C3D22293574C56FE22B0A4EAD1B368392D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141737, "uuid": "426ac1a0-de47-486e-af75-d784d6a39e06", "value": "49152:JSWwYud8nJ/ox0Pi9HVo/B/QAB/IJV7ks:JH0d8Bc9HVo/B/QAB/IJV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141737, "uuid": "87a3a9f9-7340-4496-9b52-72a3c24a8e8d", "value": 2120851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141737, "uuid": "1ebb84a9-7fa7-4cdb-a978-37dfd4f4270d", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141737, "uuid": "8067c65f-0d8f-4fb7-92be-9e203683316e", "value": "rPO9003293.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648262d2-c3ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707113915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113915, "uuid": "3d70b378-f84b-4bdf-869f-dd623d5feea3", "comment": "Malware payload", "value": "c9c98456e3540cb3dc80ef41a3c6e4e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113915, "uuid": "f8ab692a-0750-4e46-af53-3345011d0369", "comment": "Malware payload", "value": "79b602eb2703918564bbfa01cded77f8e8308adbeec88a6709d2d78f7509a9a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113915, "uuid": "efa1a68b-a987-4501-b387-db97056cf9ef", "comment": "Malware payload", "value": "bcc57bd87f1a1092dc940f3605924e5f1cd72495", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113915, "uuid": "0ec35190-3e46-488c-8827-6c9a0d8a9a3d", "comment": "Malware payload", "value": "750047fb74286f4e87033f2c61fed946be1a752fa9800aab5c06d29d8f5e77550ba59b17c702c78d95f3bf1887428f5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113915, "uuid": "c793497b-3e0f-452a-807b-54622c12430c", "value": "T10AD52311F6C558B2D56324332A306721A9BCBC306FB08EDBA3D996AFDF211D09631B75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113915, "uuid": "a8efcf0c-79c6-4b48-af6c-9e887f68efe1", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113915, "uuid": "704a752c-b1c7-42b4-8238-851cbf3dfc0e", "value": "49152:6ILEYrXdd9Q0O3dWsKe7JrS8kP2SnoWHC5oivS56apE3i32HAS0xlWsFVK:6VYrX7etDX7J++SnoLRopE3AtvFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707113915, "uuid": "17c682f3-76cc-4c28-9a7a-702ae9e85ab9", "value": 2939184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707113915, "uuid": "91bedd47-13eb-488c-aa9a-8729ea6d64cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113915, "uuid": "0cf59e72-2a58-49da-9a75-820e9123ebe6", "value": "SecuriteInfo.com.Trojan.MulDrop24.61037.18835.15227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb138de-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707144152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144152, "uuid": "f4d49725-2605-4896-b73d-8048c191bcc6", "comment": "Malware payload (Formbook)", "value": "23cd36c1946f2412a2183a12cf4fdaa3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144152, "uuid": "bbbdcfde-cc4f-4c4d-8a4d-c81d6714b080", "comment": "Malware payload (Formbook)", "value": "7aa1c19a3c4e2ebcbe15bc2d98dd4fc4aa93fd2cb9130290d17bef4faf7c2fea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144152, "uuid": "94f69d9f-b6f3-469b-93dc-ab035aa730ed", "comment": "Malware payload (Formbook)", "value": "f320865cce96eaf0889fdf8c997c65153e65711f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144152, "uuid": "829b6284-1d2f-4f31-a592-cc1e4e529e21", "comment": "Malware payload (Formbook)", "value": "bb9133b49795db4a9a57afbad158c3f1d7fc1f3766f3b96863adf017e7de3603cd0a9173563b2e96afe337c79e6da258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144152, "uuid": "5cb9ad6c-c606-4315-8211-9ff9a2c255a7", "value": "T14F0501562294EF67C43A07F1C56188A913F67D6AF830E28F1CC67CE77AB2B904664D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144152, "uuid": "59a0a5dd-ddc9-43cf-b51c-24353880c686", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144152, "uuid": "93a6026a-26cf-41a9-8b34-e1e36300995e", "value": "24576:vpGIr9cxfQ2wvbGwicvrgDOaZg+5M+exmJhI:RGIrcOG4VN+5Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144152, "uuid": "90b56cd5-346f-4250-bda8-000447c4429a", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144152, "uuid": "f10a0e8e-7730-4b2c-90a1-c9739d59356e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144152, "uuid": "b6718ced-3786-4e06-b21c-854409e79101", "value": "Remittance_90523_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "274716dc-c3fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707120684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120684, "uuid": "8b8b19b7-613a-410c-a151-cb4569107403", "comment": "Malware payload (AgentTesla)", "value": "1cc77f1ec01bcc1b55d11262f2a1bed7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120684, "uuid": "f28b5984-d20f-48a5-9def-59514189c0ee", "comment": "Malware payload (AgentTesla)", "value": "7ab5b0d0820c0e94d5d37d3a30a4ecdbc4eca681f4d48307d9b556bbadb8e0f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120684, "uuid": "6e1b4020-fb26-4449-94d3-4b47a6a7ff7c", "comment": "Malware payload (AgentTesla)", "value": "e6c733dee749bf201e11ed03c7c6155b2df9108f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120684, "uuid": "1548bad0-95a4-4b94-b3ce-faf433349945", "comment": "Malware payload (AgentTesla)", "value": "1873463492194add1b0194de10fed4dc9c4891cf5e61083e252d8f59993ea9cd3b5f04a67ea805075e196ff75936c998", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120684, "uuid": "327ea70b-7f21-4b6f-863d-d1a705d39011", "value": "T1F30501922158EFA6C87907F6C56054A863F6BD2AB931F28B9CD23CD737B3B904520D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120684, "uuid": "cd011845-c778-4020-86fa-9d2fa8ebc3cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120684, "uuid": "a4944ad4-2913-4c15-9ef6-3e43c2bdc6b3", "value": "24576:DpGIr9cxBrcP7ewyEhMMJKC+Jda5D2308r:1GIr+rQZyEhMMoTda123", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120684, "uuid": "0e3ca662-51ff-4ed2-affa-33e75ff98d1b", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120684, "uuid": "789d8f01-594d-460b-abd9-97643c6a5434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120684, "uuid": "ae647384-c83b-42a1-87cd-310ce57b6559", "value": "PO_#1109273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f45ed9c-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707144454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "adbde809-507d-4b40-a07f-b3a0a0aedc95", "comment": "Malware payload (Smoke Loader)", "value": "0daebde971a5f21690f26c1ed8bf8813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "1adaeac7-8c1c-42f6-b43f-08d5633e96e9", "comment": "Malware payload (Smoke Loader)", "value": "7abf5ad882fd72332b0b7fb530c8c6505852d4f7ea39edfe444218bdcd9c7f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "87be6029-3c54-481b-bbd0-13e3c0cae552", "comment": "Malware payload (Smoke Loader)", "value": "361417ed0552958448b0fde6aeb980fcbec9572a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144454, "uuid": "2bdb50a5-4da3-485f-9eb9-42e9ca5e4ca7", "comment": "Malware payload (Smoke Loader)", "value": "bdb611bbeaf9fd2177017d2118be006a5663c3838fa16850cc8685d77e11fe8bf4ffb6964b64979a9befdf755df04a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "e22183cd-6fd3-4a02-a6d0-3527c9e6105e", "value": "T156647C03A2E1BD50E9674B729E2FC6F83B6EF5608E19776A2218EF1F04B05B1C563711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "fc3e2534-2191-41d6-ada6-d2c5e1968988", "value": "b585adb193cc73047fae4142a994b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "099c7efd-db47-41c8-b285-a006fd7ada55", "value": "6144:QKILYpVy5qgOWp99sfQ+a/HTXbvOREnsE0aV:zIspVy5qgP2fQv/HbbZns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144454, "uuid": "e2d73ea0-ad4e-4383-9e34-2f3236cb55ae", "value": 318976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144454, "uuid": "2a4eed51-413c-46cb-b81d-0ba3c46d810f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144454, "uuid": "4a844401-87bb-440c-8edf-170253e3062c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b5c4b88-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1707144447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144447, "uuid": "7b2c227e-47fb-440a-b0df-0964d1cf6e3d", "comment": "Malware payload (Gh0stRAT)", "value": "1af97bb3b7d31c81534bc48a84021f32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144447, "uuid": "d789d211-c916-4e64-ba8a-759fe40f8def", "comment": "Malware payload (Gh0stRAT)", "value": "7c7edaf79218ec77462a5097f6860347b905b01ea8c1bc807f6731847770d9b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144447, "uuid": "c34a0b26-b0c9-472c-9d89-d3ed87f430d3", "comment": "Malware payload (Gh0stRAT)", "value": "86a1b4f7abc5993e598ff08f48a2499367d76f02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144447, "uuid": "f8d971b8-560f-4478-84a7-c62e120be49a", "comment": "Malware payload (Gh0stRAT)", "value": "21cd2ea3d29910b2ade22b68031dca80a3ca3b3bbe0de02df0bd5f1d30ee18cb38852a0d32b96d69b5cc9207a3ec09a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144447, "uuid": "17525ac9-a66f-4828-90f8-a541726d60bc", "value": "T16C842325F0980302CFC75739CC698A3B50714FAE4A01ACD35754BD9BFAF167A6E3858A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144447, "uuid": "93f4ccdf-0f48-4444-a376-3ee7b4880bdb", "value": "ef39d474ee88b9215814d74ee695b02b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144447, "uuid": "6fdcf177-98a3-48d1-94c0-7d1b09064baa", "value": "6144:4Gyne2Ko9cK2OHnV7D2djek72aTALaFIm85ZDOFBjb/8o05NYXafC2IxFVD:Pm78gnV/2okya+bFOfv8t5NY12GFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144447, "uuid": "13c26b90-05e7-433b-9775-92b852da0c76", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144447, "uuid": "7ebdd6d2-ddab-4c81-8208-13c5a82bc4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144447, "uuid": "03790054-aede-459f-bdb4-d0210289bd05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3211c45f-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707121990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121990, "uuid": "78110276-0c03-4f39-b1d4-29f9b95d1e2b", "comment": "Malware payload (GuLoader)", "value": "9dfc3c7ea837521316e17310428938b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121990, "uuid": "24c94112-94ef-4235-a44f-2bc5adc29074", "comment": "Malware payload (GuLoader)", "value": "7c940993b0cc03b93a747e8f2391a3a035d17234f7554ed1ca90ff2b36270fd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121990, "uuid": "bb2f210b-b5f0-4ffa-b951-7ef810b1d2dd", "comment": "Malware payload (GuLoader)", "value": "bfb384950c82f58c8397dec5516fedbb02eb26c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121990, "uuid": "2d2e66fb-a641-464e-b982-35c81050506b", "comment": "Malware payload (GuLoader)", "value": "0f971dc8e356c0a3d36df3f98bbc0d0c146fd081fae5ee3970dfbc8a26e3a0a5d678f261fe7177fd96796508f2852d9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121990, "uuid": "513ab8e4-c089-439e-bd47-ee282f3a20ca", "value": "T1AA0501A1E798C823F3D04FF4D150E37E8AB7A6644E56824366FB2D5F7368761782C212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121990, "uuid": "a1670a51-2aab-49f0-8ebf-ed7de7ff858a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121990, "uuid": "f9566baa-407b-49df-bc7b-40d55710001f", "value": "12288:CbLGnzJ//0l7NehtZKtSB3B7wOBXkkk050D3nwxNQdXo3wxS7pE:CbLGF/Y82oBHo0mD3nwPDpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121990, "uuid": "2c33deac-df4c-4c9a-bd95-25dd283b7abe", "value": 817032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121990, "uuid": "8fd1dc41-f5fe-49c5-9b27-e3ddfe34c894", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121990, "uuid": "b9145605-e360-44a8-8104-a295dcc73551", "value": "PO- 55846987.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "165bd1cc-c448-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707152438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152438, "uuid": "7a74f9b9-1a0c-4d89-9b08-89609c6ba64b", "comment": "Malware payload (RedLineStealer)", "value": "79654af854c2c4a27fcac91d377bc558", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152438, "uuid": "44f3ad10-f3a2-4f12-9e07-830e3709b237", "comment": "Malware payload (RedLineStealer)", "value": "7d2368254b35b48490381439afef990a06f1627de0acf24d574e708ad8a7a47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152438, "uuid": "17264910-c5ac-43b7-831a-86097d503887", "comment": "Malware payload (RedLineStealer)", "value": "4007ac6af56b1b7db69c9af1e6ea4cc072e7e80d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707152438, "uuid": "d63ab554-a0af-4487-bc77-3f3e0456f657", "comment": "Malware payload (RedLineStealer)", "value": "c0a633ef64736d77c2a4496e0a4fd3e5cb7dc3799070754532955c8b24f41b5cd0c57f8d6f101b88f590eb7092d1eb71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152438, "uuid": "1eb208c8-a58c-4585-9ef6-e41a8e718cb8", "value": "T1E4A35D20679C9F19EAFD1B75B4B2012043F0E08A9091FB4B4DC164E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152438, "uuid": "feb6aabe-f6f2-434d-a694-e08413a3ce7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152438, "uuid": "0e7f03c5-bf4b-4712-8093-eb0b5ca6484a", "value": "1536:VqsI5qeUlbG6jejoigI843Ywzi0Zb78ivombfexv0ujXyyed2DtmulgS6pA:TIlMY8+zi0ZbYe1g0ujyzdLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707152438, "uuid": "069bb327-eb81-4174-b863-1ab9f539031a", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707152438, "uuid": "090f5870-17ad-4dc8-bd9c-5b68514d79eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707152438, "uuid": "8eaea55d-a240-4033-bb54-40b85776c450", "value": "79654AF854C2C4A27FCAC91D377BC558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a86fab6-c454-11ee-b7ea-42010a9c0006", "comment": "Malware payload (NanoCore)", "timestamp": 1707157814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157814, "uuid": "5914ff91-78cb-441f-8dcf-1b05f0554f56", "comment": "Malware payload (NanoCore)", "value": "a04034e960cf51b49dabe09131a6b060", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157814, "uuid": "b4e1aec1-4f6c-4915-a261-857d511d8772", "comment": "Malware payload (NanoCore)", "value": "7d5c964e4efa00ac05a78f01a08711b4a5be766cd315349df6d385429daad481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157814, "uuid": "85e0d86a-55e9-4928-9b28-1658ea68473e", "comment": "Malware payload (NanoCore)", "value": "71e4eebfcd5e0774c5c505f52b5ac8da2dde18a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157814, "uuid": "cc246d4e-c827-4a02-9c8f-1e73fd332ba9", "comment": "Malware payload (NanoCore)", "value": "05634b10c1a7f3f064f2174de3b7af7e8a110f7672c09b7e9d2108215fd92a9de65210f9f4c51030bd623dc7ad6c1816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157814, "uuid": "f2296383-4ba2-45d0-8b4a-8c9c98eaba55", "value": "T1CD04BE1677A84A2FE2DE867D61220213977DC2E3A9D3F3DE28D425B68F167E046071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157814, "uuid": "731d36c3-4d97-45f6-8095-296abbd7221c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157814, "uuid": "6c520637-3fb0-435d-8e6d-8ca51e2a6c89", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIT2526VXLzkhXuuFtT+jPOzQN2:MLV6Bta6dtJmakIM5DrVX+uu7iyz4V4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707157814, "uuid": "a74e6718-457f-4be8-81c0-bbd829e68a28", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707157814, "uuid": "8f4fd2a2-c009-4c38-914d-a1fd5d6a0ddc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157814, "uuid": "77aad9e3-db75-4941-bbc1-1f7cc82d20b7", "value": "A04034E960CF51B49DABE09131A6B060.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b029057-c428-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707138890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138890, "uuid": "bf6bb72c-b2ab-433b-bf2a-9839f7db33af", "comment": "Malware payload", "value": "af9e9df3ea1ebc276e02a873ed50cc7c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138890, "uuid": "def7ef84-f811-469d-89eb-a37deb215ff3", "comment": "Malware payload", "value": "7d6dbfe17a26c52bd092fc313c22c2b5b948dc73c8ad5f87d8da0025549c31e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138890, "uuid": "58acfef1-3f7a-4614-a240-f95ed17b537e", "comment": "Malware payload", "value": "d220160b8b436b3437faadc7301517fc5b40758f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138890, "uuid": "efa015e1-d0c1-44b7-bdce-95ea76f75635", "comment": "Malware payload", "value": "7ade5e93c59ecc6548cf4834de7f3a9713f7a96c77fa96c53f249d88c14ff3a9a6801adc42c28347d1e007e7851dc66f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138890, "uuid": "02d4265d-7b80-4f1d-8c00-5bc5415eb0bd", "value": "T10D2412706CF25346D185A3B48C8F21BA1E653D18CF2939CFD4267DA3E49EA35700AADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138890, "uuid": "75aaf9f5-f1e3-4aff-86ed-317b39ee540d", "value": "6144:qKw41ufcpV0JbRINo7W/+ZOIETlrYtwiuLApRVJLHH:Hw41u8cbRINo7W24TrIUeJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138890, "uuid": "033d6fad-df95-4574-a415-cbe8d38736f0", "value": 220056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138890, "uuid": "7e0cd73c-49d2-49cb-91f4-4192cd474ada", "value": "image/jpeg", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138890, "uuid": "3be32fc2-748a-4058-9d05-bd2edc77bda5", "value": "1699256181767.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8373b30-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111478, "uuid": "2133cf0f-8c3e-4aea-af55-60753fdf985e", "comment": "Malware payload (Gafgyt)", "value": "dcd8c8fc02b912dca5a886f4bf57c2cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111478, "uuid": "f32702b7-20d2-47cd-acd8-079811941a33", "comment": "Malware payload (Gafgyt)", "value": "7db024912dab41909a9de9d6f9f81a554b2d6e132ee9f887ae960a4258211b68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111478, "uuid": "7fd85167-040e-4757-a3ba-f0ad33c3a600", "comment": "Malware payload (Gafgyt)", "value": "30d7f9bbfc44686c55739a3f94112a81b5908bf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111478, "uuid": "af32d68c-4a33-4284-a07e-72710925bb9b", "comment": "Malware payload (Gafgyt)", "value": "a0ba30e4f107d7ff3d928108b4b563661b7bd9e06ea648917d5d939aa0f23a34067760132b5d51d00a256c3551e9aa9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111478, "uuid": "6254a8e0-893e-4cca-b658-e1b8eee7d88b", "value": "T168A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111478, "uuid": "b26585ed-08c3-4aba-8bd5-4e46e600b271", "value": "3072:VK1z13U6HzHoXRtmTUhQogiEmmFVcqq0GnDZT:VK7DDeKlogiEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111478, "uuid": "4e76f89d-b7ea-4cdf-9323-49207a16a077", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111478, "uuid": "70cfb172-48c8-446f-b78c-b60da06a83d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111478, "uuid": "8fff6f83-b1f4-41a8-8f06-7e24af4b911e", "value": "dcd8c8fc02b912dca5a886f4bf57c2cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f138ddb6-c3f1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (0sip)", "timestamp": 1707115439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115439, "uuid": "b85ce7cd-8c98-4fb8-b6ec-4fb19fb11b8e", "comment": "Malware payload (0sip)", "value": "847a21513809ca25f688d6a34b3d3599", "object_relation": "md5", "Tag": [ { "name": "0sip", "colour": "#9C6B6D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115439, "uuid": "90f2a0f7-8b95-4115-81f4-fb1f60e5c819", "comment": "Malware payload (0sip)", "value": "7e35e936aaf628cc8d82296dc3677551e6ef2117ea8cc1adb36702da8e8a2b46", "object_relation": "sha256", "Tag": [ { "name": "0sip", "colour": "#9C6B6D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115439, "uuid": "f6142f84-9092-4a26-ba7f-e039eae096b7", "comment": "Malware payload (0sip)", "value": "fb05e3fa5be7b27278c7d7f2d438eb6e9c90441a", "object_relation": "sha1", "Tag": [ { "name": "0sip", "colour": "#9C6B6D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115439, "uuid": "e103facc-3404-4672-920a-4e07f1d4deee", "comment": "Malware payload (0sip)", "value": "f3d76ec4a8340b751273f5fb6fbc2e54a7d5e952b36ef8beb958078571b98a19cbbaff2d9ba67dfc64605e725035cf9e", "object_relation": "sha3-384", "Tag": [ { "name": "0sip", "colour": "#9C6B6D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115439, "uuid": "414547cf-29d5-4c3e-a2b7-dca697c3a054", "value": "T1CB86336173901DE1F4EB9538D890D229FAB2B4224386EACB57FC8B523F137A55D3A341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115439, "uuid": "42c4b065-5f87-4140-96fd-3bce48e2138e", "value": "bae3d3e8262d7ce7e9ee69cc1b630d3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115439, "uuid": "4143d149-9119-43b1-8ee2-542c3e7a321e", "value": "98304:e88jkCIf8708vsa2x6OMD/x/0feyGgatgQ940BDlgwdnpka9R/k9t+28Gt+xB70+:e8QF08JPDfyGgjwBdnpkYRMOzeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115439, "uuid": "44e05eaf-f0b6-478a-93cb-8cd9ff921358", "value": 8032883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115439, "uuid": "244830be-1e5b-45f6-8774-db11de3a5248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115439, "uuid": "0c1f27f5-c8e7-4de6-8d73-2f4efaf2cd38", "value": "847a21513809ca25f688d6a34b3d3599.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a9cc3a-c419-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707132628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132628, "uuid": "f850ee88-dfaa-44f4-9e11-54abb9bda214", "comment": "Malware payload (Stealc)", "value": "7c0b88535c506fc8bec1510f08f3329c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132628, "uuid": "93b2ee80-86f7-4027-92ee-d9140054ed0b", "comment": "Malware payload (Stealc)", "value": "7f2b4169d20bb191467b02abcae4dbc05e80bb5a20aece8e3d04aac7f05b0382", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132628, "uuid": "22dc38da-51cf-4047-ac30-d4c9c41810a7", "comment": "Malware payload (Stealc)", "value": "026965f027f53725e0e93d069a7143d12badd35c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132628, "uuid": "042cfca0-5598-44ce-bbe4-15223f277da2", "comment": "Malware payload (Stealc)", "value": "b132e6849f60abf26fd9af71654e5b304e63746ca5397a30b883548603e6e5d0a9b6de57e8c7379cbddd2568dc3a5501", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132628, "uuid": "7a60c8a0-99c7-4708-9f22-a52915aeefad", "value": "T1CE645C9396A1BC50ED254A738E1EC6E8FA2EF560DE19777E2218AE3F0471171D273321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132628, "uuid": "32d48bad-1342-41a8-9e00-6df2ecd1e977", "value": "8c20896f0a15a2bc693d2f11c2ab744a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132628, "uuid": "512f14c8-0b0b-48d1-9cbe-7cc7776a20b9", "value": "6144:i88LuFIhUJfTi0aFS8t4pcABVjtRYkM+:18SFIhUJLWDap/B1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707132628, "uuid": "53ea5776-73af-43d6-a4ff-df9f31a09bf3", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707132628, "uuid": "aab285b4-6125-4c03-a8a0-ac50c096182a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132628, "uuid": "48027461-baac-4dab-8456-39d068f4e9d1", "value": "7c0b88535c506fc8bec1510f08f3329c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3344aa7a-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Neshta)", "timestamp": 1707121992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121992, "uuid": "c7fdf0a8-1b62-40fa-a951-7a0762931eea", "comment": "Malware payload (Neshta)", "value": "8ad299e0aaca1de16807b1f0520f0c75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121992, "uuid": "da6e2c6b-18f9-464e-a147-6c546eb8f00e", "comment": "Malware payload (Neshta)", "value": "7f4e1b7e1ac2f029f936637660c0076291ab6fd38114badc80d0899058decbc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121992, "uuid": "3e9a412c-4ff7-4383-ad56-e01beccf1ced", "comment": "Malware payload (Neshta)", "value": "154c739775e1282cef6ec459eb4a5d0365cd4b01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121992, "uuid": "51f54ed0-6e48-4041-8b15-481a3db1bae7", "comment": "Malware payload (Neshta)", "value": "c185d7057252a5f778b955501ecfefa55c98e7cca7fdb4d7e5dfca50eabf9c4db625ed67b59249e78a71a5f3c7dc740c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121992, "uuid": "087c8efb-3f07-43d8-9bc7-a3a7ce6ecdc9", "value": "T1A2D402299A749F12F93D0FF621B4B911E3F222932516D7B91CD920C52BB3F250B44EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121992, "uuid": "27cfeb15-0135-4885-8c58-b41c7dd3a2e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121992, "uuid": "9081eada-c1d8-44dc-a4fe-378bb2e348cc", "value": "12288:PC+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8lm:PNa6u/ZKCcmdqw6S2dRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121992, "uuid": "c1f4f0ea-1fc1-4e08-ba07-e0839a03f920", "value": 602520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121992, "uuid": "5b0d55da-d761-4eee-944a-565a1217a6d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121992, "uuid": "80bc03ee-63c6-491a-89e6-aaaa10ff5434", "value": "PURCHASE INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f715c06b-c453-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1707157540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157540, "uuid": "122eee6f-7163-4da0-95f4-0f0dc62e2925", "comment": "Malware payload (BlankGrabber)", "value": "521d5df59fdb7057b9d8728cebb2cbfb", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157540, "uuid": "a71bbcf1-a82a-41b7-8557-57efd15c7518", "comment": "Malware payload (BlankGrabber)", "value": "7fb7321bf5cd6d3fc4d9adfd85631c100435ecd5d2861bd27f0f995bfba84c1a", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157540, "uuid": "a49f79bc-9c76-4fac-a35d-1f5ac677ab51", "comment": "Malware payload (BlankGrabber)", "value": "a73e7ad7eb512fe0f2e2ed6378d47de17ff97647", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707157540, "uuid": "75f125ff-749e-4f4f-930e-8c4c5591ca5b", "comment": "Malware payload (BlankGrabber)", "value": "f26ccc38e16a760f9c49ee14cd5216998e192b15c45f8ea14002764ff7f23c16a3bbc41fdd121fea4ad0a0386532736a", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157540, "uuid": "b6b391a5-840b-4416-9bb3-c365a7f54d76", "value": "T1DE4733B415D094E0F9AB0E3E9411D807D57BF51A03289CEF16304BA85F63F1A1D7BBAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157540, "uuid": "e4865401-9f86-4686-882c-502dc6261059", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157540, "uuid": "4d57bc77-bf32-46ae-a7b8-5820d5a6950c", "value": "393216:qwcuH1Yin/Zgejv8Zo1QcxpCMVzTRJrrvDN2Vcf4ZYlHKp/Fqyf0gsfNMAKR:qwcu7/ZnvMmxpCMDJHAw4ilY4vfRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707157540, "uuid": "985d1319-36ee-43c2-ae40-46b49d50e751", "value": 26218413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707157540, "uuid": "c16ce246-b03e-4b24-8a0d-e16b76eb03f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707157540, "uuid": "f01d932e-f920-4297-a26f-e8f445222caf", "value": "SecuriteInfo.com.Python.Muldrop.25.17602.16093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9598ae94-c44b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707153940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153940, "uuid": "c4cf72d1-1452-4247-aa5e-f62ce7fc48cc", "comment": "Malware payload", "value": "d6a900229c3d3a79bceecd6fdcdbad81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153940, "uuid": "aca6af3f-5334-4030-9faf-b678ebf67a7d", "comment": "Malware payload", "value": "811270243c45b2a937676be4f190c5558c5b208ea49cf28137b20ccfea01d33f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153940, "uuid": "94c6da60-847b-4801-b136-102d1f695f6a", "comment": "Malware payload", "value": "0e686b51c3dc1a7ec5b4293b574cafc9167a55bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153940, "uuid": "71c0287c-d069-4cc1-9c9e-25011ba4e946", "comment": "Malware payload", "value": "41e1f7293942978743187ad4fd3be2ec35d63d1eb662fe5875ebd3fc1546df40031b2a7eceb0cb39e3a132a442683421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153940, "uuid": "ddf54a40-6e49-4f3f-80cc-fe9c50ffc14e", "value": "T1FE35E0D1B15AD0C7D86A48B2EF5ED93068953EBD90F4820D3193B626A2D77A3104FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153940, "uuid": "7e0a9f01-efe9-4fb3-ad24-e98dcb7d666f", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153940, "uuid": "d345e4e1-40b1-4146-8c41-9ed18ace233c", "value": "12288:3YV6MorX7qzuC3QHO9FQVHPF51jgcXw36K/OJctrLOOFRGkzmj1E9KKgAbHYUYX/:EBXu9HGaVHXEy+JWa9KJmHxYYY2VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707153940, "uuid": "3a8976a2-727a-48bd-bfc2-920f34f57d4c", "value": 1093632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707153940, "uuid": "e566c51d-f03f-4c30-9a94-2f40fc06af48", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153940, "uuid": "b2c3c55a-354a-4ccb-b42a-6ec310b1738d", "value": "Bank-Form.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca78193-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094547, "uuid": "92e2e93e-1aca-4a26-8deb-815efd12b292", "comment": "Malware payload (Mirai)", "value": "1a5a85f4217e6aaca8097ed361a174cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094547, "uuid": "7fd6a944-a29d-4c72-a4c7-9b63839f7f41", "comment": "Malware payload (Mirai)", "value": "82fcd4180f661d8190def518af38e613fe4736f1d47b252c999a708267173da3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094547, "uuid": "8294fa90-8e0f-48be-90e2-2c84d708adca", "comment": "Malware payload (Mirai)", "value": "ceb0795433d3f61a5b5fe980da6667ac7ab02596", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094547, "uuid": "3a72d3e9-47f8-4fd4-89a3-8a64ef5bd0f4", "comment": "Malware payload (Mirai)", "value": "c3189e9c49c1ac337415d5b69e79a00478064421fcde4681e372527323753735fca37d7c61a0f4a1238f8300ab3268e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094547, "uuid": "fc97eeb4-2f26-41e5-ab9e-e1d1bf43d6bb", "value": "T1B603F751BC829A77C2E1137AB6AE4A8D332163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094547, "uuid": "575c81df-faf2-4132-9166-43aa2a4c749c", "value": "768:sga4CbfsG5f0OtnlUlYOJFFARwAsb9LHWhCv+b0G7rDUXoTl/NYwW:svbUG5fPlUlDf4Sycv+PUijW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094547, "uuid": "17e879ca-bdf3-4005-a550-fb7f8d722b0c", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094547, "uuid": "f046035e-0d23-40e0-b56b-1830fb47c1a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094547, "uuid": "7272f4e9-dc50-4bee-a416-41b8aead2bf5", "value": "arm5-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2e5113-c416-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707131243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131243, "uuid": "20b1b98c-4380-41c7-9695-07618d80ca63", "comment": "Malware payload (RemcosRAT)", "value": "635a192fb79b97d88e078ab3824d271c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131243, "uuid": "5e0651fc-2f84-42c0-94cf-13db617faf04", "comment": "Malware payload (RemcosRAT)", "value": "84679cf34b287601a2a31bc0ddae62c2eab3178f86e6a8f79b52bc644de13fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131243, "uuid": "761e63d1-b832-4c39-b309-ad51707b1b40", "comment": "Malware payload (RemcosRAT)", "value": "af9a9d9af88aad456a9477987edabea7c79f51b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131243, "uuid": "0222a582-5032-4522-9681-38c76650df9f", "comment": "Malware payload (RemcosRAT)", "value": "b9436d2d7a4eb2e91dcc791721cf28045bc9c593d0bc4c1f729dd119600f7f768a1a6faca8921dc815f861eda0b97310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131243, "uuid": "b7e1cb54-6f30-43fc-9c87-11b6d1c59de5", "value": "T1403412982F66EC65F2C090F45801D1F072EA2C761EA7264D07E4BF57BCBD650BE96063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131243, "uuid": "7b73dd83-8ec1-4897-996a-1707625d2ef1", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131243, "uuid": "14973836-1daf-4cb5-887a-46a0d3d84bad", "value": "6144:6mvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j1o:nvlX8i8RB5JvADGGnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707131243, "uuid": "800e7d64-829e-48cb-aa6a-462347b3c2ae", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707131243, "uuid": "c77f6e3e-2aab-4e3d-a068-37bffad8e9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131243, "uuid": "d5d71e25-b176-45b1-80db-ac130ebe7a07", "value": "bTxb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16d293c-c3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707107709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107709, "uuid": "86445a06-6a99-41bb-b971-a98ac96d84bb", "comment": "Malware payload (Mirai)", "value": "3790c39de57a511ec16718792ef5add1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107709, "uuid": "33e79764-1a66-429f-9752-873e5a1ca541", "comment": "Malware payload (Mirai)", "value": "84c821206abcbaf17c8abfe317a5c0b8193dea0b927a026c5e2aec4ebcfc81cb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107709, "uuid": "a0c86f71-3643-4c61-9f64-7190166d4b6e", "comment": "Malware payload (Mirai)", "value": "8766f77ff9fe2621d907fcbfaec4f7f5190a87b8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107709, "uuid": "3df8ddf6-4d01-40e7-9b00-57b602eea1e0", "comment": "Malware payload (Mirai)", "value": "df47b46f8d50bc0b6977ea96fc1d3706c564daf251f2303bc196e8f0a2527a1e14b92a0b397ec21dfc9e1aea5bfc7fbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107709, "uuid": "eef0edc2-60fe-4cbe-a747-9bfb1729d0d0", "value": "T179532991BD815613C6D012B7FB6E028D372613A8D2EE7313DD266F21378B92B0D7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107709, "uuid": "2e251ad8-73fd-40ae-95d2-a383dc16c29d", "value": "1536:I4/bQlggQ8zLl7FGTrpZfIa7QgOYE6vI:I4/bQVnSTrpZfzjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707107709, "uuid": "ebd109cb-305a-4347-ba8f-ee55b90396fd", "value": 64468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707107709, "uuid": "9cc8d9db-e243-4da3-8f38-66f8b1bc53a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107709, "uuid": "dab1cfff-1a5b-4d4b-ab0e-d57a6f11297e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4492466-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707128651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128651, "uuid": "e2602085-13a1-4583-b313-3b61378fb045", "comment": "Malware payload", "value": "6411fe48d2c6942455188db54a5d15f9", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128651, "uuid": "5f811ad2-a29b-43c2-b5d8-ae221db85fa5", "comment": "Malware payload", "value": "8500dda9b53b68a39bdc589a335375900e76011ac6388cad9c2c859c463bf29e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128651, "uuid": "dfd8ef84-24dc-4b8d-b36a-24677c0de7e3", "comment": "Malware payload", "value": "c94328855b8328caa55df887a67a7128e4592908", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128651, "uuid": "905fb09e-52e6-476b-a200-107a707db90c", "comment": "Malware payload", "value": "c26dbb4aeec8444858f7d8b74495e22da3d19d1781a80974b3f2753dad14ac6e83f5ca8291664d94d4d4bd32f4b5fc7f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128651, "uuid": "169c320b-2909-44b7-b707-5c7914872203", "value": "T18E85BF027296947FC2F274394B1A23C9781F7E3DA72064C61AF6684EFB74909F52E253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128651, "uuid": "9a68b913-4ba9-427a-be51-2dc3eaf9c37b", "value": "24576:YHFJLJVZ7HMqlTHtkpf24iXTATIHLyiR0NV9Cu3YiIGJF4wqPO8654lWp:YHhHMU7+0j4IHLyiR0Zl3csFRyqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128651, "uuid": "5e138fe4-9a73-4aba-8baa-f27f9f7d1cef", "value": 1843490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128651, "uuid": "04028510-a645-43f4-bae6-d2a4c658e2c7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128651, "uuid": "36ac86e5-a2db-41b9-a70c-4f7306e13851", "value": "GIAC-01-21-2024 20012100.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7642bdb8-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1707144439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144439, "uuid": "7b11330c-715c-408e-a54d-75d39615cd96", "comment": "Malware payload (zgRAT)", "value": "203be5c7c37fcaea3ee5f1101e310abd", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144439, "uuid": "26dde74d-df16-4d4a-835e-e74d47404fb8", "comment": "Malware payload (zgRAT)", "value": "860318a9982e93b8833e68bef2e4d70d81ed06747571ffb9312dacf4a2ae2855", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144439, "uuid": "94377795-9a35-484f-9e6a-89f81069c7bf", "comment": "Malware payload (zgRAT)", "value": "3041d34cb5a1a4b1a0c5f0f1ae3389b8d8e16c9d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144439, "uuid": "531eda7e-5d94-4f1e-8fa6-8e555557df60", "comment": "Malware payload (zgRAT)", "value": "29dd08f0d3f2dc01ce3316beda72faebaf8b16e60822ff5ac3f5454a301bfaddb8fe99ec67538856781ed8e171a9bd5b", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144439, "uuid": "46b02960-43c4-45a3-ad8b-4f038e8ac6c9", "value": "T18BE4DF1A77054A62C7A42736D9775B090310FAB690A3D70BA3CDA2BA600B7FF1FD1316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144439, "uuid": "4af55534-b337-468a-8c0e-b9df02093ebc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144439, "uuid": "2df5fa48-994f-46f7-bbd4-98a97f2852df", "value": "12288:SfV3CVqJtda2YQm1Zp6Ed16Ajp8rTGlzDxkZ7ba3EBgi:Sd3CsJnYQM/6Ed16Ajy40ba3EZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144439, "uuid": "69504c13-61a7-4787-8f1c-ce5c99593952", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144439, "uuid": "e9fb60e0-c420-4f30-a0e2-4865add06c6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144439, "uuid": "621a04d9-5be3-4781-906b-fc42cb144e59", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede04cc1-c3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707107703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107703, "uuid": "07353f45-a76b-4f60-a906-33b0a1455ab9", "comment": "Malware payload (Mirai)", "value": "1c2bfd73002733fc23dbc9cf467347c3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107703, "uuid": "94433366-16d7-4195-baca-08227d657d38", "comment": "Malware payload (Mirai)", "value": "879566955acb9526ed743b6242e2a0de1251572205e3265424e72db388a1b8d3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107703, "uuid": "79fd1e57-b310-4955-9673-cafbffa7cde0", "comment": "Malware payload (Mirai)", "value": "6c628d2f4867f17380faebadc0396b70598ff315", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107703, "uuid": "3e8946f0-b2b2-41f7-9499-5577b587b802", "comment": "Malware payload (Mirai)", "value": "cc8a3ff7dbfeeff4f165af3bbd24f34df27b1da1d4d4dc8d59e803d5b7a2780bf9a65f2b7670c696b8929093d7ef91d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107703, "uuid": "c7924128-46d6-40df-817f-1cf8b1c5cf17", "value": "T155630956BC819B12D5D512BAFE2E128E3313177CE3DE73129D206F24778A92B0E7B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107703, "uuid": "b16b6fe2-cd32-4434-a0cb-464332188a94", "value": "1536:BGnXsxTNsAidpKIQ1QQWCulyW2bD7ae9sg3PM5iEuWdclX5uYT:BxBsvd4V1QQWCu0tbD7aaWdclXMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707107703, "uuid": "bce98d49-f9d9-435d-bd3f-25757e8bc194", "value": 71408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707107703, "uuid": "5aabf56f-2da5-4b35-970c-89409f3411c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107703, "uuid": "8364068d-51e3-40ff-aa42-92e9bbcc0636", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a21bf59-c402-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707122541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122541, "uuid": "7b61fd34-0641-4818-a493-f38f527178b3", "comment": "Malware payload (RedLineStealer)", "value": "caf451d07706d636ba09ef376030bf82", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122541, "uuid": "f3bb5dde-7cd9-4a64-8e1d-121626eea6b6", "comment": "Malware payload (RedLineStealer)", "value": "87c4e34bd82ec6ad1f3d43de1e8516c0e53f11ff685347285bf326946539051f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122541, "uuid": "6c446490-08e5-4640-a389-dd00bf8e20c4", "comment": "Malware payload (RedLineStealer)", "value": "5ac690d49430a9f22f24656387d7b1c12791b776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122541, "uuid": "121ff6e1-69b8-4d64-b409-876561dcec24", "comment": "Malware payload (RedLineStealer)", "value": "46926a8ed5c971ed11efb0de0d5f9a7ec783ab1afc8e10bdd3df68030515eca1786f321a2f2021ecc668f3c47379a0d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122541, "uuid": "74fa45c7-9a7e-4cdd-8527-4585d109eabd", "value": "T116D4233CA213F313DC77027941585C3D23F9E3C62D6B45BE7A25A3E5A361A4F6BA6110", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122541, "uuid": "a43310bf-cc94-4400-8ce4-a84d2c6134aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122541, "uuid": "3a509d3f-86f4-4098-9095-4fa63d252b98", "value": "12288:89EqwLzHIKojny9rx8PSjB8l19rX1Ct3GxOa6+o2L8o6a86k2Ve/b/XX/iXW14j:8ULzeyFx3uFMt3GQa63fo6b2YTPqWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122541, "uuid": "cd680b98-032c-44a9-a6d8-63c228942405", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122541, "uuid": "97a5e447-cecc-4063-8bcc-f12adb434c86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122541, "uuid": "c66f7de9-5cd1-41b0-bab3-f412f97b4fe6", "value": "caf451d07706d636ba09ef376030bf82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b698d35-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121952, "uuid": "b17dc263-b728-4c91-8c74-4322db4d67ce", "comment": "Malware payload (AgentTesla)", "value": "a06160b50c9d4d5ed3b94f80be7ece96", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121952, "uuid": "1bec95e3-67fe-4595-818a-676bb2e05108", "comment": "Malware payload (AgentTesla)", "value": "893e3966b80e0ca2cf353a64fca77bccdeb3d3e445be320d3b23c23d5e368aec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121952, "uuid": "426c8a6a-901b-41e8-8f23-2111ebd9eb14", "comment": "Malware payload (AgentTesla)", "value": "7e85c5b6c330aeb47a70ecc98eff0387aec41830", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121952, "uuid": "056ef3be-3bc4-4b01-ad67-1f8459fc700e", "comment": "Malware payload (AgentTesla)", "value": "a129c20608959cf31a95b7926afd64b189b1da0ff8e8a14c46fbdb8fcfe2a5c1059e974cacf0cbda3999a357b203f65e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121952, "uuid": "11e5e169-6ea0-4c09-9a15-061f5d011d89", "value": "T1BA3410137E48EB15E5A87D3B82EF2C2413B2B0C70673C60F6F49AE5618516929C7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121952, "uuid": "dd8264a9-0f2a-4372-aff4-5e13f00456ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121952, "uuid": "9b38bf59-b896-45e5-9c46-a0c6dd19c70e", "value": "3072:+8ICv3eOeOO5ssiOvYbxS3wkbj55czB9FTJw:+8ICv3eOeOOKslvoLO6B9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121952, "uuid": "0063aa9b-39f7-415b-8edd-e44ff6f2890a", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121952, "uuid": "8f630743-e8dc-4d72-bae7-18a1e6ffdba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121952, "uuid": "0b58d1f2-7ea0-4b9b-8db8-d086a4ece549", "value": "893e3966b80e0ca2cf353a64fca77bccdeb3d3e445be320d3b23c23d5e368aec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c30eba9-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121954, "uuid": "e8a3afa9-d631-4e07-a8f7-34ce668f729d", "comment": "Malware payload (Formbook)", "value": "611687468e61d078451da95ce208d786", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121954, "uuid": "5fe91332-6989-4c71-a829-6213ce08f166", "comment": "Malware payload (Formbook)", "value": "893f4dc8f8a1dcee05a0840988cf90bc93c1cda5b414f35a6adb5e9f40678ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121954, "uuid": "37b45297-bde3-44c9-8a06-6a2061af9ff6", "comment": "Malware payload (Formbook)", "value": "e3ce65408af1c58e6b2a06e64e61e9a22e5969dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121954, "uuid": "4c9df414-57a8-4212-bfe5-c2eefab7fbcd", "comment": "Malware payload (Formbook)", "value": "553b9f5cdccb4d3ed1ace8ce2ec13e239a505ff21d0e7ed0f2b24c6cc0a12bfd6ced7a2151e2f93628067db91af2b5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121954, "uuid": "7a92f9db-5b26-4503-a869-cefc747d3fb5", "value": "T134340F037E88EB15E5A93E3782EF2C2413B2B0C71633C60B6F49AF6514516926D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121954, "uuid": "32353987-253c-4942-9cbe-74dbd34e4cc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121954, "uuid": "47719eb8-d799-441a-8d8c-3bf743c3cbbe", "value": "3072:fZG3f3/nf+Kh4xVbjUhcEHRhxoDKl+z5z44agRfBW:hG3f3/nWKh4xovxh2e+i4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121954, "uuid": "8af8bc3d-8b09-449e-a8cd-78e59504be00", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121954, "uuid": "1b72b3ff-a00a-42a2-9966-8111bb6d7d05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121954, "uuid": "64b4fbdd-524e-4d3d-b513-d1cd5be66127", "value": "893f4dc8f8a1dcee05a0840988cf90bc93c1cda5b414f35a6adb5e9f40678ce9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ae1fd8-c3f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707118834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118834, "uuid": "505b866f-414c-4d5e-aa00-338d264eaecf", "comment": "Malware payload (Adware.Generic)", "value": "3e39dd501b69359ef829ee7a2f347b0f", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118834, "uuid": "fbecac2a-6874-4873-837b-28a6abed82ce", "comment": "Malware payload (Adware.Generic)", "value": "894b34af3325dde22dc87ed9a084ece98a0c4df986bcb6b8847c56ad2a134146", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118834, "uuid": "922f85b4-ffd7-4019-a147-744be71a86a0", "comment": "Malware payload (Adware.Generic)", "value": "a533e5109b9e43f5d98bdf563170e0c157a85ea0", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118834, "uuid": "3a03dee4-a91a-4db6-b5e0-dea24b60ee3e", "comment": "Malware payload (Adware.Generic)", "value": "f2fa24acf0780a6fa03d2eae97bd5ab346fe96eb2a553dbe051f9551697c49a354f795fbabbfe3d2ce07ca299fa9a4f2", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118834, "uuid": "251b8ca2-c614-4b33-94e6-11549dde61a9", "value": "T1F5673337F225B93EC86912324172E22005BB6F1A64174C5EABE42D0DFB7F1912EBED15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118834, "uuid": "d46eb4c2-17b5-45c7-8de2-af6dc2629511", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118834, "uuid": "843bef71-c159-4f67-ac90-bc7be07dacd7", "value": "786432:xzbBqYCYV23hu8qvSI79IOKho3tP4o1AAAQWVk3xa:pbBqF8dvSI79IOKS3tPRAAAQda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707118834, "uuid": "f4aa5241-5668-44a9-b914-7f2db2f5c470", "value": 31651984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707118834, "uuid": "c9e9c1db-749b-4504-aaa7-35c6caf4d0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118834, "uuid": "62427731-ecb4-4327-b6c3-7b0f6eab8299", "value": "SecuriteInfo.com.Program.Unwanted.5387.16902.11969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b7459a-c43a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1707146589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146589, "uuid": "d5585347-5ff6-4e1e-9913-689e7498dcb0", "comment": "Malware payload (PythonStealer)", "value": "19d510788e9dac03534586e9608a0341", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146589, "uuid": "f2b4911e-5e24-4601-96a2-10e4a97dc86a", "comment": "Malware payload (PythonStealer)", "value": "89a7841adbf26185cef3e1f694a61257d2d45f08851c38ec429e767b45b32413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146589, "uuid": "30105965-e8dd-4cb6-956d-08b6143f28f3", "comment": "Malware payload (PythonStealer)", "value": "9c84eb0614ea7b9252562ea4d79ad0270dcf3706", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707146589, "uuid": "cf002dc5-ccaa-463c-ae51-06d562093e4a", "comment": "Malware payload (PythonStealer)", "value": "f99eb7615df46476193ac5bed5f2cdb82dad6b45e07a20ee5f4fc65fef3d046054d0975cf7d28bc582a8ae8713565974", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146589, "uuid": "9337ef0f-a1c1-44ea-b93a-67c8d77dc93f", "value": "T118B6333DD6930CA6CC67D1F0F7E234B3E82E6A192A05C4672784B5E44B27F902369F56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146589, "uuid": "9f806cda-2367-426f-921f-333c7c7baf46", "value": "a7b0793ae6dd3f16ef244d19e4de0c24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146589, "uuid": "d069f406-caf8-4317-8923-59b280e179af", "value": "196608:03qcMiSbkjE70veFz8HkprcJNd0qx9Uf8OcbfZ06hB:8BMiSbkg7mg8HPSwef8ftH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707146589, "uuid": "1d1f8fd6-4659-479b-ae2c-3fb8cb907bda", "value": 11201536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707146589, "uuid": "6b5e0953-ffb2-425e-8b1d-e6a48e333914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707146589, "uuid": "39c7eabe-4f36-428a-b2b2-ae2e662181ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d309f057-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1707144165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144165, "uuid": "0c5657c5-1611-4170-9c6e-f44750fcffca", "comment": "Malware payload (QuasarRAT)", "value": "821a06a17d265c49b95d0bee2da8a0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144165, "uuid": "01225bf0-0ac5-466a-a2de-3cc1aaf29c5a", "comment": "Malware payload (QuasarRAT)", "value": "89c232f52d508d2f9a407a678d8e42d39444440a211dec807a9f74a6a7df0465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144165, "uuid": "1d0b673f-d50f-48e2-bf24-be00d27ef5aa", "comment": "Malware payload (QuasarRAT)", "value": "7f3cfcc28df12840547a4dc3c8d43c4976b78281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144165, "uuid": "b7a948e1-c81b-4b01-a54e-7c6b24a5b1e4", "comment": "Malware payload (QuasarRAT)", "value": "ddc095112ce3c91e180a2f204a65fda25065e42050e74157108b7afd17eb5b7a3ab85aa455cccc25c2fb423942909b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144165, "uuid": "4b2302d1-0a37-4dc5-a2da-46ff6584af4e", "value": "T1DB552302FAD284B2E9732A324525AB10A5BCBD301E34D96FB3D44D6DDE70541EA31BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144165, "uuid": "4be8a8c8-278f-4d7b-8b20-8f5977115131", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144165, "uuid": "5e7c328f-0fad-490d-bf53-f5da426361c1", "value": "24576:ZNA3R5drXPexWDdLgBJuYgLhknebSjXCRTbyBXOesUCpmoqEZ4G9po6BovUg7:c5mcLX1LJeAuBXOe5Sm3En9Jg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144165, "uuid": "b91d0abe-566c-463c-8b2e-0427edbd5f79", "value": 1316633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144165, "uuid": "ef4d8b03-55c1-4121-b972-9bf0dbb96f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144165, "uuid": "62902546-acc8-4398-8202-9ea430e68225", "value": "Odeme.belgesi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fc0eb0-c40b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707126346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126346, "uuid": "b57e91b3-126f-4776-a6af-51260163256d", "comment": "Malware payload (Stealc)", "value": "5a86bf6cc9dc5251e398398436ca2fe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126346, "uuid": "0276bb1d-3da7-4c38-b9b4-77c899e0247f", "comment": "Malware payload (Stealc)", "value": "8a12a7cfb07d4ea86f212911775850f6187eea3d7a9c070ae2d68e0b318266e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126346, "uuid": "02240a4c-93e8-444c-8df8-a80f6e2b9aaf", "comment": "Malware payload (Stealc)", "value": "bb9c266ee3a7c18a18ae9882f90d08202763f1fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126346, "uuid": "88d6fe2b-216b-4a51-92ff-977f1a9c82a5", "comment": "Malware payload (Stealc)", "value": "ee068e38522dd72928cc3d702b1f606b1dd8fad6328b5d347ed7de47b7566db70c5dcecd1a01c2f378b85c3b3653a4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126346, "uuid": "5361b024-d8f7-47c3-b24f-f5cdb9be4ac8", "value": "T187646C5396A17C54ED264A738E2EC6E8BA2FF560DE0977BA22189F2F14B0171D173331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126346, "uuid": "a4c58e8d-2093-406b-84b1-91c1c06da6ee", "value": "6ccd4bc2d35613d37d4776250d7c29da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126346, "uuid": "2b613fed-3234-44ec-8d29-e07d26cbfa90", "value": "6144:m5LlvwFUClMbfjxRVlw35oxsloJztRYEM+:m5pvwFUClMT/7w353lE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707126346, "uuid": "e2f64bd8-5bc9-4fa4-88b5-3daaffe24020", "value": 318464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707126346, "uuid": "d26508b9-be71-4e45-b62b-9cb9e390129e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126346, "uuid": "7fb46824-298e-494d-b1a4-4d17554cbc51", "value": "5a86bf6cc9dc5251e398398436ca2fe6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d0c064-c3e1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Fabookie)", "timestamp": 1707108362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108362, "uuid": "ffc6a1ec-3bf1-4cdc-8a37-93a7d346a3e9", "comment": "Malware payload (Fabookie)", "value": "b811f93bb852edfdceb786c087f409d9", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108362, "uuid": "c7968199-1b45-4756-aefb-70b4369a1c90", "comment": "Malware payload (Fabookie)", "value": "8aeb0d61b1211fb7817a3d9f1ce69cd385f21f0c10b7df1eefe6c6e7fc6b9206", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108362, "uuid": "838f911b-c998-4309-9c4d-0a768e2d453d", "comment": "Malware payload (Fabookie)", "value": "60831662ee9b6d6111a02f4e1b1f91453c46a944", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108362, "uuid": "89c0a8a6-aa32-45da-ac06-3bf850a13130", "comment": "Malware payload (Fabookie)", "value": "7a13cc2f26558a5d7ce5cadbae52eb1d3ff8862601a66a0903762de9e1fa74a979e3729cfaa4a36892f22d7fb405da22", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108362, "uuid": "0c161122-e824-41d6-965c-9adad1c03c70", "value": "T151F42B56FBBD4272E061C135C9A6E7B5E6B27C855D30970B2345EB2E2F335118E3AB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108362, "uuid": "525ce462-e56f-46d5-bddd-3d4b6045c195", "value": "f2fcd0efb031ebebeaa83cd4cd21090b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108362, "uuid": "bbf93304-7a7f-4292-848c-726767886365", "value": "6144:nA01Nd5uvxQWQSYYaE5CinBdRxQ7cUBmCUiJbc77ZvfuYuEdGxTC2iWf7xLUnw+V:ndo5QWJnnBIShtdGxTC2u5JL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707108362, "uuid": "a7db1476-7405-4b50-b8bb-90a9f7209058", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707108362, "uuid": "bf61214e-b6f5-418c-b810-79c65d4a8a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108362, "uuid": "73ae8fda-b95d-49ce-8fc3-30018ef46fb1", "value": "b811f93bb852edfdceb786c087f409d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4591f097-c43c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707147363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147363, "uuid": "e0b93a05-e898-42f2-bbd9-d30dded0f943", "comment": "Malware payload (RiseProStealer)", "value": "3055347ecec998835410070285d2ec66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147363, "uuid": "77c24780-c359-419e-8ca9-f860bd2791ee", "comment": "Malware payload (RiseProStealer)", "value": "8b5f77a3f37f01a49f99ecd6a985ec000f50890b3ec265e7bd7469936ce717a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147363, "uuid": "e349a5e2-f112-4373-bc8d-d7b71be876c4", "comment": "Malware payload (RiseProStealer)", "value": "20cb3d07d337c6b94b9619ce360409cfa5098f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147363, "uuid": "31b813af-f82f-401d-8985-d3ff06100f13", "comment": "Malware payload (RiseProStealer)", "value": "fcc8f6b90a4118fcde53372b3ec09dae9c0517f33de89f50f39ca316ebbd339991e9030db76243b6fb76f7931ac98781", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147363, "uuid": "01ef5315-58bd-4dff-a0aa-7e2db0e9bbb2", "value": "T10B5633247AD710AAD59DDA784592FEBCB5FE2E511462C509FB847ACECFB328063B7001", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147363, "uuid": "5d294cad-1885-4fef-b69e-c467a7713df7", "value": "940b3a5d63813005f48f6ae4f0c3b75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147363, "uuid": "b7d0a0d0-7ccd-42dc-9b4b-20bfd190466d", "value": "98304:TdF6rUhq02XsQhuIQ77TuSHbyPjWNH+R35wTCPSfsoPK2+karu8K5cdz:76AhmssuV7nHboWNH+R35wTiKK2eK8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707147363, "uuid": "b34af68f-3333-41cf-9905-a8c81901c884", "value": 5949440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707147363, "uuid": "3762055f-48ef-4bb4-879d-34f560f82696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147363, "uuid": "7b9792ab-a210-4c90-bfb2-9f53da3b8f73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f8fc8bd-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121959, "uuid": "3b616904-f512-40f6-a1db-19db46122099", "comment": "Malware payload (Formbook)", "value": "66186c177677f855b1f9ea01aa3da44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121959, "uuid": "93dcb110-32f4-4b04-a272-255cac3e63f2", "comment": "Malware payload (Formbook)", "value": "8c4e9183384fa03c94f5fc1746fc75e87b380f516977ed7a82fa3c0aadb6dfb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121959, "uuid": "bcb8dd30-3148-4311-9bad-49ae452fb914", "comment": "Malware payload (Formbook)", "value": "a7012f92b2d7411d7f4fe9277c30e799c8e0a9b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121959, "uuid": "d5605a10-e239-4816-a242-cf3c5226cf5b", "comment": "Malware payload (Formbook)", "value": "36683e8d4d768658aa38132e3e66ca504d1f3380752add489f4076a955e19a17352fee276580d93ef27c86cf3b1454a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121959, "uuid": "b4058419-bd0c-4113-b289-8c2b762c8fb0", "value": "T102836C25638DD52FD64F06FDAC61A124237082B24503E78C5F98C9AD312FFE95A06BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121959, "uuid": "8e40fa03-a817-4eb5-a6f4-438eae843e22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121959, "uuid": "41633a6d-521b-4a2b-8b1f-0ae8c2ce5f55", "value": "1536:q82P7vOjG3a8Fl4uoJaqPG2isI19SANWFsBu1dWShJu0CvmVoR:q82PbOj2aCKuejhI19LNWzMSrubvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121959, "uuid": "2829592d-ccc1-4464-8b1d-29358a34438c", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121959, "uuid": "3be443e2-a61a-4e67-8935-4e048cd8e3a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121959, "uuid": "35dc6d93-7689-4d91-899d-83e10521180c", "value": "AQUA CHEMICALS-RFQ#013024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21de7134-c3f2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707115521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115521, "uuid": "cc2e9de2-ba65-43c9-9c85-cc3d226447a0", "comment": "Malware payload (Stealc)", "value": "64334427ca7bfa36c5482b56349257a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115521, "uuid": "ff853901-22b2-4859-8116-f8f0f302fa7e", "comment": "Malware payload (Stealc)", "value": "8c60d8266cba33ca8ae04373fe0cdf90d665acb0fd5067c9fc95a27c8bc07733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115521, "uuid": "23ad7fa0-e13d-4ab0-a1fe-1f7e0a5fc0f6", "comment": "Malware payload (Stealc)", "value": "909c252abdc18997631782fcbd563918614937a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115521, "uuid": "e9146cc9-206b-447e-9836-f03013d176ec", "comment": "Malware payload (Stealc)", "value": "af98458033180414c810846deed3ba4cec74da872479060bc5e61420b4f56cf750bf2a29e0d64ea5b822390b39476230", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115521, "uuid": "a1be22fa-aee3-4b5f-9c19-50f278e141ab", "value": "T1CF645D8396A1BD50DD264B738E2EC6F8BA6EF560DE1977762218AF1F04B0171D173720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115521, "uuid": "1cc5be36-87e7-4e11-b2d6-33a87b0def0d", "value": "6ccd4bc2d35613d37d4776250d7c29da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115521, "uuid": "96d1d5be-1b48-41e8-86ed-10312b0e745b", "value": "3072:YD3LLmABUMx+y80rwpvBTDuyyXUDu+Iu/QUJKawPef59X39d5RvYlv4tRYMuQnM+:YTLlv58zTOEi+AeGmfPfvYStRYEM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115521, "uuid": "7e89e364-05d3-4a39-ada5-290957268242", "value": 317952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115521, "uuid": "4ace347e-4d6c-4e13-aa2f-599da1056fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115521, "uuid": "d46e6277-6fb2-4d81-a04d-861cb55f33a4", "value": "64334427ca7bfa36c5482b56349257a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf934b70-c44a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707153581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153581, "uuid": "67328757-a4c5-4501-a651-515f07a24aa7", "comment": "Malware payload", "value": "aa338e256ba84ccac8a06f7065d026ce", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153581, "uuid": "55ebddc2-c4f5-438e-aa21-f7cef3b532fb", "comment": "Malware payload", "value": "8d65ae68d90ef27e031f9300b98e277ba603823fa29e33a869c5e4da6663e120", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153581, "uuid": "9c186f62-46d1-4fc4-95cf-1b53fda27080", "comment": "Malware payload", "value": "1f28d98e005b4236f696f92d7ba942d58488dd02", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153581, "uuid": "f8234f19-8740-4897-a132-697c365ce88a", "comment": "Malware payload", "value": "789b58eb80aa69fd59f6a366bedabfa9672d05863dccacbe81a5b66fb605fe1989a0993b1e8930d72430b7ef619f8991", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153581, "uuid": "eafcb2a3-f574-4656-a7f3-77ec2b2571e1", "value": "T10A06D49C3CE7226142177039879F5484E939881F5118AC84B48DEAF85F99F3C47FEAE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153581, "uuid": "972fc129-c60a-4976-a95d-8b2b141f711d", "value": "49152:Nx3ii6gobYQS3QpOVtFBgiAEn0i2pdlHNgx0WFqaeqNn0i2pdliWtAXiAwyfMtAX:NQpwtFBgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707153581, "uuid": "d35a73c9-8a19-4a57-a420-f042e206d84f", "value": 3808684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707153581, "uuid": "2428492a-f86f-42f1-ad13-6a72b016bf6b", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153581, "uuid": "84c92530-cc7e-450f-903c-8c6974fea5f6", "value": "an international agreement to voluntarily limit greenhouse gas emissions is called the 60718.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3c1c51-c412-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707129368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129368, "uuid": "f07a19f1-63ab-45b9-a3bb-ff93b9b45830", "comment": "Malware payload (AgentTesla)", "value": "0de7e7145c5b8ad408df914caad5da95", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129368, "uuid": "fcd9ce49-24f9-42a4-8523-08aaf1834b06", "comment": "Malware payload (AgentTesla)", "value": "8dbd8cda7099e0fe70604e6fd9ed6df4474fe6e24ce4db63fe319447a86f0baa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129368, "uuid": "b83f1b36-ef27-473e-9eff-79abd3a89651", "comment": "Malware payload (AgentTesla)", "value": "6ef1cb214c014229679257321efe16f53cdcc548", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129368, "uuid": "b5b8a8a3-2f2f-4c5c-ad1a-3a2a3c12540a", "comment": "Malware payload (AgentTesla)", "value": "a323726d3268deef9c8926cc8ee7fad8423156002864e91123f649456b736194a40fd8771e83396bd43d1bbc37c8620c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129368, "uuid": "dae6f447-9fb8-4d80-a242-ab43b391467c", "value": "T197F40244A3EFC30BD5704BF3559051406B32B31A20E3D3E91D84A1CDE9AAB9B5DA8F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129368, "uuid": "cc7d1563-219d-4bc3-bf3f-1fcb82bab517", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129368, "uuid": "0d5b902b-0180-48c9-adc0-a1d96096ff61", "value": "12288:GooIFFHgeg/ccMVxfaSLk7C9G5VSNc2FBPZ+T56BshZgrBMYPNCjlr9GW:fXFxDxfFDU5wPBhyg7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129368, "uuid": "e02d9eb0-401c-46c3-b0d7-570f8302b06a", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129368, "uuid": "21151839-0035-436b-9079-5c1abc0dbb6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129368, "uuid": "7a494e36-18db-4573-a433-31c336082b0b", "value": "Nostro ordine n. 24OA0022_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0873f51c-c3c4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707095721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707095721, "uuid": "34de3243-ed70-4f0e-9f51-d534c4befef0", "comment": "Malware payload (Socks5Systemz)", "value": "1f973adbd542db0e2accb9ff334c9189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707095721, "uuid": "1463d94b-2686-4045-82d7-ea226cf183f9", "comment": "Malware payload (Socks5Systemz)", "value": "8dd8887d8acd43b2e8a7b0bed168933dcddf4cb3083906f6ef864e451041ae18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707095721, "uuid": "3a86cfb6-f32d-4132-88cb-1c7f2bfe2f81", "comment": "Malware payload (Socks5Systemz)", "value": "713260984c002819d10b11e63b6bf28873641950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707095721, "uuid": "78ac2d28-1ad8-4a3d-9942-903edb247f6d", "comment": "Malware payload (Socks5Systemz)", "value": "79881129b6b0b6fd053b4d2843905204b955b118219f32a63f18d9928986a1d92b5d46df04dc5ad9743d4755e956c044", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707095721, "uuid": "46b6e503-da05-400f-9312-1d5a774f270c", "value": "T1F1349D1023D0D071D1A7213585A5CBB24F6B786266739BBFFFD66A7B2F343908629309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707095721, "uuid": "94e17bd3-3dd4-4724-ae21-0bf22cc2bed9", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707095721, "uuid": "c783e99c-2af5-4985-a1e3-a69aeb83a39d", "value": "3072:94uOsKcdFdzR/9sA+cqRf8qWy6/dbgZyvhid/8VrOgGet6P0s4iNx:9ocFdzR/9sAqWyQeyvA/89OAt1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707095721, "uuid": "06c1e8a1-a3df-4171-a4c7-2caa33a19ba7", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707095721, "uuid": "538c8265-7913-4cf8-a7c5-41296215c530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707095721, "uuid": "bec6c522-e521-41d4-a6ba-1dafc23b62e9", "value": "1f973adbd542db0e2accb9ff334c9189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d70757-c460-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707162963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162963, "uuid": "cf2c95b8-87c7-479c-b742-b238fd059062", "comment": "Malware payload", "value": "0000a7bb0f77ac45ac8397b673a958b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162963, "uuid": "0e59ed83-6479-49ee-9ce2-4bb090a0694f", "comment": "Malware payload", "value": "8dfcfc0bc6554556c7f13c4d5f25719f4480e02acbdc14044bcd68abff2f9e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162963, "uuid": "77b68ce2-770f-4f50-96aa-da572e015e3e", "comment": "Malware payload", "value": "aab00c17b201708160ae0b90fc65368c4a5dbe0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707162963, "uuid": "85f9f047-8502-4a66-ae34-904ba947b1ab", "comment": "Malware payload", "value": "f314715385de40f8617a9931f867f6a9dd7fa1ffd37cf4c4abdee3ca39eb77ca356924a88373a0019da8dd1cbf526461", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162963, "uuid": "1aa5109e-2b23-4ee1-8214-cc4d77a6f36a", "value": "T154052254B5B01B46C5FF8BF68E656106C7F69123D923F90DECC3B4DAA402B284B12B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162963, "uuid": "3ee042e2-0108-4afd-b379-356676b50cfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162963, "uuid": "2d42f3c5-17af-4c50-8a4e-adb3faadeef5", "value": "24576:dV68yq0N4MOQA1EEUJOO38jM3R0kMRIma9cx:dVsqCaJ1JUpP3RxMRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707162963, "uuid": "aecda569-f345-45f0-9af6-68c30fd49df5", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707162963, "uuid": "cfd3e585-e1db-4f91-96c0-042a29f38201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707162963, "uuid": "7c8b6e52-31ea-439c-a309-e194d7676fe5", "value": "2xNxZQ035cmIoGG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a5b3bd-c443-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707150365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150365, "uuid": "61936a5e-ce51-4781-92e8-0cb607a28026", "comment": "Malware payload", "value": "2550990d2d52581b213e7c9305c392d3", "object_relation": "md5", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150365, "uuid": "8586bf94-4eb1-4c56-aa5c-24085030fad6", "comment": "Malware payload", "value": "8e27b76b3903312cc5e93f250d7cf90b7b999592d70dcf2922bb450023014006", "object_relation": "sha256", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150365, "uuid": "c5ebed37-cab1-479b-a647-f3b35829823e", "comment": "Malware payload", "value": "f7f069915c9b97550dc1fb6cf631f6222416dcf5", "object_relation": "sha1", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707150365, "uuid": "2e07b379-7bbb-4aa0-83a4-863204dd7ac4", "comment": "Malware payload", "value": "5300988628fa515f53624cb6bedd7dcf6da33131544feec682e3377859fcff663237ed550ae8c6050c82c0499f702f3a", "object_relation": "sha3-384", "Tag": [ { "name": "bash", "colour": "#CC62C8", "exportable": true, "hide_tag": false }, { "name": "Kinsing", "colour": "#D800AB", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150365, "uuid": "fb757a9e-fe74-4dcd-99a0-6848afe1d315", "value": "T1E6F2274D9072ECB52D65C866DEE1322DB0BEF088C5F37B88AE213D3C55A4005FA715AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150365, "uuid": "ee8684a3-8f52-4745-9728-14ad06d3929c", "value": "768:X87XzQ5VFNcDAFLcIwgnoYq0xFB6ytguz:X3VF+D6cIwgos/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707150365, "uuid": "acb462ce-5521-453c-b043-7dd5a380ab3d", "value": 36327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707150365, "uuid": "e54850b4-ddc8-432b-8aec-a8d63e1c98a3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707150365, "uuid": "e6d719e7-e8a7-444a-9fa5-a7ebe21ea3f6", "value": "pg.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8784fc9-c467-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707166105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166105, "uuid": "726b29d7-0ed2-4040-98a8-e2b90a7ee771", "comment": "Malware payload", "value": "49b505e83aeaf05712999db427ea561d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166105, "uuid": "09304179-259c-470f-abea-3f4a9d5841d0", "comment": "Malware payload", "value": "8f425ea306da925eb8dd76f6ef41ed5da7db268f73e5513b496c172e76da204b", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166105, "uuid": "a27bc17a-c62d-4735-ae90-eae62ce77989", "comment": "Malware payload", "value": "74201e9837a791e78f5963293e7e2dbc6733836a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166105, "uuid": "51390cf6-6fdb-40c0-98d9-b2fcb3e129dc", "comment": "Malware payload", "value": "304c934580283ab67067552d1c797c415ebd518e6e4ceb5825e133f0abf8ba091aa3674a9a99f7e58bd0719e779505b4", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166105, "uuid": "4c63acec-eae3-4644-9b7a-83da29f5ebe4", "value": "T19A672207E648CB96C0BA43F16E230E591E175F1D8283AADF151A366F2D736E50BCD98C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166105, "uuid": "6b8a4d86-2bba-4593-810c-8103e0050bce", "value": "786432:tMJ00N0DO7aPJj3BntKous2UwmLqf46RfYb1oB:CaDLZ3BntKous2ULqf5RfYbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707166105, "uuid": "5abd2529-c3cc-403d-9b95-46dbda1ea307", "value": 31363941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707166105, "uuid": "8d0e0546-1dd4-425c-9cd7-7aababfcfcca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166105, "uuid": "0e97d14b-c0d2-4475-b12d-1af1713376f7", "value": "MetaMask3.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d75e31-c406-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707124329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124329, "uuid": "feb18aa6-3345-4b6a-a6b2-ac0e66fb448a", "comment": "Malware payload (AgentTesla)", "value": "dcfdd9ad1e4024c2b60367636f63f300", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124329, "uuid": "2b3bb966-9663-4ce6-899d-fd8528c7a956", "comment": "Malware payload (AgentTesla)", "value": "8f9500ab199475ccae799126de8156b316fb9b200e1f3429b7b5b5baece8ab46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124329, "uuid": "61719564-fe30-4e03-a644-75012d107aec", "comment": "Malware payload (AgentTesla)", "value": "896d6f494b5c96e961cf46018f7d68ab448a05fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124329, "uuid": "8a61cd06-8e17-4a20-b3a5-412cfc03dd1c", "comment": "Malware payload (AgentTesla)", "value": "f2ad1adc58016630b8b56745379f94ad79941913a086c6d432326243f7d941319cecc6f826d74e2d8dbf113e17d42521", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124329, "uuid": "6375fbaf-b098-4c16-a5cc-074d0a7bf8b5", "value": "T14F05221478A92B91D4BE5BFA58A5404293FE89236C63FE5DCD9B38CFD422F404B02B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124329, "uuid": "a275fe14-df4e-4d1e-899f-0b75070d7cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124329, "uuid": "378dd6f5-d540-4d88-ba3d-b217663de825", "value": "24576:2/V68yq0N4Kxaqg33MICrUc2uTLmiP3RzjyhU30QL9cx:+VsqC7wvPCX2GPehV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707124329, "uuid": "f9cde321-4a82-41c6-afc4-ceda9934ddf1", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707124329, "uuid": "c0cae298-9ef4-4de0-ac95-4a6161989751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124329, "uuid": "45f85d30-e7c2-4c07-aedd-97a1197848da", "value": "BL draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358f2b7c-c402-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707122426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122426, "uuid": "63e597d6-0ade-437d-8895-27b75fef49aa", "comment": "Malware payload", "value": "b4998a1f870f636948ec8e3673ee10ae", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122426, "uuid": "279a789c-423a-439b-8c15-cb42f95dcf3b", "comment": "Malware payload", "value": "8fa0d900f8b1031addf04fb5e0a1f689a843c1ce0f9ebeda7943460db0bb80d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122426, "uuid": "af007406-73be-4ed7-ab0b-228cb5eee074", "comment": "Malware payload", "value": "f47a0b8a833dbc0dfd5139089cf7f2f1d230068b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122426, "uuid": "38a23f7f-0b10-4585-a42e-c8b02e305d9b", "comment": "Malware payload", "value": "07e4c245a0ff1224cb1e0233628415d55b14861b432e35e985a438af9322ac7c2885099bb75994b6c5651301aef24252", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122426, "uuid": "f4f39889-2c92-4fe4-9406-da5f8782cfd0", "value": "T17C245C04074A3CF5D11292FAB9434953B9705846B9834FD4B88CF22ABF7A7DE2C5F2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122426, "uuid": "105c0136-63d9-40f4-a237-4ddf4df3bce9", "value": "3072:OM02rlnA8hN0UqhnBl3p7NDvUrhck1EpnAGQ9hH8XV8W2s+8UbPuUG3w:NJsB3Vet+dAiv2pPunw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122426, "uuid": "cbdfc4e7-876a-4c91-8fba-3ae5b6079546", "value": 223610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122426, "uuid": "0e91fd61-6e1b-49ad-a234-7d7dd48bb22b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122426, "uuid": "79fd1dd9-c1f7-443d-ad72-a9a0eb5842a9", "value": "script1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7679e3be-c42b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707140144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707140144, "uuid": "fa07309c-1d18-4f7a-9bd9-cce7cb195670", "comment": "Malware payload (GuLoader)", "value": "b9bc0787ce0d17749886aaf3b7c153a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707140144, "uuid": "e4a0131e-fc25-425d-8b62-3e35198e066f", "comment": "Malware payload (GuLoader)", "value": "8fbc8e32e756e47c47df9e8ab1d1f4cc4d5c5791367a92415d740c0f6360a45a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707140144, "uuid": "f504b12e-b871-4e60-99cd-417e9fc82231", "comment": "Malware payload (GuLoader)", "value": "c65e112eed39e449488176324b7b57653ba3b754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707140144, "uuid": "8ca2d981-1260-476e-9aca-edf537cf1f86", "comment": "Malware payload (GuLoader)", "value": "3ab96e9ab66b6ed5da6919e1fd2e82bf7b24e6b730b67a43fe7f6bdc8b06f5b90bf68b1effc67c5d7e42694fa9cd3c22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707140144, "uuid": "9b557f73-4137-4a06-8fa8-9e695730def9", "value": "T1DC4512C937D0C4D1E86F18783AB65C29026B3D66DEDDA841B04A7B0D84F3986B93F15B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707140144, "uuid": "495de4a3-8c81-444e-b0d6-eb72ac3b2d9a", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707140144, "uuid": "9dc50ad8-0825-4576-bfcb-f2a2c12b7a79", "value": "24576:eUjH+ezsDLlqwCB1/wtKgVCfBrnU/OjuzjWDJ+Ak+QhLfFJD:PjHolqwCB1oZYBzUAuzi5k9LjD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707140144, "uuid": "198f34f0-e386-46fd-be3c-b4b1581cf555", "value": 1206488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707140144, "uuid": "bc8b66b1-a056-400c-9f69-b7f1c5bf24fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707140144, "uuid": "f0317766-b738-49a3-b6ca-03491e3ca71f", "value": "GC Invoice 02052024_docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1974b938-c412-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707129251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129251, "uuid": "859c9258-0fd9-440e-904b-3ac37ef99e58", "comment": "Malware payload", "value": "83073012414814b236f3e9f793bd3c61", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129251, "uuid": "b297da4a-5420-4fd7-b76a-d2db1140d441", "comment": "Malware payload", "value": "9084fa74ffb18c8525429699df10cc853fae093a0f25cef6a0e38e9d1306dfda", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129251, "uuid": "47d2da5a-d259-4f89-9c66-9c633a9ca2b7", "comment": "Malware payload", "value": "0fd20ece7d40cc276ce4dfdf4309492254eee985", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129251, "uuid": "dcb5f016-dcbf-4fda-9a37-32872939ae9d", "comment": "Malware payload", "value": "8cdf59278f4d0b14ca45f6c0180b6b7d5d6ca119de467665ef368c8abb50427648563e16f353f8a0022ffa2c950ef573", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129251, "uuid": "960cc3bf-805e-4848-8695-cc5b5c4a8145", "value": "T149C5AD12FB46A4B1E58E02B8617B6B7F4D398E189334CED3D7D06D669C311D1263B38A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129251, "uuid": "5dc168c8-9259-46f9-8cbf-6928ac234a05", "value": "8e0dc3e97338749c059836f05e9ef715", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129251, "uuid": "34a96dc2-2513-439f-ac32-73323affcd10", "value": "49152:uwuZCH8c/8Th1l/GMk88C4ISPryrlTonZtP9Rpk1+qwY:uwugccarpGT4/wyrOZto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129251, "uuid": "5da20c06-6472-4308-929d-f406b38fa459", "value": 2692608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129251, "uuid": "5a54e4a9-5978-408a-a100-23640f424fbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129251, "uuid": "445fff1d-f6e0-4417-9a82-d506abf260a0", "value": "SecuriteInfo.com.Trojan.SuspectCRC.27943.8757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353cc6eb-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707125432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125432, "uuid": "8f391407-78be-4e6c-b13a-665bceae46e2", "comment": "Malware payload", "value": "e2be25ec1c860b98ea99a835cc981d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125432, "uuid": "a6cc24e2-e6a7-40a5-9bde-38fe54ca0bb5", "comment": "Malware payload", "value": "922163713b973cf8c4ad80f16cf69305ed0ca319b314e7ec8ae1982ed5f2a9ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125432, "uuid": "68e1537d-1b4e-47d9-9778-0f6828c42af8", "comment": "Malware payload", "value": "cd0498ef91cd6c7ce9ebf78b3ee43032d65deee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125432, "uuid": "19568093-b1f6-452e-9f6d-4502d41a94b5", "comment": "Malware payload", "value": "39c55a2b593bf00a48aba9eb87dd2a7f865c3b8a5d20a3bbb49d8d0bc95980bfbdbe5db465ef1dbf78753584536e0c95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125432, "uuid": "b4740310-1fbd-4c25-99e1-2b81e3ac756c", "value": "T16A556D4A77A841F8D076D175C9A78A56E7B2B8060B3187EF07D0A21A1F77AF05E3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125432, "uuid": "41dca73c-34f7-4c84-92f6-86f4d1769808", "value": "d8c629b29d617e5840b52a1eb7e78d11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125432, "uuid": "c41ca6ab-2945-4b3d-82d0-f6868523b885", "value": "24576:iSBsKAhjPTMl1xPiZvL9IyK4LEaDnmfSVgPCS3tMrMyj3F9hIF1SqY5cbaF:iSBsvPTMlLqR6N4waDWSVE3tMx3FE1Sr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125432, "uuid": "b1988682-69d0-4944-b2f9-0b5cd6640169", "value": 1399808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125432, "uuid": "f13beeaa-3ed2-47f0-b6ae-f0f0198fa7f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125432, "uuid": "c538a091-7846-4c32-ab4d-bc624eaaac4d", "value": "SecuriteInfo.com.FileRepPup.28573.17283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835d9c88-c406-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707124274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124274, "uuid": "f61bf4b5-9a9e-4583-8578-adfadb70d657", "comment": "Malware payload (RedLineStealer)", "value": "e5b82330c30d992c9b2df56f7453f6c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124274, "uuid": "4612f752-c295-4cf4-bd1e-f10e48e37420", "comment": "Malware payload (RedLineStealer)", "value": "93b181821181dbe7e8f5e86b5aee87a6476efe70c0fa66e9cf0d1f18a297ee3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124274, "uuid": "8cf48a2d-d8c6-4386-9f26-0485c99b69b0", "comment": "Malware payload (RedLineStealer)", "value": "554f834002ebbb657f084c42b0ec72c643479f27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124274, "uuid": "5052b605-9801-43d5-bc58-992875ca0fc6", "comment": "Malware payload (RedLineStealer)", "value": "a01e201301bda2f39f79bcdec5d772ab963066e7254299ba1202ba37dd2f392bf558cc63ab98db3b6636c039a05085f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124274, "uuid": "80fa5d14-e80f-420e-9c91-42afdb67bc09", "value": "T119D4239457A7162DCC058DBA3D50050B9AFAB724BD030AD6BF0AC13D166772FB4BB3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124274, "uuid": "3f0af2f9-afd7-4dff-9372-27e2e0dc197a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124274, "uuid": "7112e716-1da3-419f-a9ab-fdc18f9349f3", "value": "12288:BUCTMNSc2aBSPgzCgiYcHAp0dePcaMdi0WKa9lD6wrcK:2Cw2a0gXiYLME3M07l6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707124274, "uuid": "74aac90d-c463-4d77-9e12-d3f4c8bb5504", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707124274, "uuid": "debdda84-b77b-473c-891c-1422a9628646", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124274, "uuid": "76464d78-3190-462a-a0e3-97f0cb188e68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9816e5a9-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144066, "uuid": "ee494aa6-5de3-42da-a5c6-a0e24dbd9681", "comment": "Malware payload (AgentTesla)", "value": "27fb513ac503240d6477e1154e950174", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144066, "uuid": "b663a8b8-b3f4-4555-89ba-3acb40088053", "comment": "Malware payload (AgentTesla)", "value": "9488dfd8800c8cf75b34d544cac08a2e5aedb31009aef644e12778a9bac14b74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144066, "uuid": "8e8837de-e716-47ec-95af-7ef1dc6de025", "comment": "Malware payload (AgentTesla)", "value": "30ed6eeb6b572fd8a04d99c0f4643f705187b62c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144066, "uuid": "162d84b1-df65-4d70-b1f1-a516d6b7b597", "comment": "Malware payload (AgentTesla)", "value": "a4878c22d949b645fdc389411934ba7e0400238a6fb225fed339bdc60f4aee825201741ac2a766201461ebd315ec7b73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144066, "uuid": "970868c9-d83f-4ade-9ba1-5d71969976c2", "value": "T150051248B8A92B46C07F87F628D11245AB369127A46BFE1DDCC375EAE472F044F12B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144066, "uuid": "d9f5f0a8-590b-46a9-966d-1e84fe8bfb5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144066, "uuid": "b19a3671-4914-4faf-b516-195f080b165b", "value": "12288:FWh868yq0Gg4rs/WulPXOoBavHapMAZUrltMKWb8UI1ZMTirluvSkD9c3h:FV68yq0N4iPXOoIvi8tMKGGuTqSL9cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144066, "uuid": "f62b7f08-e162-42fc-952f-80aa3d6021e2", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144066, "uuid": "e429bbf1-d6b5-4f46-b73e-8198c48a75ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144066, "uuid": "8e3ce41c-2755-48f9-94e4-4cff95b51abc", "value": "Siparis TS210 TRTRP2 % Vat DIP No2561 PB 34870 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824acce7-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Phorpiex)", "timestamp": 1707144459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144459, "uuid": "dca0116d-4a2d-4794-8c85-049d99260c90", "comment": "Malware payload (Phorpiex)", "value": "bb3d7bd66c92454429a8c78bf64f977b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144459, "uuid": "9f963004-b669-4895-a219-fee5cd5c1db3", "comment": "Malware payload (Phorpiex)", "value": "94a66eea65edd08ca19bf6db266058e81714312b6a51892298b461ffd8b90161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144459, "uuid": "5d6f7634-5df3-42cd-8f3c-77838b9a485e", "comment": "Malware payload (Phorpiex)", "value": "85563e7850d20f984a6264f68602fcc8a2b1a73f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144459, "uuid": "3b379e4c-8332-4f73-9de9-457da1d66626", "comment": "Malware payload (Phorpiex)", "value": "4b700461ca7ada3589360a1020487e86a3ba85c5077141cc5571d5098aee90cb460e1bfc0860ef61b20576c834ea67d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144459, "uuid": "3ea5f217-750e-46a6-8e88-55333da33bcf", "value": "T1FD833A01F550A07FF9F680FAA1F64969543CAFB413484CE792902A5B87347EAFC3606B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144459, "uuid": "0a85209c-6fe1-4213-9ec3-a1041f1e7153", "value": "f208a57ae5f6e98d6bc4d9525040c798", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144459, "uuid": "25b5f3ad-009b-4aaa-a666-3ed3930efdda", "value": "1536:AQaPX8E9Fmavs2ThOBYHpCVfF7kIchZU8mcwpjNV6IqTlEpF:AQ48BOLhO/DMZJxwpjmTlEpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144459, "uuid": "45a53094-6cc9-45bd-ab17-d4a191b314f2", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144459, "uuid": "11dd77c2-4caa-4aaa-b1ae-7bb34c0dffff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144459, "uuid": "eca2488b-ceb4-444b-be6e-fb281f1f4d5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4afd7cf-c430-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707142476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142476, "uuid": "db001c1c-e771-4ff9-81bd-2727becf8afe", "comment": "Malware payload (AgentTesla)", "value": "00950d047eaae3a184eb008390121e27", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142476, "uuid": "447ffbca-4ee1-4a13-9779-0dcb76d73e07", "comment": "Malware payload (AgentTesla)", "value": "9601e20ef76d429b66d9dadb372b9b90f2ac5f87ac0091ed620bd0382104055c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142476, "uuid": "e011b134-935e-4670-93d2-4ba04d890456", "comment": "Malware payload (AgentTesla)", "value": "6d6ebc809461daf07f3e40a076b5f49b423661fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142476, "uuid": "6cd361fa-c06e-45bf-bfc6-d2f1266f6c5b", "comment": "Malware payload (AgentTesla)", "value": "c67b8ce437798fbea561a76e92e1971fd2e9bc28d32853a1f7bb6c7773aca53c0b238c8a3c456d6c1558571607c6e41a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142476, "uuid": "1fa8445f-da19-4ac9-9bb7-a58beb8a32a6", "value": "T100B25B19B2DC4A23D5AF13796D7322101B7CB51B5A03DA5FAED6858B0EB3BD04602F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142476, "uuid": "4a6d8178-1b45-4aca-bc67-9c07a7f2c6c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142476, "uuid": "9f4717f0-fcf4-424b-90f4-1d92fa4746f1", "value": "384:58JJPPqfU8/M7Ivvz//9MDIz2PTFjPv1k0PJZq4DJ04Da8+BsOIWaieCOVQM:GJhPqfU8/M7E/932rFjPvRPUDIQOb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142476, "uuid": "445ed4ae-3b87-4761-8942-5eca5d2fe9d3", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142476, "uuid": "d14d5604-9500-4342-8d88-42ccdd4f3e9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142476, "uuid": "5fb57542-cbdc-4d01-8fbb-f6a08fc69d11", "value": "Quotation.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2918cf-c44b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707153793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153793, "uuid": "c32480a0-e58c-4b42-a2ce-546aa3cc6c10", "comment": "Malware payload (AveMariaRAT)", "value": "ebfc94231e9a58e7e6a6fa94394c39a9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153793, "uuid": "adf2c8f1-d3ab-416f-92e3-198b0854b8f5", "comment": "Malware payload (AveMariaRAT)", "value": "9670a8cd3233ee7447636ae933537455ccfa56634b15141ed9beec4583c86e45", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153793, "uuid": "f13ef9a2-809f-4d44-9118-76f98e02a0ce", "comment": "Malware payload (AveMariaRAT)", "value": "61404e9e43e5338e40d27646fa70292de6da9e92", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153793, "uuid": "3c7701ab-7b6f-4463-8086-9694b6d8db6b", "comment": "Malware payload (AveMariaRAT)", "value": "37f9f00aeaf177b73db510754df99707596c86e9a1372fe8f4b2eee67b0b79438dcd6aa3752a1c6dc0b3929b586bc05a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153793, "uuid": "48a78a8f-1afb-4769-bf72-c93de45ed2a5", "value": "T12EF49DAC365075DFC957CD72CAA82C64EA60747B930BD203A02315ADAE0DA9BDF141F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153793, "uuid": "de18b8c1-1abc-40c4-a8d0-78444950784e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153793, "uuid": "6d26bc5f-5a53-4d2d-b2cf-4e6c0a2d7afa", "value": "12288:wl5H2QEI8j8qshDcfwI1s292OF7VS9X/qMT9JajrHCAcP6AkfYtZd1tnJuFaLr/Z:wlYy8bshIfwQJ2I5S9/qMWibsfm3oUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707153793, "uuid": "e522eb01-d985-4be1-b79d-7f21dd5ac6d6", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707153793, "uuid": "916fef8e-b7f2-4293-9463-fed142e28e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153793, "uuid": "3b8371e0-52f2-4869-8837-e10f3b348b0d", "value": "New-Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42e2da3-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707144516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144516, "uuid": "68c69622-791e-47f9-9567-6a1ab2af5c64", "comment": "Malware payload (PureLogStealer)", "value": "80ab7e28d7ec49ad74b35b12a528942f", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144516, "uuid": "ec2f34d7-ab66-41c4-a2a0-6f80b93fb08d", "comment": "Malware payload (PureLogStealer)", "value": "9729dcd89ef9816a3348291f1f63e96ae01a41056b130a44ccf2f2335864ad52", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144516, "uuid": "0ccb6ccb-1981-4d6d-9e64-83a6aefc595d", "comment": "Malware payload (PureLogStealer)", "value": "6a7ba200540df44884baec4ba6e776d8368f33d9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144516, "uuid": "b5a8e110-c43e-4063-8ce5-4c64d57fe425", "comment": "Malware payload (PureLogStealer)", "value": "868e3f45fce5c2db3663ff0a4f5a1649915db5ac3ea7616a3afd70e54e29ca56d23d9210cb7b2181c11816672f5d9bcb", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144516, "uuid": "48a502b2-9ee4-4b4a-abf6-e40b7abe9d4c", "value": "T1A6D4E02817654916CF6A9770D5B3AB000B91F9B76462E34B83C4A17DA82B7BF5FF0702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144516, "uuid": "863f7330-ddf4-481f-a3ae-13eae020b18a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144516, "uuid": "dda11466-e1dd-40d9-b194-80168bf01cab", "value": "12288:442Wgy4I3z0vZIdP46N6teHKNhMKArTAJt+FqcZZHB5wT39R64L:AWgy4cz0vu4KaNhMTnmAFPZJ/UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144516, "uuid": "a1e81a20-8a49-4418-bf47-0d7579f58872", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144516, "uuid": "4ffd0f7d-e70b-46a6-a548-283c4e80c966", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144516, "uuid": "225edc71-d7af-4e36-bfdd-a140abea5fc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d48e317-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121956, "uuid": "81cb85d9-f4c6-4115-a370-dd5f6ef53763", "comment": "Malware payload (Formbook)", "value": "bb1408fc453d742cc2cf3e54e66337c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121956, "uuid": "4416f154-1b63-4c77-88d2-14b88cfe90bb", "comment": "Malware payload (Formbook)", "value": "98db6fff862c151404cf2ca328419d4bda81c342d1d6782fa6f199a482e56cb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121956, "uuid": "243c1d39-1cae-4efe-a3ac-51505af8ed42", "comment": "Malware payload (Formbook)", "value": "9a7a833bebc5eff878caf64c05f5b5775216daab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121956, "uuid": "51217695-2235-4f49-9a6b-6bc22a682141", "comment": "Malware payload (Formbook)", "value": "6f70b79f8b1b60cc6ae5ba69d1d1d8b2102343c8de50b8dff7699bcfe228453aaa2ef18d36511423b4c3c029710db85c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121956, "uuid": "7c2f5554-2a9d-474c-9bc1-7cfe2126ead7", "value": "T12204AE32D602C070F2B251B5F6BD1B7B483E0E347295A0AAA7E115E16EE09A5F52D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121956, "uuid": "102aa784-14bb-4452-9dee-59b6aa098c73", "value": "3072:LMvECkVK8gU4m2389WGeqKS6br2g12VG9fIAiTOHAT92pi:EMg89VTb6br2PVGZI/TOHAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121956, "uuid": "a0eaf378-a18b-42ef-b5d9-4589a34b6778", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121956, "uuid": "3bd8b6a2-0db7-43f3-a823-e52bf6f90e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121956, "uuid": "5e1ac110-db8e-43d7-a858-67a6966c823f", "value": "98db6fff862c151404cf2ca328419d4bda81c342d1d6782fa6f199a482e56cb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73a936f-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144145, "uuid": "32dfac47-9cd9-4ba7-a45a-726e2a4aeff4", "comment": "Malware payload (AgentTesla)", "value": "16a97a41b6c465d172281755959ee119", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144145, "uuid": "e0c796e0-ff5d-45db-8972-8fd3be9b4001", "comment": "Malware payload (AgentTesla)", "value": "98df54aa91d29918fd2dd0efa3216e0cfb1079fa01203cb698f6b2a1f2982a92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144145, "uuid": "97655510-93d1-4b9c-9cba-2003eb312296", "comment": "Malware payload (AgentTesla)", "value": "d4582884bbba1e3a0199834c64b61c0802b9af6d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144145, "uuid": "649ef111-de47-4f84-8eab-8d08d9b12383", "comment": "Malware payload (AgentTesla)", "value": "c28e620853a66755bc39480000b8ff8e879309e8326fc73cdebfc535f2ecff2563fb6c9ab37fe7101666ddbee95a56d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144145, "uuid": "6c6bba65-8c8e-451b-b56f-6bd05d5b5f4c", "value": "T10E052354B8A42B2AC47F4FF90D859142C7B491365923FB298DD7B4DAE021FD88F02B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144145, "uuid": "6884469b-1c7e-4443-a8fe-78c663e40519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144145, "uuid": "57259f59-7dbc-44a7-8601-0a0da9866099", "value": "24576:zV68yq0N4bQDdyaepzxDMsQ/DClyrQ9cx:zVsqCBya0zxD34SyrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144145, "uuid": "2de76d2e-bf1f-4754-969f-12269ffe5841", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144145, "uuid": "cf1f84a2-1095-4ba8-b802-66b1fb64ee8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144145, "uuid": "ad5936ef-a54c-4eee-a340-0d5621dce5e0", "value": "DHL Receipt_AWB#6355646657577514374654-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab5793f-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707128501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128501, "uuid": "37d93a36-a07e-4a73-8f3b-0693905541b4", "comment": "Malware payload (GuLoader)", "value": "99b69b1d1bf64cccb851e88ade132611", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128501, "uuid": "d1c658d7-e87d-46af-8580-aa81494fedb7", "comment": "Malware payload (GuLoader)", "value": "9900680a25d13633ba83cc6f9d6ce813ba564f621486029b299e30acaa4bdc83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128501, "uuid": "eeec14fb-e0a5-4a2e-ae63-ab707fecec26", "comment": "Malware payload (GuLoader)", "value": "f6f295231bdc143a688ec4877207d332d65b6280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128501, "uuid": "a0129a4d-752d-4e3d-b3d0-4f7375e408c6", "comment": "Malware payload (GuLoader)", "value": "e633515f089e84f6491ac1effd66d64bc555631f27e4aff7f16915fc1aee19267ceda2a50daad8e79b6faa9cd424e41d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128501, "uuid": "d1ec96b8-95aa-4c26-b121-d51e5a09128f", "value": "T11945ACC3858A8EE5F95F59B3C0B43C29650FAEA1C8C6031476223AF016F79DB9A7550F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128501, "uuid": "cda1e7ea-6e4e-4a7d-811d-6bae94ffbb8b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128501, "uuid": "93b9320b-6963-4430-8236-1f208c70a1c2", "value": "24576:vXCx9I1xxekSxI+y/JetA2uQsHhu6Rgaqk2SI/JWz:g9IXxnSxI+y0A2aZM/wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128501, "uuid": "862acb82-ec78-427c-b352-dff806814bd6", "value": 1232559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128501, "uuid": "20f8771c-14c0-4808-a28f-40adb6ef753b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128501, "uuid": "d61383ed-851d-49a3-ab77-f5a33b387c5b", "value": "AL-Ordine2402012.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e4ab314-c41e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707134574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134574, "uuid": "a1e65777-c9c0-419f-a799-13acb5b59cde", "comment": "Malware payload (AgentTesla)", "value": "4ef82e51e4c7054d88124788c55ef2d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134574, "uuid": "33fc412f-c389-4b63-b160-ab393c5f42c1", "comment": "Malware payload (AgentTesla)", "value": "99e884720a1982da21ea03a623e3db4d9e34462738eca8cd594cf1f815421120", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134574, "uuid": "19e9a98f-7bf1-4d24-bb5b-f1227411870e", "comment": "Malware payload (AgentTesla)", "value": "c3165ecaf1da27de675d7060fa234e5f9aa963e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134574, "uuid": "f9a6ef71-aafb-482d-baaf-211a1f7a276d", "comment": "Malware payload (AgentTesla)", "value": "5ff087d4f6d759da68e3bee8e3484fb01d58ff115ca72cc72e9e0394a4cb5aff76f3105bd9a2eefa1d1f8c43e2d36f4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134574, "uuid": "f9f823d1-0a36-420e-889c-0c835f4c16ae", "value": "T1ACD402289E359F12F93D0FF211B4AE11E3F222976516C7B95CD920C52AB3F250B14EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134574, "uuid": "cf73cc07-1b3f-4736-8fcc-ed7658dfadc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134574, "uuid": "9fb7ada3-94e2-467f-b97f-7e07a5b7d3b8", "value": "12288:nl6+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l2:n/a6u/ZKCcmdqw6S2dR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134574, "uuid": "6bb837db-afae-4813-84f5-a9a563e55c00", "value": 601992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134574, "uuid": "482dcdb8-1dc3-4fad-badd-61c4354491af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134574, "uuid": "81ccc310-7fe1-4a3e-8dad-81a2cc384097", "value": "img RFQ_6001676pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3d3b3c-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707144046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144046, "uuid": "8576d447-51d6-4b32-94a2-3608ae0e38e3", "comment": "Malware payload (Formbook)", "value": "168c4f14b651c33c525f7ae23209113b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144046, "uuid": "a3d2e74d-0ce8-4851-a3bf-6a0dca151cf0", "comment": "Malware payload (Formbook)", "value": "99f159f5917886ccb644cbb4d99a570f55fac5845a2869a7afbeccfe464f7a71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144046, "uuid": "0953b950-8817-42a8-b111-dd5d7feaacc5", "comment": "Malware payload (Formbook)", "value": "5bb870cecea212bde20c65b488644b7e1a9ce690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144046, "uuid": "c529acba-7dad-49fd-a35e-716776168e53", "comment": "Malware payload (Formbook)", "value": "a9fe505b0de58b6dfef1d5b861a4162cb3a989c8f4a4239a81005db0d086d33e26b99904bfacfa843e88a067dd16f301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144046, "uuid": "9f0a9a01-ab0c-4256-96b0-f6e1a86b9267", "value": "T1BE051248AE92174EF4BF4AF554925116A3B58C271632F72B8DC639EC940FB5B0A02F1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144046, "uuid": "16f28711-7405-4bf6-8e2b-8a4512f784f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144046, "uuid": "560fd166-ba3c-4f29-b011-0aad5390abec", "value": "24576:l7V68yq0N4L/Y7kYktG+mXvYjpzEr849cxH:l7VsqCkk+FVzo84O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144046, "uuid": "c23fc2e5-ac7b-4529-bcdf-4af0af09d078", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144046, "uuid": "64825f55-3675-4c01-9056-4c8113e9e6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144046, "uuid": "64b51bc2-a32f-4497-9468-62ed5074ec1c", "value": "A1234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2008e171-c3ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707121101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121101, "uuid": "278ba1e4-93d9-42d1-9c92-f9aff8eaa577", "comment": "Malware payload (SnakeKeylogger)", "value": "65ab735f17efb779a59a476e98ae38f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121101, "uuid": "8194e2e6-d791-4415-bfd0-af15982a7cce", "comment": "Malware payload (SnakeKeylogger)", "value": "9a887d14ba40c323a1a70eff8385c36ef3715db7a0e7e8c514cd629489ee3f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121101, "uuid": "c2d9f3b2-5ab0-4c56-92a0-5279358f18cc", "comment": "Malware payload (SnakeKeylogger)", "value": "d4af8bac0aa50d00dadb54cfbf93fc8aac5789a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121101, "uuid": "b5f59964-6583-46d5-ae12-128d9cc26d2c", "comment": "Malware payload (SnakeKeylogger)", "value": "7bef148d9c05daa18168fe9031e0a8927584ffacdbbacec49ddcb6b0d19b4df18cd9901550995937a3169de89eddcd04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121101, "uuid": "8e4f598d-c708-4408-b109-1e9b91971836", "value": "T172D4F12031794A73D23C88FD71B2928A4BB55A62A112F7C96ECA71EFD4C77CD8231257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121101, "uuid": "f9f9f1f9-0455-4822-9cee-b2e7168e37f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121101, "uuid": "cf4e1427-3b84-43c9-82ef-86245f732294", "value": "12288:TNyd53rD22Vtl/oMkJ99lpDxQaRhFmPdxtThalyys57UzBx:RGrD3wMqTDxLAPdxxhalxs5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121101, "uuid": "1bb2ae17-26fd-416c-b519-ba3933280ae4", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121101, "uuid": "16d94bed-a403-4c77-b1cd-a364d5931304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121101, "uuid": "decf619b-9aef-4e31-9c82-6645d824f09c", "value": "REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53709ff3-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094559, "uuid": "f5d60d98-4712-46e8-9576-69c6fc661b45", "comment": "Malware payload (Mirai)", "value": "d0535b23eb544b532626224459be8f41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094559, "uuid": "616cf17d-5511-49a3-bd51-7d957db9f892", "comment": "Malware payload (Mirai)", "value": "9a8a5afe0e20bd0759c29c1a890a06f8e30a32de859e1d00fe397f5c1de00407", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094559, "uuid": "92dc5347-59b5-4200-b49c-96cde1e0b7cb", "comment": "Malware payload (Mirai)", "value": "aa938a41ad88d866edf5a267caa6df0019437228", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094559, "uuid": "8a67e289-3bfd-4a75-ab49-a8ab4e4cc124", "comment": "Malware payload (Mirai)", "value": "3517005ee8b725ec97a426f3c8ca45eada10236a9b9fc5d0b45c9ff01dce0c28a000a4e2904615b61a1478df5f897510", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094559, "uuid": "a4925d00-77aa-4cbd-9927-d664549b6f4a", "value": "T194534B17B54280FDC09AC1744B2BBA3AD93775FD0378B2A67BD0EB222CA6D211E1DD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094559, "uuid": "1d911372-f6aa-4f94-b7f1-b87e0d9a78b3", "value": "1536:dpmbSQ6U3q7cCBT/lZsK/0DiQWLiKimfFoktCe3fYRMM:WShU3q7cEDlCK/0Du9i8Fok06fYRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094559, "uuid": "20444b8c-3c34-43a2-8552-373a4750c0a7", "value": 63296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094559, "uuid": "6fa9dcfb-953b-4d44-9f06-113c3bfedf88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094559, "uuid": "10037159-e9b8-4f52-b4c1-552ba8d01b26", "value": "x86_64-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d62b952-c43c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1707147350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147350, "uuid": "3ab45919-4dc0-4aa1-9ac9-3054c630c353", "comment": "Malware payload (DCRat)", "value": "523c53675f0fee6e718deb0cfb09f2f2", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147350, "uuid": "91cf055c-4203-4831-89b6-e720718fb2e0", "comment": "Malware payload (DCRat)", "value": "9bccd2dc8f14b92f591fab90b458da775598de51f9c56dca13ed0561e33eea24", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147350, "uuid": "b41b8e48-713f-4eb0-a0c5-54faec98859b", "comment": "Malware payload (DCRat)", "value": "7434e1b491dc3f8b40666eadc90a78a219ab16ff", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707147350, "uuid": "c7167642-938c-4c7c-98f6-53704926dc7d", "comment": "Malware payload (DCRat)", "value": "2cfaf3dc16c38496e2246de17205527fe870604beb55510e66c566f9c52f90fd48a71aaf88c5d141c7db2e24b35bc184", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147350, "uuid": "2fa8eff1-5a38-4d20-9ed3-4818dbeb2240", "value": "T1E31512223FC9C1B6C467063844E9733AAA76F609133185C797941A659F663C26B3C3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147350, "uuid": "ba3ac432-4ba0-4cc9-93f3-afc82b596205", "value": "3ca126d9bb80afb4394eec23e256ebf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147350, "uuid": "ad1179a8-d4f7-4290-8e78-24e5d7a6656c", "value": "24576:BJCKbYqWhdhXoW+qJ++uSEWPZd3zrpi+0:BBbYqWhdhonqYOEWx5rk+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707147350, "uuid": "843c33c0-853f-4d31-8e2d-0be57b483144", "value": 960236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707147350, "uuid": "b3355cf1-2bb3-4238-af99-efd361ca3287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707147350, "uuid": "f489217f-2f57-4b7d-aeca-b793c3804201", "value": "523C53675F0FEE6E718DEB0CFB09F2F2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ef6457-c411-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707129001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129001, "uuid": "fc8921d9-8fe4-4a26-afa9-b7faa1768566", "comment": "Malware payload (Formbook)", "value": "63f45b650e9ac6b1f7181f6ca63eb2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129001, "uuid": "402fe6f4-af8a-4857-8d81-1375a2d66e5f", "comment": "Malware payload (Formbook)", "value": "9c5a6c7bcc2daf95ed17a0dbd7586ec7c7e660338dbdfab5b1d197db8646818d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129001, "uuid": "6c4d5ef4-1f1f-4f0d-81c5-2cdc15a55a32", "comment": "Malware payload (Formbook)", "value": "f2d35d7d28ea62e1f034888eee33bceb432bfaf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129001, "uuid": "6bd1f0e4-29a9-4a9d-b9c1-7015c1ff4fc4", "comment": "Malware payload (Formbook)", "value": "795565d5068d081c61f19bda15cafe9d0266cade19c3bba4b259334449a9500840ab268596bbdbb8abec480ac143fbb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129001, "uuid": "702dac5e-f014-402f-a930-9a95471febeb", "value": "T10A942252B8E2C0DFC4AA12B05D9AE13BA7315C04C311141F5BF26F3A75F36A6899F2D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129001, "uuid": "b00c8b9b-d2b1-4e50-81da-5c6f0eb651c3", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129001, "uuid": "2141b840-429c-4d9d-8781-4a2fe7ddaf20", "value": "6144:M8LxB/bNdiku6613EDFFFqQ19AZYF1dV68hlw4K8Oq2AJ6gANtnIjNtqRjecLTww:XNdikIAFzqQ19AGdlKOOqRJFmtkPGoAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129001, "uuid": "f0fd18b7-c995-445c-92b2-a2b5c2d27b45", "value": 430188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129001, "uuid": "a83b3054-b26a-4a1c-9b72-ab8572a4b444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129001, "uuid": "20d22ea2-181c-4f85-b34d-376543dd526b", "value": "HSP-661-Valve Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e9cd2b8-c424-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707137124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137124, "uuid": "eb866b83-2fdb-49a7-a8f9-684e88038dc2", "comment": "Malware payload (CoinMiner)", "value": "00fe0d4cac30853ebf2c7c1a3c91cc81", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137124, "uuid": "518f418d-1490-4ee3-b295-b33ac09d5ee5", "comment": "Malware payload (CoinMiner)", "value": "9d50ede53cd699edc7f5fac997bfa83ec292aa7124d523969befe890d6466160", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137124, "uuid": "187fd093-9a28-4f6a-966b-b0af340ff933", "comment": "Malware payload (CoinMiner)", "value": "d583b698d57927c0025bc68eff96b4cc055bc613", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137124, "uuid": "a9295260-d8b9-488a-8cf5-60cd21b6ed72", "comment": "Malware payload (CoinMiner)", "value": "801714b70415ada9c305a4f1ca748f494ef12eb00736e6fc05c39a9a6f44aa882185fe044e29995fc304b5f27e620ac4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137124, "uuid": "b3201d34-b271-448e-bf3a-006ef4c0369d", "value": "T1EA872213762542D9D0A790BC86A50A17EAB13C050371BACF5B607F7A5FA7BE09FB1324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137124, "uuid": "a3f6746d-d45a-45ef-9c33-62a1e9d5b0f7", "value": "8fed2759c1731a0dcc74ccc3dee8a8ac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137124, "uuid": "a083a023-8e76-4cfd-991e-43f45c5f6817", "value": "786432:z8jXhyaSFsKvaXStCcuTAnWCNB9ohyvCJhOg:z8dSFsjCth1nW29eym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707137124, "uuid": "f530e600-5b8a-48ef-8656-17a81b20ea9e", "value": 36892160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707137124, "uuid": "4c4eb0b5-bc5e-47ad-bac7-14430d2cf130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137124, "uuid": "4560814c-89d8-439c-8614-57f382886e90", "value": "SecuriteInfo.com.Variant.Application.Coinminer.43.2365.22325", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b541c44-c412-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707129227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129227, "uuid": "f7684951-f835-4d8a-a7d9-47790efb7cc0", "comment": "Malware payload (SnakeKeylogger)", "value": "164650213929fabda37b39c57714b3d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129227, "uuid": "61c9818a-e895-4f7a-91cb-f9257faadaba", "comment": "Malware payload (SnakeKeylogger)", "value": "9d90fc6d3862dc5421b2aeb967b2ab4157145baafb43f3a8ea25e386c1d6082e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129227, "uuid": "cce37115-ea95-4a19-97ec-f5a4eaa9c418", "comment": "Malware payload (SnakeKeylogger)", "value": "cb33b80a8f571aca5d053065a7edf8eaf555d099", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129227, "uuid": "944abaf3-ae4e-48c1-ab28-575e5001a95f", "comment": "Malware payload (SnakeKeylogger)", "value": "792b3fb9dffe21d8bea7649f48a28e92dd0d90cb0faa12f5a48e6967ea468612ae679a2ef48c882d3ac8a2cd0b2de46b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129227, "uuid": "f5c5c6e0-3c98-4ea1-b9e5-31b71e579faa", "value": "T1DA156DD1B19089DAED6B0AF1BD2AA43015E3BE5D54A4C10C5A9DB71B36F3342209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129227, "uuid": "ae3c9c7c-9140-43c4-bd96-a9646ecc905f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129227, "uuid": "3fb041c1-b997-46de-b5fa-f0763c553a6e", "value": "12288:DAoIFFHgeg/cm++CLsksWJf3ZykQNolDi4j5aEI:DAXFxmnCLsLgPZzFl2EI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129227, "uuid": "fa231fbb-c146-4dfd-ade6-f866936c989f", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129227, "uuid": "44e61615-9b67-415e-a338-919f9ada92b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129227, "uuid": "9e67a4d4-cfd4-49f6-852b-28b116e680d3", "value": "ORDER#20240129.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7c6de8-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (FormBook)", "timestamp": 1707120614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120614, "uuid": "07015d0d-b0fc-40e1-9d5e-4b5f7f9d91bd", "comment": "Malware payload (FormBook)", "value": "82b4a692edfc17941f8b92ff54ab9fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120614, "uuid": "9540ba07-d8ad-4840-8bbb-a76abed58bfa", "comment": "Malware payload (FormBook)", "value": "9ddad999a7d1a9a2b88e669e9dbe272f9f3611d29add150ba7ccee04c21ddd72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120614, "uuid": "1ea42dd4-6c55-4303-9493-aa23b4ee982f", "comment": "Malware payload (FormBook)", "value": "dadd32c162268beba8fa40722abfbca97ae1884e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120614, "uuid": "2a9cdb00-512c-4e6d-b3ba-8c9b6bbbb265", "comment": "Malware payload (FormBook)", "value": "895411fe789ec13f366b3440f548a26aa752403d04231a01b853dcc4ba10788b1f227de8f6ca5df1f743288ec87810c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120614, "uuid": "06a7ca3a-dce7-44b1-9358-193bbaa48869", "value": "T1045523867B40DC93C8250E344536597D82F6EC588FE1EF83B61D7B3B68B3942D909B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120614, "uuid": "7a965372-21f5-4484-a2e3-1fcfa057c4bc", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120614, "uuid": "2b1f7a08-37d3-4bf2-a4aa-f5ba0363c242", "value": "24576:+t1FzNSuea5pifV0l8lLAyBlzSk1GaMe/vIL6EX5RFTKqK1QYzkzU9:6kueuQV0ilLTl+kFvIWC5RFGh8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120614, "uuid": "0e772d2a-e149-4104-baa3-b931bbca4723", "value": 1281784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120614, "uuid": "66793b48-a8b3-4321-9585-1100726dd7fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120614, "uuid": "3b8e5e4c-fe17-4fe6-9e39-8dd60526450f", "value": "SA1-23-327J-3938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e3708a-c411-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707128926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128926, "uuid": "31ef4c98-e5a9-445a-923e-84c28e70dd7c", "comment": "Malware payload (Formbook)", "value": "70224c219b4155dd85ac6d28f792dbf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128926, "uuid": "de6bf437-60e4-4b36-90b1-4ee01ffc0499", "comment": "Malware payload (Formbook)", "value": "9e56d17ef8b791e156c49abac008e8c5dc3e639105d684856f98aed512ed9862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128926, "uuid": "118c70a8-2256-4e83-825c-71c46dd4c558", "comment": "Malware payload (Formbook)", "value": "74813571b883a2981d9e7d5886fe5879f2b511a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128926, "uuid": "8c3bf697-92f5-461c-85fd-e68282f92671", "comment": "Malware payload (Formbook)", "value": "0addfeb10f9e3809d0654ed3b25a1432f4211d8a2e3eacb8ae85895e62a98d34581bfabe40d6b703910179b20da6993a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128926, "uuid": "3ad12327-0548-4829-9918-346cc64a327e", "value": "T1C9727CA26B481666D5E74F744CE3E6325A70E3D74C549A5E3EE8C18E2E03BC02F1117E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128926, "uuid": "ae26c2b3-a96a-4924-91a5-e38b5a02d87f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128926, "uuid": "340f0ee3-1e6d-4dbb-9060-95639be13f11", "value": "384:kOutaiLKV3EdekzYZJZMU9GoGCJEF8ZpHJ7CF:kd8V3DcYPfEFiRFCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128926, "uuid": "1c8fc71f-9c55-46eb-aac2-6d055bbe4d4c", "value": 16792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128926, "uuid": "a72ed3c9-f84d-4479-a050-c18cad46f83c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128926, "uuid": "2027e245-9c7d-43ef-b920-793cadfc4d62", "value": "Statenment of Account #4576300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5aa2e2-c431-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707142838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142838, "uuid": "2027617c-e798-4450-bf06-71ac904b7c34", "comment": "Malware payload (Stealc)", "value": "ec46d06db14dcf1c83151bb9a18a83d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142838, "uuid": "7ddf9db2-f82f-491e-b956-e76f98f44652", "comment": "Malware payload (Stealc)", "value": "9f263f90eaaae77714ef74eab8b799376160bb8bdb3f58c3d987d9e236ebcda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142838, "uuid": "9931bf5d-7642-483b-808c-3c800b86ef61", "comment": "Malware payload (Stealc)", "value": "fee69ba22083254c9e801a38982ff07b47a8c79b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142838, "uuid": "6e92b7b8-551d-4843-88c0-90fd80472533", "comment": "Malware payload (Stealc)", "value": "2671e4ed5a1db7d55ec64561c18036d753557fed326444047c463893f80f2b48d6b2ad6e9d7786de08b854aff50ea7d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142838, "uuid": "784f1d58-9178-4d22-9b30-3077dee7af5f", "value": "T1CC646C03B2E1BD50D9674B728E2EC6F83A6EF561CE59776A2218EF5F08701B2C163711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142838, "uuid": "919b928b-be97-442b-a921-a2d5e30925d6", "value": "b585adb193cc73047fae4142a994b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142838, "uuid": "1f20c02e-7dcf-4a2f-bd55-1e024a340f3b", "value": "6144:G+LOCl4N6wUErqvEWD/yMReSzVrbB4d3V:G+SCsSnv1KGbzVred", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142838, "uuid": "069545c0-8f9d-43d5-a95c-2d771fea280f", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142838, "uuid": "d5152bfd-e034-42bf-95f1-dcb290d2450c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142838, "uuid": "57e34cae-2312-40cd-8ea5-a69f72476f58", "value": "ec46d06db14dcf1c83151bb9a18a83d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0cf7e3-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121957, "uuid": "c21ed99f-6935-4ab4-8abf-6d0f0b9ed741", "comment": "Malware payload (Formbook)", "value": "f6f4066b58b598dae7f47125e8e6f932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121957, "uuid": "b40fbaf9-0571-4c65-b583-ebe61960081c", "comment": "Malware payload (Formbook)", "value": "9fa1cca42acf8598282acf8346fdd11ad4ba13aeb6527c9033fa5084ac27d131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121957, "uuid": "2ce9832c-70c2-4f17-bd61-cf79d528b14f", "comment": "Malware payload (Formbook)", "value": "27686d3f45372cd0b904aee33f6245c30b0a2146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121957, "uuid": "800ff979-fb11-408d-ab6d-1cda149e7093", "comment": "Malware payload (Formbook)", "value": "eac35ae3e1264781967ddde4285ed7d6cb6465d0207526957c578257c28b6486f444126ce504b3225bbb1b69f23a9e65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121957, "uuid": "35d3b73a-25e2-4173-a8c5-6bca25959bf4", "value": "T1A404AE36D602C070F2B215B5B66D1B7B883D0E357294A4EAA3E12AE05FE48D5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121957, "uuid": "09a21c90-3789-4603-9c65-983f2462cceb", "value": "3072:7h5MEfXo5Fwd38wi8kHaJ47Hxp00CABkW+ALRYpnz:7xFR8b8QaJ47Rp0BGkW+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121957, "uuid": "7994c1bf-d07b-489b-9c42-ac6dc3eceddf", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121957, "uuid": "4080980f-7c31-46e6-ae15-13403a467c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121957, "uuid": "c15565bc-7d32-434f-bee0-10bee6c11c9c", "value": "9fa1cca42acf8598282acf8346fdd11ad4ba13aeb6527c9033fa5084ac27d131", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa774454-c3bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707092128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707092128, "uuid": "d1ac1739-fe23-4b4b-92b8-bbb146c3ff38", "comment": "Malware payload (Stealc)", "value": "138a318d5ec73f981d7f5fe0e96c9011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707092128, "uuid": "7a9646a6-44f1-408e-a7c1-f7a8f85c158c", "comment": "Malware payload (Stealc)", "value": "a022daaa10f66f7870e535d0cb76290e5d3d6bba6e73708673c528bdb1417215", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707092128, "uuid": "be83f07d-be99-4a75-a51f-0290eb9cc2d9", "comment": "Malware payload (Stealc)", "value": "35683552317016fcae123a8f4c50857bf7b3b7ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707092128, "uuid": "a7a38f01-43ac-4e10-9f9a-c68e0a9c1b9c", "comment": "Malware payload (Stealc)", "value": "6bf5d3cb70e353fe3b26552c30c4ff40d3db7301663e5d48c683e3db34b2bba7a328e44a039e673b812b0e4d643d10b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707092128, "uuid": "6c7d517c-5444-46ac-a877-38f52b36477d", "value": "T14254BF1023D5E471D19725358925C7B24ABB78256A23AFBFBFD61B7B2E34380DA2430D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707092128, "uuid": "9fcbbf46-1017-4c45-b933-da715d037a9d", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707092128, "uuid": "268e217d-19d4-4d0e-8538-6422383252c4", "value": "6144:95nAzlTq8VHdUMyc9R43+6I8r8xfsD1lu1s:95nAzleYHM3fIfJsD1lu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707092128, "uuid": "0f22ae49-4d0e-4549-b4f2-7576de8cf0fc", "value": 291840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707092128, "uuid": "0fc3efb8-94f9-46f7-8cfb-91da71c8b2f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707092128, "uuid": "2206e516-9e34-4311-b120-b2541afd72c4", "value": "138a318d5ec73f981d7f5fe0e96c9011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3133d6b7-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707128431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128431, "uuid": "f7ce0d2d-b7fe-47f5-890d-bc45ae4932c3", "comment": "Malware payload (AgentTesla)", "value": "f947e691fcce0f1be14057c6fb6feaf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128431, "uuid": "ffe285e7-e549-4887-99eb-a84d3909c4a3", "comment": "Malware payload (AgentTesla)", "value": "a05415162237c6bedaae4b41da31608b9e16c6f160a56c54425667c52593779e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128431, "uuid": "2e4f68a8-789c-4210-863d-83ac6c7e0eb2", "comment": "Malware payload (AgentTesla)", "value": "1e993587ceda1644e711db921399b5107125d24a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128431, "uuid": "76a261e7-4a66-48a0-b765-befb974c519a", "comment": "Malware payload (AgentTesla)", "value": "09e2dfb0d3b3e81ec4ba7e3fe48b2624ea690c124a66448b29a9df54f945095002a3013f95d6bc93987181c1e76c83c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128431, "uuid": "fb4006f8-ddf6-4449-afde-368001ad8a7c", "value": "T15635CF852AB34F14E43E57F450650101A3B4BB5B752FEB5D9EC0A0FADEB6B030E86A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128431, "uuid": "6b940456-84f0-47b1-8ae1-009a5917d50f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128431, "uuid": "8eba7e7f-fdb9-461f-af81-f8fe9213bd12", "value": "24576:JMyUI3SLrDZ0OCXFwIVKAD85NxO+SGrytKfgL:qDZyKIVHD8Tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128431, "uuid": "785108ff-a8a5-42bf-943e-0ae30941b1f4", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128431, "uuid": "d2239bc6-3d4f-4695-a57e-beee28743d4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128431, "uuid": "37df4d47-9038-4643-b38f-b762b5f36333", "value": "BONIFICO_BEU1706601709133170_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9663dd-c3f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707117958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117958, "uuid": "a62411f3-e624-4c1b-a554-f1ed2317a462", "comment": "Malware payload (AgentTesla)", "value": "0d3adf5486f3cc40d035540e9ecdc0a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117958, "uuid": "62ac71fb-ca38-4af1-ad2a-f740fe08e6e0", "comment": "Malware payload (AgentTesla)", "value": "a19472bd5dd89a6bd725c94c89469f12cdbfee3b0f19035a07374a005b57b5e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117958, "uuid": "2d740831-942a-4d99-8283-aeef15977d5e", "comment": "Malware payload (AgentTesla)", "value": "5a45677082690b3125322bc23537dcd88c376061", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117958, "uuid": "2f0161bb-a61f-4005-9c3f-831d4b631a9f", "comment": "Malware payload (AgentTesla)", "value": "77a27d6664337f5e076f153b47a64c6cfedd7cb7c264dc2914332e15f1cd30f7ef5d79e9509c78a4ab92ffc8995262ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117958, "uuid": "961362eb-3b45-40a9-8f95-73635d593372", "value": "T1F5461D97BA806D7D70CE916410217BE9E2ACACA788DB835C875DB0814D7FFDD8C3A446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117958, "uuid": "8c68e3aa-c844-4794-b30a-c50fc3581cb7", "value": "3072:W26YAJS13TJpI+IjIp7QFdY2Rv6J+LBYhHt0VZNoyEhLdNkeKapF7PMIl5l2+eSA:mAzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707117958, "uuid": "4eade33e-992b-4b39-87da-d8a9e353e429", "value": 5495213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707117958, "uuid": "5e2ea28b-675f-4be9-8dc5-20a7bc6f67f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117958, "uuid": "ad1adad6-e747-4def-876a-af1550e44316", "value": "atom.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5aa779-c3da-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707105445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707105445, "uuid": "e8c5204a-a583-4117-87e3-18f54d8a90e4", "comment": "Malware payload (Stealc)", "value": "46d44e00b19778dfb3f9615c774c8589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707105445, "uuid": "09316db5-ea87-4beb-88ca-da7a2b20965f", "comment": "Malware payload (Stealc)", "value": "a2426a4ecc9babad217d30ecc526382eb2b72a2611dd4c752c3811ecc038b6c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707105445, "uuid": "4bb76b65-37b6-4240-8695-dde7f05614e7", "comment": "Malware payload (Stealc)", "value": "759b363feaf289c1e678e08abc7d68812cb1f200", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707105445, "uuid": "ad4dab4b-7e92-46d6-bfb0-71048d3c2507", "comment": "Malware payload (Stealc)", "value": "63413f48725cd52395ec6091bdddb48a30d724c4d240ca8b8fc87a99f894c6a1dff3d1fb21cd56388cb33809a8cd3081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707105445, "uuid": "13e12c17-465e-4a31-b9a8-9d78b1dbd7bc", "value": "T16DA5334DB5578E32E8B94972A5312BF767BE8E7846D435187734B7C8387002B229FB42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707105445, "uuid": "a758673e-bd19-4b4e-830e-ec11d7270b73", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707105445, "uuid": "e04b444f-4cff-4e43-95a0-78d3999f67fe", "value": "49152:ChVF2z0X1W34qvuyXPHcqaGqW9gwLgMyu5noEiyIJAul:CfFdFWINS/NF9gpMR5oEfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707105445, "uuid": "d513a3b7-9c99-4421-87a2-8541bdbd4280", "value": 2123207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707105445, "uuid": "cc273fa2-4400-4a58-9bf3-147faf470718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707105445, "uuid": "92f5e186-46cf-4052-bb4d-6a50c2216639", "value": "46d44e00b19778dfb3f9615c774c8589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3ca4b0-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707143991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143991, "uuid": "41d73f8d-dc2b-43a0-a1db-ba741a29f688", "comment": "Malware payload (AgentTesla)", "value": "8529f220a47606440316b5fa15df773a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143991, "uuid": "51f7d0b2-ec2c-4bfa-a063-5d91d6f7e3ae", "comment": "Malware payload (AgentTesla)", "value": "a2bf23a924850ed2737ac093c267bee77953e4e8164f3f10cc272ceb7dbebe53", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143991, "uuid": "272459b8-b101-406d-8594-f0cc1fcbf39a", "comment": "Malware payload (AgentTesla)", "value": "92b379dcc94559262355cf3172f4488499cc40cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143991, "uuid": "5d596dab-bad8-40ed-8dfa-f09fa813c505", "comment": "Malware payload (AgentTesla)", "value": "e14e4dec8f971df9091d4275d5bf10a5fbc87f884edcacaabb90a18a08255bcb979f2626b7f654474e9bf8c5f456e3f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143991, "uuid": "d75ba637-a3b9-40a9-acb1-fd09969a8631", "value": "T15F25E191E6DC86D6E4A3AF7244B79D3295B332BCA4B4451E295CB6327BE3343002EF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143991, "uuid": "06d55e29-3871-4d2a-80db-0b7fb0dcf610", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143991, "uuid": "931eb7f5-4df1-4767-a291-98259f0036e4", "value": "24576:K+avBXTCRkc3ELdbZnPPioSAaowgxJ4B/F3YdgDmIc+:havBXTekc3gtSLow4a19Ydkc+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143991, "uuid": "5dbd7ae1-47ed-499a-8428-47af6dceea33", "value": 1022192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143991, "uuid": "a4e215ea-6d7a-40c5-8405-e2372cd08dd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143991, "uuid": "d70f1e2c-1fd4-4cfb-b3f9-6ef98e33fde5", "value": "PANELLI s.r.l. .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36bf4b7-c3f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707117939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117939, "uuid": "9441f40c-a265-4b2b-9dbc-4898b2718ceb", "comment": "Malware payload", "value": "feac523f300947e52e2e5ca44221d9d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117939, "uuid": "79190e48-a820-4eb5-907c-acd9382c575e", "comment": "Malware payload", "value": "a2e7f3210ef4f7fb06606399dd09b873715abc2ce4a45900bd2434f37d55c559", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117939, "uuid": "eb4a5ea9-0b14-4df1-9ee5-63f50ff6fed2", "comment": "Malware payload", "value": "ac6dc611f760b48779bded9a5e6816c91375fd2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117939, "uuid": "dc2232a6-2407-410e-bd8c-d4356886162d", "comment": "Malware payload", "value": "a803d066a4f9f7898b6b9c18e5bf292ec5214502ef85bd8748b9b791435ef3fe9a65894aa5e077b6fc23499522761c18", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117939, "uuid": "25a73e1a-3151-49fc-a3d0-2ed393567ad0", "value": "T17E338175F7DBE3880B039A5C583D3E379BAA85D005D4923B8A6B0D09A185F7236177BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117939, "uuid": "0049aace-0203-43fd-82c3-4cb22d6c4075", "value": "384:86SDvX7hWFcTPm/K7Uzzzzzzzzzzzzzzzzz3SkYTZvL:86ST7hWGTO/KQ8ZvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707117939, "uuid": "87b4af11-d5e2-45f5-8272-83b450be2aeb", "value": 51682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707117939, "uuid": "85b0a8dd-4e6d-4f09-91b5-6461b249d911", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117939, "uuid": "908af2e4-c375-4d00-a393-b5b42e7c27f2", "value": "invoice-1580727057.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f15a754-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1707144453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144453, "uuid": "edfdf1ab-a547-4611-9b40-5cc556050099", "comment": "Malware payload (GCleaner)", "value": "fe5e6f3511282f64d0bb6d42ff126b25", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144453, "uuid": "a69d5531-e4bb-4bed-b8db-685999afc20d", "comment": "Malware payload (GCleaner)", "value": "a939923a67e6c9d0ba120381e2bc5323ea80527e333d977366c2a5669a995e13", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144453, "uuid": "5e247711-1c79-445b-8252-a1c689b68488", "comment": "Malware payload (GCleaner)", "value": "77a8dcb00a6b382b78d0be7f026d8a5a354aed49", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144453, "uuid": "f4a49620-b017-4cbf-97d9-442e5db25fb1", "comment": "Malware payload (GCleaner)", "value": "f1a013369e21bb240b0525e68afecd76176e04a59af8161b59efc04dc29ba23f493319eb7e44aaec454c69fbb7dc5fe3", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144453, "uuid": "d56244df-d1e4-4a9a-a61d-d32680f2888d", "value": "T15736AE0576E58E31EB6E2776D0A3413253F1F4925393F33B279226A828737E84D8D25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144453, "uuid": "5585ed2f-9f66-4398-8f46-19301f509fb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144453, "uuid": "25f2c407-03ed-4078-aa44-08b26003ef9a", "value": "98304:pyOTq8U9dDWWjdQrrbKLtKX5uTfOW/QuxwiWgIAvMsdM++:pyOTq8U9dDWWjd0rbcwXUCW/QuxwUkNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144453, "uuid": "ac645bbe-2fe6-41df-83c3-c0d481624dfe", "value": 5307256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144453, "uuid": "515a8344-7831-46cd-a8be-6d18177fbf09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144453, "uuid": "e99c628d-0278-4bcd-8e9f-bd12a6f4fc68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdf8f8b-c44b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707153709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153709, "uuid": "7617998a-ce01-4c40-bd26-696ec3dbc5f2", "comment": "Malware payload (RemcosRAT)", "value": "fc897bc1923c3dc25e823108d5478d83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153709, "uuid": "613d6010-adec-4e5b-a053-b98dfe7eac96", "comment": "Malware payload (RemcosRAT)", "value": "a9cd6552de4f6589e50cdbe8da9d008fb3a494d425ce0e793f528e01ccc3666d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153709, "uuid": "6a319da5-f9cf-4c06-9c19-ac7f1b0f5b1c", "comment": "Malware payload (RemcosRAT)", "value": "03bbe1bf73b1c4d463526f135af2de678d7bd55f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153709, "uuid": "00aa7e66-5e16-4319-b3c0-45bba8d493cf", "comment": "Malware payload (RemcosRAT)", "value": "e933bfd070997947c27c5f05daffdca029558ea16615c09a9edf397d058a6d934d65118f29395e5c127dae146500894a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153709, "uuid": "e157ca67-fe11-44f8-940d-e3f2b42f3db0", "value": "T1D7F3D72BFA9695B2C389673AC6DF01040361DB81B293EB0E7D8E33D558C37B6AD41647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153709, "uuid": "24e2a472-937d-4d89-8a52-06cceec98eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153709, "uuid": "5d5147c1-0bb5-46f7-8b46-2ac567d78493", "value": "3072:WW8gGV+1zsKFQshtoBl68jeJ/ji+CQ83bqzqwmNSA:WW8gGod1FdGDeJLi+CQ83bqzKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707153709, "uuid": "5efa2155-fcbd-467c-9ddc-2ef253c4bb2c", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707153709, "uuid": "00c99c84-88d7-4206-ab12-5dae2f6c12f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153709, "uuid": "4a3ddab4-fd8a-4265-a5af-0407d6c78c1d", "value": "Copia del Pagamento_ Intesa Sanpaolo.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4474cf39-c437-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707145214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145214, "uuid": "9e117c4d-4f4e-42b6-8863-e18b0f5ba080", "comment": "Malware payload", "value": "cb75b6e7910427dca089ae5017842744", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145214, "uuid": "0dc7dfed-b198-474f-9794-8ea734375303", "comment": "Malware payload", "value": "aa0d0e6b9d2837caba23565e62911125f3f9135a642c3216ce98b4ca92b6a320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145214, "uuid": "f2e2cb5f-791b-40b6-a62f-36834dd9a3b8", "comment": "Malware payload", "value": "fe2a8c7ecf572fb588ac48d5203a46df4db6ef18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145214, "uuid": "8c53f142-6d84-4f2b-a780-74ae215e2ae9", "comment": "Malware payload", "value": "d878d4fd8b0f7918a3037e36dd5d979ddaadfbbbd1042debc85ee55a76a1023582ef36e0962e824c848dd0d27efd66e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145214, "uuid": "a5b9b3dc-62a4-4a61-bf1e-afc107c7159e", "value": "T1AF76334538F15F32CA7947FFE919B128B3751E7B9B926A69630E00AF363E027C181536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145214, "uuid": "7e0390d3-7d88-4556-9252-a3c87201d08a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145214, "uuid": "26c8cf98-1262-48eb-b185-f198d0ccaf4c", "value": "196608:wer82TklmZKpwpFWNfCef7xaKrqxfaorxE39QdBWe9ej7:wMKCkjao2faq+Gbcj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707145214, "uuid": "5fc85af1-09ca-4900-a867-2c8074acbfd3", "value": 7432583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707145214, "uuid": "c769b6c3-893f-4a01-8a11-fe62aa064df5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145214, "uuid": "4983164b-d058-4c6f-a10d-5dfbdfb00358", "value": "aa0d0e6b9d2837caba23565e62911125f3f9135a642c3216ce98b4ca92b6a320", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12951c49-c412-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707129239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129239, "uuid": "e2c83ce5-ae2c-4981-80fd-8c3b25ecd203", "comment": "Malware payload (AgentTesla)", "value": "68e2083de8a5ba17c552a93225f7f1fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129239, "uuid": "bd5e45fa-af24-4a0d-a924-a86772a3a5e5", "comment": "Malware payload (AgentTesla)", "value": "ab0ab872b074e41bc8391409aaee38fcae8a8814fdd5b0cf26ffb6da8cf9f55c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129239, "uuid": "bdc6d7f6-6130-4433-b12f-de22a72bac2c", "comment": "Malware payload (AgentTesla)", "value": "169a92cd3b084514f5637550b4d9e0104e1b1722", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129239, "uuid": "dc75f527-dd3a-4502-b475-c974b8d225b7", "comment": "Malware payload (AgentTesla)", "value": "830c19791926975022bd456ce58f22a3b6f43a3185857e05a451a3f19b10d6aa208415ffd931edff9826bf151a175746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129239, "uuid": "8aef6711-f0f7-4acd-ad10-b3a320c16980", "value": "T13AB25B29B3F88636D4BF573C69B3221017B5B5175A03DA9FADC6548B48B7BC00A12B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129239, "uuid": "49996355-1493-4cc2-bf44-b0b66e21a34c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129239, "uuid": "f2fc4eb7-5c2d-4371-9571-f0e66eaf5118", "value": "384:rvERnKRShEOq2Ul/u7Iv6tlUXfR48xvQAKiYyFXV0rUH6IC6jwsPoftA6U2ZOVUk:ziKR6EOq2Ul/u7oXu8x4AZYSSlMwswVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129239, "uuid": "39492043-a506-4e67-8726-ff97a10c0093", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129239, "uuid": "fa98fdf5-567b-435f-a03c-5dca44b2c35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129239, "uuid": "55884860-d234-48bb-b9cf-2a0592743706", "value": "SecuriteInfo.com.Win32.PWSX-gen.19724.10468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2c6878-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094545, "uuid": "cf069b98-51a5-4c3b-a831-80274f6df314", "comment": "Malware payload (Mirai)", "value": "86f8eb8329ed6c4c43e54ab0f1425197", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094545, "uuid": "e27b50c0-326a-40ad-9fdb-23a5a3a0c5d3", "comment": "Malware payload (Mirai)", "value": "ab8155f00201bf901776554ff4240d76d73b8fbc04ef3b65d6546dc96ae35cd8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094545, "uuid": "8e3e12da-3e3c-417b-8940-a3a25c4e869a", "comment": "Malware payload (Mirai)", "value": "19c7baac92bcd61dce34f9984878e0998103e5ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094545, "uuid": "4cae5915-2ef7-404c-9452-fcd35ef72386", "comment": "Malware payload (Mirai)", "value": "117837a084584788cb7b8891d248fff7e4b8ce362350fb4e9b43bab3b1395fc8b1a556b918c8d5d7588d3e406e45928c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094545, "uuid": "94bc7103-da56-47d0-82ed-19f521925794", "value": "T118730856B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094545, "uuid": "fd169d1f-fd15-4fe5-9507-877272ebcaf9", "value": "1536:mln25xPBXk1wnnkL7+KE007kjVkyazN0bIqvikNnsvHTGsV5GYIW2:rxpXCMkM/Qja4NnsvHqsVER/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094545, "uuid": "b7594e7e-a8a0-4378-b031-330db8c76314", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094545, "uuid": "226630ec-2bb0-4e0b-892e-544a53e1a1af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094545, "uuid": "d20dc77e-182e-466a-b799-9236632ecff4", "value": "arm6-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53c1a7d0-c44f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707155548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155548, "uuid": "1cbf5ad3-4613-4e17-a680-410bf4da79ad", "comment": "Malware payload", "value": "b052ab77f5a25c7a400fe226cfb7cdc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155548, "uuid": "dea67128-f11a-4e86-ae8d-e826c28df819", "comment": "Malware payload", "value": "abe1d381c1a833fb7e99f55ddc10a4d874f340c5304790e1b82373a32d5f2289", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155548, "uuid": "1ddc563f-efd8-454c-9734-9632d70a6141", "comment": "Malware payload", "value": "73d84bc9e449af733368e7fc1b2d070f67cd5221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155548, "uuid": "4db029a5-8e75-48c6-8087-af0838253565", "comment": "Malware payload", "value": "4f36b19e710dc3290a9fc38d467d9e34c94abe1fd04b947d08eb929da2a261c00c99bbec8750fecd735a430714534d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155548, "uuid": "25f48a65-0b5d-48c5-ac87-2e84e45c30d8", "value": "T1A255CFD1A581482DF1A7ABFC6D6BFAB5D56A6B234B21D15F33C43DF10DB008C6726222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155548, "uuid": "7cb82382-ca8d-4ca7-a038-0985ba70e909", "value": "369fe35b86c83b3130c02698158a4d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155548, "uuid": "d789d533-8249-4adb-997c-bd1ed37ffd10", "value": "24576:vRmJkcoQricOIQxiZY1WNzcsR+4TiDnGucpJlwiudQ+u2yEvbeso:kJZoQrbTFZY1WNwsR+4Ti7Gumsju2xvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707155548, "uuid": "32a7dc3a-569f-4b76-85a3-ab547e4a1f76", "value": 1344389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707155548, "uuid": "e12c11e3-fa6a-4097-a88d-4e98c15b4ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155548, "uuid": "91bda245-d509-4267-b804-531cc76a2787", "value": "Order-2232-PTP-deupx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134e4bad-c431-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707142555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142555, "uuid": "368caf83-68dd-4cd5-b456-eb2d4470219a", "comment": "Malware payload (AgentTesla)", "value": "88bf2226d528a886c4ca9903cb704585", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142555, "uuid": "9812b82b-6fb2-4a04-be6c-7b6016bfc04f", "comment": "Malware payload (AgentTesla)", "value": "ac161dc52077d5d50dae3be1c007117b6a8b2a8bb24cc83f3a931f44270d9701", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142555, "uuid": "28172b7c-6483-4bb8-8dea-5d8aac97928f", "comment": "Malware payload (AgentTesla)", "value": "6230c0549bdbd7df02cc4ac1e2fde037af663d8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142555, "uuid": "7c612392-c6b2-47dc-8426-6f59eacf3af3", "comment": "Malware payload (AgentTesla)", "value": "e6bb5ab27ed17ae985c20cb22fe1272546ec7fda7d007ce36f45c65ce97f3419d73aee7d0be2b3838088455e1a007468", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142555, "uuid": "19efbac6-0e67-4555-b61a-8f1e4fade5cc", "value": "T1A754C5C2D25501A9EEA84F359C771D2E16676F78A975F20D285CB0322FB33D201B9E1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142555, "uuid": "f52a32cd-ee7e-4c14-97cf-b22e1771a031", "value": "1536:FSn3ZtwRuoeQK3NOKR8nYJL1TmIlulYvLnjNNokelsKJK6pWS6fWYQPPsTuH+fTt:EoeQK3/8YXfrrjXoVHKI9F8TZbhbYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142555, "uuid": "dd72b942-158f-4ae0-9b86-c5b5a271cbb0", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142555, "uuid": "d1ef09bd-6ebd-4d8f-9f2c-44881d20da58", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142555, "uuid": "52dae7d9-4892-4ea6-beb0-b2a3e2a7d5b2", "value": "nNuovo ODA OF179_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed19b83-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121958, "uuid": "9ba45aa0-4f43-45c9-83e8-239c29ab58cf", "comment": "Malware payload (Formbook)", "value": "d599fc96e1bc6a0c3e415ca2b4fd7530", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121958, "uuid": "5ada1106-87a0-4306-b24a-d0f31a1d5f36", "comment": "Malware payload (Formbook)", "value": "af0148cdd6feaca74880647deaefb36851f430bb8207b2a839b2fefc7e8ca22a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121958, "uuid": "3f5e1beb-1c28-4500-9b04-c20464ab1da4", "comment": "Malware payload (Formbook)", "value": "453ca4af8829abeb1f3f91932eff57260066fc1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121958, "uuid": "abf269dc-777d-45e6-9f26-cf2f2443658a", "comment": "Malware payload (Formbook)", "value": "6ff487d20e7064d660c0ee5e520bfcbd9cb0e4bf9fe2aff4f7d3f96a9fabaa33052584dabd97c764ca780608076ecece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121958, "uuid": "0d333f50-9b53-4090-8116-56d20898c795", "value": "T1F004AE36D602C070F2B215B5B66D1B7B883D0E357294A4EAA3E126E05FE48D5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121958, "uuid": "fd7dff52-1400-4f68-a409-77d6974ff4db", "value": "3072:oh5MEfXo5Fwd38wi8kHaJ478xp00CABkW+ALRYpnz:oxFR8b8QaJ47Cp0BGkW+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121958, "uuid": "9f9855da-d94b-4750-b0d0-6e98ff751bec", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121958, "uuid": "e61a94f8-cfca-47e3-9de2-26b679968aa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121958, "uuid": "a0b6dde6-5695-4686-84c5-a819d1fb5445", "value": "af0148cdd6feaca74880647deaefb36851f430bb8207b2a839b2fefc7e8ca22a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d65aa773-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707120548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120548, "uuid": "627cbf6e-966f-451f-b9aa-ba2de2fb1105", "comment": "Malware payload (AgentTesla)", "value": "de82aa829cf7e407eff6761a8cf93b9b", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120548, "uuid": "b6e28217-9b3a-465a-bb89-d40b11f9bf1b", "comment": "Malware payload (AgentTesla)", "value": "af0514c9dd0576269b24f5edcbeb425ca071ed91e2ef98769bd100f24045adc0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120548, "uuid": "f24e1f76-917a-4893-b400-44b809b9de8c", "comment": "Malware payload (AgentTesla)", "value": "932086595c4d91ea295bfe75ba8f53205b8483f4", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120548, "uuid": "ca338150-ebf5-4e2a-adc8-8808f0de608b", "comment": "Malware payload (AgentTesla)", "value": "81c337a42c24d85b42860c0e326cb5bfdf0f58a61f028d7c3a3f5ec14433db6266c959dfe107d3ca2555047f7ccb2712", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120548, "uuid": "a4e09594-72db-4473-a797-c0fb084ee218", "value": "T10732C0B0AD753150D0EC6361E2E606ECC548CED89FC812E385EC2DB187DAA95668690E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120548, "uuid": "6dd6f484-b126-4cff-b090-a637f7feeadb", "value": "192:kkip83FhBknUE4tTEeQbeSUBMaCLVdRAHa8Ml1FLffy4OiV+JvWq0G0JgafxQ1N8:kps6JrBbeSUBMb268MlL7fpEvWawVfGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120548, "uuid": "494f5a91-9088-4788-aec3-cfae09434465", "value": 11869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120548, "uuid": "b654ccaa-3e90-4de2-9abb-90a11bf408d0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120548, "uuid": "7e21f000-9ae0-4342-87c3-273299413a45", "value": "RFQ-20047577Q.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c81fee2d-c3f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707117947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117947, "uuid": "4e9bcf99-c8d6-4201-9353-0313d9ecf9cb", "comment": "Malware payload (AgentTesla)", "value": "0612fb7c23aef2a0f93084b8efc0e170", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117947, "uuid": "a73c6ccd-9c11-455f-bbe2-e837e11fce23", "comment": "Malware payload (AgentTesla)", "value": "af54d1421eafc452618912c18aefe07ca5880743114e02cbc6edd1367037a901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117947, "uuid": "549a9019-8be2-48f5-bf9f-20c24d63a517", "comment": "Malware payload (AgentTesla)", "value": "4868125a13c39e38f189c11106e735bbfcfc023f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707117947, "uuid": "d8e092ee-b07b-43bd-985e-91ce17deacf5", "comment": "Malware payload (AgentTesla)", "value": "91288a23f7d4025ff71d86b14397ef893f3a022608c959f93a4e2252264004005d1c0ecd827d8c3043eb0d22c0604a7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htlfeb24", "colour": "#0E1819", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117947, "uuid": "793dff30-b9b7-42a9-b1fb-b7c2a08fefad", "value": "T11D05FC98E10ACB6734BAECAD34791D034EC7ACD7889C84CCA6C68E0D73D659A51DD1DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117947, "uuid": "58c65aed-393a-4c9a-889d-aa5a6bdf9963", "value": "48:npsOq1HtFvMbvAazEEydWh8mqod2ddIXBsvo3BMWz:npfq1jQvAa4Ed8Hpo3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707117947, "uuid": "cbfa962f-846f-484e-9b6d-288c05e49a1a", "value": 841495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707117947, "uuid": "d6c6b349-44a2-42df-826b-8ff8426ba5ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707117947, "uuid": "2f57264b-6098-42ad-b11c-0fa89cc61b25", "value": "invoice-1580727057.pdf .JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e7ef41-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707125436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125436, "uuid": "c2751fe6-e5cd-43da-9682-a81436c17b15", "comment": "Malware payload", "value": "0151e006443174af2f2ea167eb3317fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125436, "uuid": "8b9411b7-ab02-43c4-8c35-1eea1cb40a2e", "comment": "Malware payload", "value": "af722c86835a47bbb5913361b0cedd00288aa23edd04709460902e4cc04be497", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125436, "uuid": "9e4f2eb8-9fbf-4d27-ad5b-4aa4c3f9b296", "comment": "Malware payload", "value": "4867584b2bb6a5d5b9082a5a1b5d2d571eed7ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125436, "uuid": "1f37fce5-94d6-4bfa-b7b8-2a7fee8d08ed", "comment": "Malware payload", "value": "1d75530741bf630cecc03276148f275ba34e782f14079e654237f85e13ecfd5faf2e1947158bf85c0494afaa92977597", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125436, "uuid": "35db4daf-5dfd-4435-ab04-5a7fd259c8cf", "value": "T1DC45CF063B14E986D26813FC92B5A3E593DC2DB5E040CFD5A69667EB08B612C5E10FCF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125436, "uuid": "27ac20e6-c038-4756-bb4d-d295f133d8b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125436, "uuid": "6eacfec4-de50-417e-82d5-96ae886fd6f6", "value": "24576:aO4dHPD/U4dYG/2ndSzGmTG2/mRQdc0GmTG2/mR6Trr2h60qP:a/PD/z/5HZrr2h60qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125436, "uuid": "8b1e6a2b-d51e-4bca-afcd-e40ce5aa29ea", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125436, "uuid": "acabffb9-e782-440f-9b55-349e42e19494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125436, "uuid": "6ac12cd0-f287-420e-a495-6c4e3fd55195", "value": "SecuriteInfo.com.IL.Trojan.MSILZilla.84608.20683.10373", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20540c73-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121961, "uuid": "87f6e924-6bea-4eed-b71a-c5aa67fa8399", "comment": "Malware payload (Formbook)", "value": "ff41776ff88b6904c25f820355c53198", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121961, "uuid": "c68e499d-232a-40f4-a0d1-6edc194b69fb", "comment": "Malware payload (Formbook)", "value": "b028c1cd096c92b3a035f54901315e2958ac5f8459aaf6f5fdad94bfcb201d68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121961, "uuid": "fbd8c2e4-bfda-4fa2-92e1-6f9b372c0134", "comment": "Malware payload (Formbook)", "value": "ed60519531d2235bcd341745676ff5f89f21262c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121961, "uuid": "229b6313-2a29-4322-b061-895b6b592047", "comment": "Malware payload (Formbook)", "value": "d8e06d6411dea685bafaf882633e3c88e6476825d3b607e63428cf0af6ffc8813af2da750c3c36b20b9d8fb33348d818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121961, "uuid": "6a1c1bcb-8f8d-4c4b-b4fc-ebc099a4314b", "value": "T161049E32D601C031F2B251B5B6BD1B7B883D4E357255A4EAA3F216E06EE49A5F03931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121961, "uuid": "861395d5-c34e-4adf-8320-a9c5e151ace9", "value": "3072:WgSsHkVi7vvnal3DmHnCo36AT0OJ6Tcq90rfmNpl0AstFssaCOjVa:BmiaJD8D6AT0OXqYQ0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121961, "uuid": "af76d4c3-8739-4996-a608-d9115572c7ee", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121961, "uuid": "036768fa-8875-4c25-aa76-dfdcc2cecb69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121961, "uuid": "a334b423-adda-42c7-aee3-bae60a0bc9bb", "value": "b028c1cd096c92b3a035f54901315e2958ac5f8459aaf6f5fdad94bfcb201d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebc1999-c3f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707118871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118871, "uuid": "afdea4b5-4888-4310-8fd6-642f4356e121", "comment": "Malware payload", "value": "90eb39a2fff53076cd7130fd565ee04e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118871, "uuid": "83e9a24e-4126-413d-88a3-fe929b2142c4", "comment": "Malware payload", "value": "b145b9cab9fb9c0ca08f24f05b20647286290e4f91c66487f625a1fa6274db19", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118871, "uuid": "e96c4f1d-4044-4604-b4b7-3e3ba0f73c1e", "comment": "Malware payload", "value": "4f14d247493a7808738554386aaf48a8a90b3382", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118871, "uuid": "c5166223-5269-4587-8ba4-16d8e16531aa", "comment": "Malware payload", "value": "9c4d306a0a483dbfae758268612a2757cbb68fb6a016b37eacea62d4273c60beb8d12ab054d96b45631ca074af716ab2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118871, "uuid": "ff8f2831-9605-4781-9ba6-5d8f4b67f958", "value": "T1A9344D44178A78F5C11291FAB9934863B5795806B9834FC8B80CF129BF7B7ED2C4F2A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118871, "uuid": "8d7ebd21-f332-46c8-a33e-b44b7e659de1", "value": "3072:BQYm7K8Qf3e28Tlcz99cAtfIp7INgYk5loganae9ZvQVQWHkhGUR9Mov7ZRLWjbp:BX199cigpKgBogaaovHWkD6q4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707118871, "uuid": "136c35bc-5fe8-4ee0-aafe-bd043669d96b", "value": 252909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707118871, "uuid": "97a5b945-1ca4-40a5-ac45-1161fe2858a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118871, "uuid": "6d1363e1-c4ac-4570-822a-5df4271d5a4d", "value": "script156.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211cdb3a-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121962, "uuid": "174aa003-09c0-4443-9214-e73d88df3979", "comment": "Malware payload", "value": "d134e3dff0722fb0e08299b34cd2df04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121962, "uuid": "215b09fa-8abd-4e35-9120-af5a805aea65", "comment": "Malware payload", "value": "b1944e7290c27e4af066876d5282bb0fc7177766fc15b08511652cd79aafe0d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121962, "uuid": "b846d238-5b91-4843-b8b5-a5ff59416728", "comment": "Malware payload", "value": "f352528ee19c9c6d1eb0fc6c51923b4417204397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121962, "uuid": "b415049a-bf01-4c83-a435-fddbd60f0f00", "comment": "Malware payload", "value": "7359044560df1dff890268f88cbf44cf09efedf01236c7c720b2b9c32e6030a8dbc2473909584a0c36b0b0138ce12fed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121962, "uuid": "7b9a66cc-8673-4836-b63f-57d07506d4cb", "value": "T193345CA1F798C823E3C04FF0D164E37E8AB7A9645D22851356EB6D8FB768761782C311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121962, "uuid": "2531f6a9-31ee-4db2-bb85-aec6b7ae50df", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121962, "uuid": "8596e215-9eb4-4d67-b03f-b50ce96644a1", "value": "3072:vbG7N2kD4UpouGQbgSSu097BG0D6eMk1PowSR9issv/ZISbaQCFkcb:vbE8UHgp97BnXMk1P//KGalFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121962, "uuid": "9803308f-548f-4a08-b42d-78addba5e574", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121962, "uuid": "07fa2228-702d-4bbd-8539-f98b439ad686", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121962, "uuid": "3fc6af4b-0f3e-43ad-8cd6-c74a88d51eee", "value": "b1944e7290c27e4af066876d5282bb0fc7177766fc15b08511652cd79aafe0d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebedce3a-c3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707107699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107699, "uuid": "77782aaf-4369-413b-be0e-768e2657274b", "comment": "Malware payload (Mirai)", "value": "4046e170d144e4855f4787d04420872a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107699, "uuid": "b3b4b08c-3140-45f7-87ff-eab5f2dfda8c", "comment": "Malware payload (Mirai)", "value": "b3a839720bc7a224a9dc670a1f12fbd20f3fcee3b831bba3ef5411b5a918b92c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107699, "uuid": "af314e6a-604b-4504-b806-b710935fdd64", "comment": "Malware payload (Mirai)", "value": "d2ba006890240dcc3e7cf93da8d4ca8744f543bb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107699, "uuid": "23a22880-fcfc-4896-b1d8-6a12073df692", "comment": "Malware payload (Mirai)", "value": "db5a13537c7edc750e2dce1fed048e1a520cc69f2d3804f7c26c8a3410bef36820d84f587ce93bf337ebebd149601ba4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107699, "uuid": "05872bff-1eac-4383-b0e9-6ada2b72d306", "value": "T169334BC8DB43E9F5EC5705752133F7338A33E53A0118DAC7C3A9A93AE852A01E65729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107699, "uuid": "8fa3f30d-81d0-4563-81fc-e578655cb769", "value": "1536:lawNegrEJ/0qJCtrVV2cW8Aip3+lcN1ZKsWJQnwSj:laIDrEJ/ByrVscnAip3oc3Zzg4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707107699, "uuid": "74aa8fcc-7e73-4dae-b50a-fbf8aef707ed", "value": 54348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707107699, "uuid": "569fdb0f-1ea1-46c0-931d-4501bee94628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107699, "uuid": "47585485-ef98-4273-b8a8-6eeabdaae70e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f00d76-c412-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707129320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129320, "uuid": "32e13ea1-4439-4f08-9b19-61c593b93f96", "comment": "Malware payload (AgentTesla)", "value": "0f33571d24352363aafee9b8ed424edf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129320, "uuid": "4e61e894-7094-469e-93a5-a4aaff972e46", "comment": "Malware payload (AgentTesla)", "value": "b3a84f2072487ae5125f9acd46f0ae0342dfda49344d103615411520eec25bdb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129320, "uuid": "fc311417-0055-4f4b-8aae-b03518a0e497", "comment": "Malware payload (AgentTesla)", "value": "db24280041e1ae18d42d95c83cad50571b2cde66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707129320, "uuid": "b2749677-f4d6-4b5e-971c-02c27645e928", "comment": "Malware payload (AgentTesla)", "value": "b08d027ee082970405c034b3112d815138f807920dcfcafdf5b319c168101d56b205c8bc21732877abeaa8899f53785d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129320, "uuid": "e8d72b75-2cd0-44e1-bd10-d9cd6c0656cb", "value": "T1AD55AE037380C075FFAA91B3AB16E24057BD6C698127951F23D83ABA6DF05B1163E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129320, "uuid": "1281207a-00da-4ec6-acb7-956329288c65", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129320, "uuid": "2a1afcab-47f0-4938-ab3f-8e11f57285b9", "value": "24576:tAHnh+eWsN3skA4RV1Hom2KXMmHaiLwhO/9YmaDn6rr/qKoSbVyc1VNfe4DG9c5:Mh+ZkldoPK8YaiLRYmaDnoqKoSbVyc1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707129320, "uuid": "0e050afb-daa5-4539-8d0f-fa853300aa9a", "value": 1281536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707129320, "uuid": "05907013-9363-49ef-b4ca-50fc939d3ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707129320, "uuid": "0e3d1a92-e09d-4207-88ce-bbed0f108892", "value": "SP_4666803673_190377373883737_____.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95976e19-c425-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707137619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137619, "uuid": "822f9200-ceab-44bd-87c4-102f8789ed6c", "comment": "Malware payload (Formbook)", "value": "216f0ef5802f8e1f9bb30aec78297959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137619, "uuid": "1707aef6-87f4-4c42-9160-5467945816ca", "comment": "Malware payload (Formbook)", "value": "b3b85eb79173e3d957bc2dfbe15e245b751695b05261ef661528d3f90b16dc23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137619, "uuid": "4513999e-a2a8-446d-87de-9ca9e8cd2e85", "comment": "Malware payload (Formbook)", "value": "ce14b081f3b4e6025741816110f4114edba57f2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137619, "uuid": "268a1db7-0a0c-48f8-82e4-79cffb4e793d", "comment": "Malware payload (Formbook)", "value": "543a54cb5d754ad04819dd635fe5da5d9db2bdce5e0b60dc342225773ef455cc6e41e463e8febe0d0b0f9432926a9e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137619, "uuid": "489450c8-f081-4496-bbf1-1ca548db2985", "value": "T114F4124663E80BB8C5BD07F6646251814BF62C7F9670F94E4ECEB0E709727528290B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137619, "uuid": "40a83a00-5e0e-43b6-9470-2e5cdb1f986f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137619, "uuid": "8b9955e6-62e1-4678-8ef7-b5078652a97e", "value": "12288:iWhGDXL8nHltOtfL7WXxxRJkmf/hxmxq1yz10QbqN5kQ4rXFF/id53rD22:VhGLYnHl2T7kxxPRvmxq16WQ4uBArD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707137619, "uuid": "4c44c165-200b-4fd1-9531-7eb2cfc6c17d", "value": 748032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707137619, "uuid": "b6cb8c29-c2fe-48b6-be49-284658ece1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137619, "uuid": "362116e2-92f4-4c8a-b965-403149df15aa", "value": "rPOIUYTRR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8814846-c3bf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707093869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707093869, "uuid": "e98e8a5d-c04a-4405-9f0f-8fbf8eb03108", "comment": "Malware payload (Amadey)", "value": "92fbdfccf6a63acef2743631d16652a7", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707093869, "uuid": "7ca5c629-f9ac-4ed4-aa32-bb8616ed7003", "comment": "Malware payload (Amadey)", "value": "b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707093869, "uuid": "9994ad6a-b3a3-4b4b-b965-105560953bd2", "comment": "Malware payload (Amadey)", "value": "971968b1378dd89d59d7f84bf92f16fc68664506", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707093869, "uuid": "ef1dbff5-3acc-4036-b6df-8f6c80023f00", "comment": "Malware payload (Amadey)", "value": "ff6be91b032ac2c6e71c1dcde1b0a269f0995e2207809b1929b240b4f73eb2e266e538e44fdb916ee9a22fa227281273", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707093869, "uuid": "cb6032de-a0ec-4c5d-aa81-937964d201f9", "value": "T153557C0FA26541BCD4BBA1789A135947F775700603709AEB07E446AA3F53BF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707093869, "uuid": "288476f5-347b-41c6-b8e0-f2ffa99a2462", "value": "3eb70f83441fc8632e81bd6eb89f424d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707093869, "uuid": "e2754708-8bda-42c2-a132-56bb59adde0b", "value": "24576:ZvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgg/l+yC7:ZsMPSYcS5wPi095PbgWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707093869, "uuid": "940caf88-36ec-49c3-8f8a-c6fd2d8eab3b", "value": 1285632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707093869, "uuid": "a628a744-bf5e-4848-889b-397d2885c442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707093869, "uuid": "d818bbb1-5e6d-4afc-a9e8-180862eccf52", "value": "92fbdfccf6a63acef2743631d16652a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94134c27-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144059, "uuid": "4e80e6fc-af0a-4530-9465-96a43f5635c1", "comment": "Malware payload (AgentTesla)", "value": "704b2efff443bbd4f3e30476e5c35f0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144059, "uuid": "047cb214-73c2-4961-99d1-9ac3e961bcda", "comment": "Malware payload (AgentTesla)", "value": "b59cd2a03e661ac8e4259af1283e8f48cc92e534d9453547589eec900e9df416", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144059, "uuid": "454874a5-1a5a-4021-bf55-64408a5f649f", "comment": "Malware payload (AgentTesla)", "value": "063d17d634106964e274d94e3f47a6cdb496b7d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144059, "uuid": "d5e207cf-bce6-49f2-8d2a-cdab08d2141a", "comment": "Malware payload (AgentTesla)", "value": "8cfe111082a96ce945bf5654f219cb15b3515df66f700061bb8c0eafd29fd92684ae7a1fe53bdf7db4c1c965ffd5db2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144059, "uuid": "67780b32-3e04-4ada-a917-9c577e2804ae", "value": "T141D26C2573E80722E9FF0B34AEB360211B70B2675A52C95E2DD6988B4C73BD05B11B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144059, "uuid": "a04336b9-7d44-4ecc-8c51-fcf90fce6147", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144059, "uuid": "03eaf053-2183-4252-bb4b-0dc2b8b95777", "value": "768:bh/BwqsU3/X79Ph0l+dpfhnIspgmRXOJjxEFiR:V/Th0l+dpfNpZXAjxei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144059, "uuid": "c55f8f8b-9634-4f5f-acd8-09cbba5f35ef", "value": 30056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144059, "uuid": "80c4db46-0d1c-4a5a-b803-cbfcb42cffe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144059, "uuid": "9c1d196d-4201-4cfe-93b8-fd9f5712d34c", "value": "fenn\u00e1ll\u00f3 egyenleg Bank of Greece.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3974679b-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1707122003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122003, "uuid": "5402a424-bcac-4aea-a98e-02baa0c33cc6", "comment": "Malware payload (RedLineStealer)", "value": "baba7274faa22d44d8cd842610e984b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122003, "uuid": "f8dc0765-c576-4cd9-84d8-c7378e93f1c4", "comment": "Malware payload (RedLineStealer)", "value": "b7664fb08da2efb39adc099cb3afe9c0a3a8259ab36988faaff6eba517a40c10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122003, "uuid": "c7c7babd-386d-4940-80b8-f33b0d123fb7", "comment": "Malware payload (RedLineStealer)", "value": "c51a590ac454f4764f0dce1cb545a02089f5e2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122003, "uuid": "ec2f235d-6ec5-43e8-9ba9-a91fa8ff038e", "comment": "Malware payload (RedLineStealer)", "value": "dc5841da98299794c39e4de857e158eae8efd9f301066c4d58017c1f5af052ad7128bdad6a4f20fde9316064edf9a275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122003, "uuid": "50bae144-78a5-4d23-8cb6-6c0bdb7ca6bd", "value": "T15445AE0263BAC02EFFA691739B59B201567D7D3501278C5FE2A83D796970173E22DB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122003, "uuid": "17a1e74e-1945-4a2f-9f87-166705c26cb4", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122003, "uuid": "33055910-db9e-4471-9762-78c911633ba6", "value": "24576:uAHnh+eWsN3skA4RV1Hom2KXMmHaVWJ6Zkf9JucPPG5:Zh+ZkldoPK8Yak6Z8P0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122003, "uuid": "21bf6c74-3277-42e3-90cb-ecb4a67dec74", "value": 1240576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122003, "uuid": "e6198cc2-466a-43b3-806d-8dd22ad74ae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122003, "uuid": "eb9d1a00-f58a-4897-9041-be5c5b37e3f4", "value": "rrrk890ooecd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eec9989-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707143997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143997, "uuid": "cf9a9388-4818-4828-acf1-08fb77571d5b", "comment": "Malware payload (AgentTesla)", "value": "fc690b8be111f1118144d3a1a6be5a70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143997, "uuid": "3fcb3de0-a8a8-40df-895e-8594d407bedf", "comment": "Malware payload (AgentTesla)", "value": "b84d15edf58bb03dd0755dd0c940f745e14054f9f19773b9cdcdfe70670f27c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143997, "uuid": "20d2f154-8f66-42bd-bd7c-923145052fe3", "comment": "Malware payload (AgentTesla)", "value": "132f6dfc4241aa6eee724d449835cbd1913c832c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143997, "uuid": "172c6e7f-be19-45a0-9b28-e7ad28d3a029", "comment": "Malware payload (AgentTesla)", "value": "afe4b098ec6d016cd2e281117fadb82f704b113779596ebd0b23d59757114409cf742de276affb0dc9dd2248c365e208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143997, "uuid": "3dc31f10-0ed4-43ca-aa6f-3530d645322e", "value": "T17625E081E2DCC696E4A3AF7284B79D3295B372BC94B4441E295DB6323BE3353006EF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143997, "uuid": "29f62173-2f4a-405d-b4ff-6f1d19f40cd1", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143997, "uuid": "84bb4f0c-3f8a-4015-a0e6-f32ca3dd0c37", "value": "24576:F+avBXTCXzGR0PioSAaow05tJ4B/F3YdgDmIcP:QavBXTmtSLowga19YdkcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143997, "uuid": "a9174153-a4e4-42a8-a6cb-b698ae30454a", "value": 992608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143997, "uuid": "f42bdac4-56f1-4739-abc0-c57835f913bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143997, "uuid": "8ecc3c19-529a-4564-8240-9dce4a26f879", "value": "P00000271_1705329916.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ee181c-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1707141719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141719, "uuid": "e2cca235-0177-4b2f-bbe6-1ddc54cbfcdf", "comment": "Malware payload (DBatLoader)", "value": "d6763c4a0dbfc4fc455b3cd8c11e1c2a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141719, "uuid": "7356b01f-7387-47cb-b34c-ab3e0042c9f9", "comment": "Malware payload (DBatLoader)", "value": "b8e26b101d3957c980bea380c0f3d05d7d2a8e511b3df667deee502621ede392", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141719, "uuid": "f809510c-b150-4b38-8b82-c16cb6f02a67", "comment": "Malware payload (DBatLoader)", "value": "5ac25787bcb9756244435aaf1b9310007dabd674", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141719, "uuid": "2eaa9ffb-e07a-4b89-a0c2-fb66e36c44f1", "comment": "Malware payload (DBatLoader)", "value": "bf72943d4e926eb250db2042a3e7fe5e068956259fd8b869cb0d19e684abd41308a41b26e7a5b7755f780a135cb6fcc7", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141719, "uuid": "4578d74a-1a2f-4119-820d-1bd30d559e3b", "value": "T10855332F35BA66BA30D5E8CAF7D5DDF342179D005E6D648240DB312A0EAFB2D0A4D46C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141719, "uuid": "1c937f15-6b34-4351-9d83-c25886efd8ea", "value": "24576:xzoKl//e2ZeP0Sl7cG60QkoW4VC1DVvVioBmPMLUFUeSwf3chzZ/LQ+xXO:xzJRvOll4G60QhdEpDLAUeZ3cLvxe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141719, "uuid": "8523faf6-23da-42df-ba5a-8b4700e2c655", "value": 1350542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141719, "uuid": "07b3717a-acb1-4cab-95c5-ca014e1d7103", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141719, "uuid": "f5ce7fdb-e504-4cd5-be71-328428254da9", "value": "nPO9003293.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e2b91d-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121963, "uuid": "09f84ba3-7b86-4bfe-83b0-a9dcc7219d82", "comment": "Malware payload (Formbook)", "value": "f79db3deef88787bace9b7ed2198e94e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121963, "uuid": "f68a3e67-dea2-4d19-a1f2-73d90c0c1900", "comment": "Malware payload (Formbook)", "value": "b9192e15194b4f05411e8b9d394796700001d6df597be17dc9cfdff6f3911001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121963, "uuid": "70e42a09-3496-4491-a500-ab7434c03e1d", "comment": "Malware payload (Formbook)", "value": "2f99fc2ca3d33c04bac72292a624de221b217394", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121963, "uuid": "808e7be7-85e4-41c9-88f5-79a18dab597a", "comment": "Malware payload (Formbook)", "value": "19b41a8089a0b7f65c74f64cc7c226b40f82a45bafabb50e064ee96f8b92a7e396908bb8e98a43816987085001c64ece", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121963, "uuid": "7343c666-ffaf-41ec-9686-3b644d6530f8", "value": "T16A44227D529AD213D58F02BF6D6BBBE21868171E9A4103F874980C567AF4CC4263B3CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121963, "uuid": "07fc37cf-f897-4fd7-aff0-00488b2642dd", "value": "6144:nVI0YJKcnoAtxMIE8KqU5wa2W//McBXo7nnOTzSTzyHegTi:nKnJiAtKYha5/dBXo7OT2Tzy+8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121963, "uuid": "1b1eefc7-0ff6-4dbe-bb19-5f4ecc1a1bad", "value": 253440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121963, "uuid": "fc96062e-860a-4867-b5d3-b8f02f13c8b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121963, "uuid": "7fc1f9ab-e2f0-40c3-8845-9886a1c9ea68", "value": "b9192e15194b4f05411e8b9d394796700001d6df597be17dc9cfdff6f3911001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4324b302-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094531, "uuid": "2075ba85-b117-4818-9539-5cebc1a3d80f", "comment": "Malware payload (Mirai)", "value": "2d2e5dfbc99e679cf4c5fa92d07b8421", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094531, "uuid": "039af660-5642-44ca-8401-0d02b1b77c38", "comment": "Malware payload (Mirai)", "value": "b98df344d504b8a6e6985b13a21cc782dd2d273d26166e95e8069a83535d6b32", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094531, "uuid": "973406c6-39d7-44a6-8686-f1bdc4a9cc04", "comment": "Malware payload (Mirai)", "value": "5fb4408fdbc9dfc054967d22194dec71e09f7641", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094531, "uuid": "fb7e73a3-de69-4f30-8f6a-a57c88409365", "comment": "Malware payload (Mirai)", "value": "0c2e00aa69a9a93cb8eaf2602a7caaed6f0b3b670f75f66d97d097be36f4adbcfad554781aaa5793b431986b97b3ca67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094531, "uuid": "31991aaf-fbbe-405d-9231-0791c7a155a9", "value": "T1A183A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094531, "uuid": "461afdcb-dda6-4e0a-a58f-7c8c1f20b5a7", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTx7ZDYovZ73x/nL8y8Q6:Rakdn2Eo3ePu5GTxRYo99Be037W7/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094531, "uuid": "5b9c1f00-f163-4ab0-a414-6c8ff24f04c6", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094531, "uuid": "8637b63e-4263-492b-b209-a8290655b2e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094531, "uuid": "d095263d-d963-4409-8bd3-a6e00af68274", "value": "mips-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e884a273-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707120579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120579, "uuid": "0dc29230-2a0e-4373-a418-6a33e9ae8eaa", "comment": "Malware payload (AgentTesla)", "value": "2ef262f343013f90bfce6e496fbed464", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120579, "uuid": "c2bc0434-9762-46fc-b57e-f2ab12f67911", "comment": "Malware payload (AgentTesla)", "value": "b9bc950dd17132bc222e6950ff83f6aa46c21525bdc820cb32e9c3fd53279e51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120579, "uuid": "36b01b21-76c8-437a-93c3-01f53809f0a5", "comment": "Malware payload (AgentTesla)", "value": "fd26d0dac6ace485fe62aa8e926c304b2a556cc6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120579, "uuid": "85cd86be-7d75-49a4-a8e1-20a454f6d5ca", "comment": "Malware payload (AgentTesla)", "value": "8f159e0b322a155ff893f539ad534bcfefa5904573f47db5ab9cf69ec052af984b5b0e78d387bf68d56bf7957c4b58fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120579, "uuid": "ff3909d9-4ff5-4224-919b-5d5c2fe9091e", "value": "T181E3D02DD34B01698F624337AB1B1E5142BDBA7EF38552B1306C537933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120579, "uuid": "c9009844-f497-4abf-b6d2-d644b6ef465a", "value": "1536:9wAlRkwAlRkwAlRrBrIweo88Qs52I0LL3t:9wAlawAlawAlh2weo889ElH3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120579, "uuid": "6fd523ef-c2b2-44ee-a916-21799fe20099", "value": 143035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120579, "uuid": "55e49404-5fba-4c08-bc63-88a3270767ac", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120579, "uuid": "ed5068f9-619c-4572-8d90-52e56397fb61", "value": "MT10320243101.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d29aa61-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707141793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141793, "uuid": "e29c6d67-3ae4-4046-baa5-b0b58037aadd", "comment": "Malware payload (RiseProStealer)", "value": "c2d27b50c257132e7f1d4364b36dd9a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141793, "uuid": "219a353d-e982-4498-b2e6-8550ebea9dc0", "comment": "Malware payload (RiseProStealer)", "value": "b9be49af1d0ea6dfca487ab6a6d12de548cfb4ced632351650f1db276cbd9bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141793, "uuid": "13e0f79e-3476-4837-bd1d-04d23e74c9bc", "comment": "Malware payload (RiseProStealer)", "value": "b08a284eb07dcace4b577564f9b4caff3150746e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141793, "uuid": "0a57e385-6502-45b3-a00d-82abe6b5812c", "comment": "Malware payload (RiseProStealer)", "value": "38028897994018ebba5dc5866386b98464942860f3e207e3b4f59d04c8c2462871ba996993b628af4829b9ccd6bbbe4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141793, "uuid": "e989b7ec-eace-45e2-a995-c3ec29fb3109", "value": "T1B94533FD9177852AE15317B52C9746C426A7BD9706002698068FF38A3F3C1FE6703E8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141793, "uuid": "5fba8cf8-1b11-4c56-ab7f-5086063e0bf2", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141793, "uuid": "31d6e3bb-b6fb-4fa2-b898-1495f91b7df9", "value": "24576:TW6AMrKFVai+lCD7+StHxNDoTd4wQnyEvOH/zTIymxOuC:ZAuKFVSwHxNDZlwfz5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141793, "uuid": "b2564343-db87-4f82-ab4e-4061239bafee", "value": 1207296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141793, "uuid": "0833403e-9784-4548-8c54-4e2d5884979c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141793, "uuid": "6a48b88e-03ce-4836-99eb-15fb3a0a9a21", "value": "b9be49af1d0ea6dfca487ab6a6d12de548cfb4ced632351650f1db276cbd9bb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f99b0a0-c415-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707130549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130549, "uuid": "fcef07e4-133f-478a-b1f8-88ce4727cefd", "comment": "Malware payload (Stealc)", "value": "34bbd7fcf1c43fb2d7b0ddf75633a16e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130549, "uuid": "6bb8ed56-fb1b-4fc9-bd03-cf782f29fde8", "comment": "Malware payload (Stealc)", "value": "ba01502b5a5c02dbdddf6a85c50670204b9e47e693cbf37fe58f55b9bbf1f2d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130549, "uuid": "c65de5e8-4d10-4044-9968-d0b0ae2103ea", "comment": "Malware payload (Stealc)", "value": "97a8bd8f9c0f04058a8420e1ac9a0a97a6e498d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130549, "uuid": "b8f732f4-17ed-4e53-9fb0-2388ebd30b20", "comment": "Malware payload (Stealc)", "value": "3b1bd115433816ef9b7589d6ecadcb5bc63ed6d5cd3b0a056cb2070bebe030677479bad2f92fce6e2cb1f573a4689672", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130549, "uuid": "e4db7c61-8005-4045-bcac-ac57b084df94", "value": "T139645C8396A1BD50ED154E739E1EC6E8BA2EF560DE49777A2228EE1F04B01F1D173321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130549, "uuid": "74f02e13-daa8-4fb9-86d4-e3cd673c8d6e", "value": "b040380142286d9ecc549c036ca7b815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130549, "uuid": "f07d0939-e345-4077-a25d-2f28f125b154", "value": "6144:vwQPLaid9uw281fmYV1KChRHN9kSIK6LtRYkM+:vbPWid9a8FTdnNIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707130549, "uuid": "9c98accf-260e-4a66-92f2-391af33fe546", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707130549, "uuid": "270d34e7-7c26-43e1-afc2-3b409b6e7812", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130549, "uuid": "65e47379-ced6-4399-b7df-6b750ea45284", "value": "34bbd7fcf1c43fb2d7b0ddf75633a16e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7d7c0f-c3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707107705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107705, "uuid": "2c35e1b4-c4e3-429d-b741-7d136fa32f5e", "comment": "Malware payload (Mirai)", "value": "0a8b08281bdeb764bbd2fb47a418f364", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107705, "uuid": "fb89584d-1915-4a8d-82af-eb7776bc846e", "comment": "Malware payload (Mirai)", "value": "ba2a72847da68aa0800bf528c1350197832a8ecab767414383ce8e9663b8859f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107705, "uuid": "9edaeff2-7016-4dcd-9d05-d4c5b4895f05", "comment": "Malware payload (Mirai)", "value": "38f486bd6626c4cf118a42f7e4e928434b6abd57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107705, "uuid": "f9d31b55-d1d2-49b6-bc7f-571b020f6e17", "comment": "Malware payload (Mirai)", "value": "feed47faf7afc8f87ac95dfdccfbb5067c6c8b7315d681c0bda6651ec7acac594307f4affa075536623c750ce46e76e7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107705, "uuid": "5059b2ee-ce88-4575-b9cf-cd3f5d2adb91", "value": "T125E32B46EB418B13C4D61775BAAF42453323AB64D3DB73069924BFB43F8679E0E23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107705, "uuid": "f811682b-4c12-46e9-b05b-eb42d15ae47a", "value": "3072:Y7/vdPSwYjCNMQ4e2laB7OtCxQuSi+qCvm9peJSYawM/9L3k:c/vdPHopQpmaB7OtCxQ9iugpeJS6M/9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707107705, "uuid": "e88d7f9a-54c6-443e-8656-7642f58bdc8f", "value": 143829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707107705, "uuid": "f340e60f-45a7-405b-ad9e-a2239dc0646c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107705, "uuid": "14c4073c-dcdb-4625-85bb-d1da5476e65a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9116f6-c438-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707145713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145713, "uuid": "197f3600-d026-41de-9479-b72739e0841a", "comment": "Malware payload", "value": "a4f8a32f1927d1bf93fbc814883063a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145713, "uuid": "a5954472-f927-42c9-837e-eb0926da1fb0", "comment": "Malware payload", "value": "baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145713, "uuid": "39923f47-07f7-4672-9ac6-477d214f6510", "comment": "Malware payload", "value": "041cce3c1e69f77923154b9f9be9c09a38ae2515", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707145713, "uuid": "6002603c-9fb3-49e8-ba14-53dd2d4a1e3e", "comment": "Malware payload", "value": "a9e5cf8cf79612a7c4fc60a01a9147946c77dc6d7f70b48ccba1a5327c076d80e8b9fd2999c28478c1b11071e8b08dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145713, "uuid": "df157a06-6039-4a93-9650-92d34bbefd2f", "value": "T18D6523207FC0D9B1C06244390E95AB796A39FC2017361AC76768BF1D8D355D1BA3EBA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145713, "uuid": "59a6b69e-ae8f-4b28-9fbf-3aac5a207d40", "value": "319b1edcc4538be377f43066c635ffef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145713, "uuid": "4cff8b26-0fd5-45d2-a444-4cfa456203a5", "value": "24576:qxLsMs8WdUS8vyooy7U2H55KnzRfnVQF8IqKLu/9ASfb3vXCFK9pYEm1Ap3U:usldsvyoXfHPKl/9Ij+9bqFK9pDm16E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707145713, "uuid": "db6812d5-bfa8-4133-937b-7a5b11ed9c22", "value": 1429679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707145713, "uuid": "9dd9bdf3-5d88-4c2c-b6a7-67908e32ebaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707145713, "uuid": "393811ef-8938-4a09-be3b-b5229b708ba2", "value": "baa13ad4c9d7ba4f03915385de91c623e63c677a363a1dd2acb2d6f119b8adc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1974aea3-c441-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707149437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149437, "uuid": "f0019125-17ca-4914-9923-4953fa596e0b", "comment": "Malware payload (AgentTesla)", "value": "78b8995359753c6b087def8d0b53a3cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149437, "uuid": "e37a1ac3-2980-4e24-b1ff-dff8f2185364", "comment": "Malware payload (AgentTesla)", "value": "bb9ea892f7ed60ef20e2031adcca665f8916a05f5c40e9bc4427b3e8b1f5a998", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149437, "uuid": "a6151479-8b15-4d59-bce4-3e0bde29bb90", "comment": "Malware payload (AgentTesla)", "value": "86b27730da631266d9b6b942eca25c873b3c330a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149437, "uuid": "ccb36476-3f1a-4454-91fb-1002e3776d04", "comment": "Malware payload (AgentTesla)", "value": "d6b4938981029d78aade5ed892f0e0dd97e167a7a0e0d47450d5eb6f29e22336bf75998035a9725d267e1c98cef95204", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149437, "uuid": "35166135-9e24-4d86-a405-3f3b0059fe42", "value": "T102B25B1573DC4737D8BF437568B321052B74B51BAA03CE1EAECA544B4877BD44612BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149437, "uuid": "fcb92887-c6f6-4293-9a17-a71cbf3cfc63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149437, "uuid": "cdd7ae71-42c7-4c79-b0d3-4fc14a39e0a7", "value": "384:wuTinaDWVeCqKUR/17Iv+xM8GUG5W1yn/tPsHQ/NSsUpxtWPVWZOVUMD:N6aDWECqKUR/17tMrUGY4UhC2O/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707149437, "uuid": "e60e1687-6cf9-4037-9e46-fb6b42faf1d5", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707149437, "uuid": "2fbd545e-1dbf-433a-af61-31be3916ba36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149437, "uuid": "b5ea1d1c-a585-4852-840b-b08075e07ebd", "value": "SecuriteInfo.com.Trojan.PackedNET.2665.21550.24654", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdb2dc3-c41e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707134518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134518, "uuid": "96d027ef-412e-4a64-851c-35b474382fc3", "comment": "Malware payload (Formbook)", "value": "636e5f8bfea3e27620c34bfbb2f2e1dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134518, "uuid": "3b8352bf-f8dd-421f-a169-6af5a01993bb", "comment": "Malware payload (Formbook)", "value": "bbff392c9f1986f1f59131ce3c9513548a52018d0ee0366181d3d27f11924e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134518, "uuid": "61a36b79-8d3b-43a5-8c32-f87dd1659365", "comment": "Malware payload (Formbook)", "value": "4665e9ff9187303d965f5bd6ea5b5d42b64dfd41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134518, "uuid": "453f2f91-65a1-4c06-99ce-00b7d28c72d5", "comment": "Malware payload (Formbook)", "value": "b71f5674d50fc7b5a4ce1efe6d2bf806700da037273e956097838aeaec68bb4acc32446d0f31e7c9ffa41b3a139bde0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134518, "uuid": "50a5203d-3e1b-480c-99ce-d8ece3dc09e7", "value": "T11E55121723C92F50D87FBB7122B1A01507F5758FC726EA1F3DA502C4AD63B48A662B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134518, "uuid": "29ec867a-3ccd-4eef-9a6e-c668b7a4aca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134518, "uuid": "b1ac9f08-4baa-43d1-be37-f274d1d9e3cf", "value": "24576:EGzAeKt9pXTHoFezlcs+QxTWi3/IWi3/7NWi3/x3D3lrQTpy:EEAeKDtbCyHx53/k3/7T3/x3D3lrQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134518, "uuid": "cee5fab4-697c-446d-be3d-d9b70fdb6bbf", "value": 1299456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134518, "uuid": "eef05881-d77f-4ae9-8b71-8fffba35fea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134518, "uuid": "0c22b530-9025-45d7-9518-a314b67b2a2e", "value": "yeni sipari\u015f jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6e3b58-c3f9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1707118837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118837, "uuid": "19f9fc92-ab62-4f92-bf07-b94bad16b9a5", "comment": "Malware payload (Adware.Generic)", "value": "5e007ae18348b676fa8234bea66e3b6e", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118837, "uuid": "e2ba9ad1-a2c1-4edb-97ef-9e26fc2f6426", "comment": "Malware payload (Adware.Generic)", "value": "bd6af87005b17032147ea193161436ddbc5f596f82f75b9cb856adec6a9203cb", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118837, "uuid": "eeeffab8-a343-4b78-875c-d6ce41eada4a", "comment": "Malware payload (Adware.Generic)", "value": "5e3112ee4f6a691ebd18b66520a766f8b9020e87", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707118837, "uuid": "01533ddc-ca17-4377-a0f2-ac040554a4d2", "comment": "Malware payload (Adware.Generic)", "value": "a1a3254d6fa29442d147eacc4b5c6d3244601cda4f6a546dec5de6031f8a7e514f871026412415d335b5f4e196f006e9", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118837, "uuid": "fb383766-0bb9-4687-b78f-cda67d6d3560", "value": "T1BBF62337F128B82EC82506324572E22045BF6F29611A4C5EA7F43D0DFBBF1512EAEE55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118837, "uuid": "2226b32f-d07f-424f-9091-e251d9834cd8", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118837, "uuid": "6a4050cc-1620-45ea-b2e9-944acd9123a7", "value": "393216:4+P/dW7HyTkjpLl+1SVdqb/mJfHv3Wpx/VEf:B/Q7STKl+1Z/mJvqx+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707118837, "uuid": "2b015d76-29cf-4af1-be99-5a9fa0fca7a4", "value": 16378872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707118837, "uuid": "051cac8d-cead-4e48-9ffb-b3f31fd85791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707118837, "uuid": "ac65f1ff-7543-4bc5-ba01-da81a682cc07", "value": "SecuriteInfo.com.Program.Unwanted.5387.4640.28408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426f88ba-c44a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707153371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153371, "uuid": "d1dadef8-2ce5-4935-98a5-d0e5b1618c93", "comment": "Malware payload", "value": "d0df75433508fb6e1353724f02f3d2cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153371, "uuid": "5ffadc1d-acdf-4e6b-9814-c31472625ccb", "comment": "Malware payload", "value": "be1735fad8254f619d83a8e80803cfcb2b17f74161e831f5004829f0bc9db83c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153371, "uuid": "5d65f30b-b54f-43b7-8735-fe94c77467c6", "comment": "Malware payload", "value": "759d120a33c72571d6fe09995df55ebdeae9aeac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707153371, "uuid": "595c5aca-b24f-4835-a212-b34be3f33eae", "comment": "Malware payload", "value": "f305ad1aec7137f7abf6756e1a0087621c413e35642b4cddb40fd80c32e52e870b64c235964d557dcc726903e996fb17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153371, "uuid": "f3b1a303-f3a4-425f-955c-417e7922eb3d", "value": "T136A5D0797190C475F226AD36CC07A7F906BC3D22283574C56FF62B4A8EAD0B364396D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153371, "uuid": "467a6a59-37bd-475d-ad51-68808b4c4965", "value": "a3c863c31417e734b1deebf8dea8c3e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153371, "uuid": "fbbd12aa-670c-47ea-b6e8-c1b9523078aa", "value": "49152:W2iYgCFcn9rcFw/uRHtojhvQIBXMlxvY4:W/oFcBURHtojhvQIBXMlxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707153371, "uuid": "79f9be9e-3892-422e-9391-d3226e41a499", "value": 2120192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707153371, "uuid": "d6ae7eaf-52c4-4d20-9692-cde775068b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707153371, "uuid": "6091f153-c994-4c22-a4a2-dfd5188f491d", "value": "USPS_Receipt_Details_06_02__2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdb7750-c430-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707142515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142515, "uuid": "455a41ef-f6e2-461e-a2b0-5da6c29189ce", "comment": "Malware payload (Formbook)", "value": "1b4196e46a22f9eab189dd5e276f5387", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142515, "uuid": "1f07b1a0-7bd1-4b5d-a2ba-42018467e426", "comment": "Malware payload (Formbook)", "value": "be1cfa406d8ed5411a49fb64283c6a120e0c43a31df164acd8de332cdb89f411", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142515, "uuid": "b99d0558-9b3b-46a0-8c2c-aaa24ba6baef", "comment": "Malware payload (Formbook)", "value": "87764cdec781a49b57139a383f3da6c34b52b082", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142515, "uuid": "6efb20e5-dd05-4eed-aece-6c7c191aa445", "comment": "Malware payload (Formbook)", "value": "430901905009ff4c2a322289464b01e2bd2a77197fa56ebf2960210f35970308c25a84fa38ca7fce51df5a10700ee6c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142515, "uuid": "c0a18f62-92fb-4d4d-a75f-4803729831cb", "value": "T14AE4128163EC5B74D6B9C3FA6870108047BA765B7521FA2C1ECDF2C66B94F011AA0B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142515, "uuid": "97325745-1861-4aed-8c37-83588bb3eca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142515, "uuid": "8708ae1c-e14c-40fe-a8f2-b56a6070043a", "value": "12288:LaDXoxxI5lAuwGHQO1iMA8EUY2OXTj8euFLoo9IIQ2mHevuDd53rD22k:eDXox2AujQHUUvPuFL3MFeGvrD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142515, "uuid": "cf90868f-8370-4570-9e97-902ef7f3260b", "value": 711680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142515, "uuid": "aeb22688-faab-4db7-90d1-d17179625c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142515, "uuid": "cdc71b99-1da2-4cfc-a92c-14c3f9ab8665", "value": "rNeworder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15934261-c415-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707130533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130533, "uuid": "46df31eb-b289-4746-9e5f-2dfcc1b29d11", "comment": "Malware payload (Stealc)", "value": "7a1f698ba32a1c465ffee2e3b9991abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130533, "uuid": "8f9f73c3-079b-4f2d-a49d-918266fa2fcf", "comment": "Malware payload (Stealc)", "value": "bf2db683620d4237f32a39ea241af0e066aa591c157837585f506345f7c82738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130533, "uuid": "52a3868b-d923-4f70-9977-e74be4aca865", "comment": "Malware payload (Stealc)", "value": "77a1df827318c4f8f1fa969445b3431db86fa5c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130533, "uuid": "6d0af632-01e4-47d7-8883-57ae259c318f", "comment": "Malware payload (Stealc)", "value": "7648f773958fd53668a48c7003a8c381ae760e9166c855c6628d60278a0363fe844f921709eb6d69e13e9984186280b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130533, "uuid": "8001989c-693f-47ab-9bba-1e9095b7bd65", "value": "T155647E439AA1BC54E9164B738E1EC6E8BB2DF560FE1977762218AF1F84B0271D173321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130533, "uuid": "d4677633-f556-4655-9f27-090cf31b4c11", "value": "b040380142286d9ecc549c036ca7b815", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130533, "uuid": "17186629-7809-46ad-b6fe-d7911b4a7378", "value": "3072:fhcMQQfHLmBWOCwiHXBGxWR7zPuO5iYzVeV1LQ3xRTGX3oBa5dH0UtRYMupIM+:fgQfLKCwi36kzH3eV2fSlH0UtRYkM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707130533, "uuid": "a8d6f1f4-61c1-4286-a258-b4cd43ceb333", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707130533, "uuid": "c3d8d323-38ae-4d93-bd50-671de6fc51fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130533, "uuid": "ca2c1d29-c25d-499b-a7e4-8596bfe29ad1", "value": "7a1f698ba32a1c465ffee2e3b9991abe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260e41c6-c427-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1707138291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138291, "uuid": "495e2069-ad1c-43fb-a8f0-65dffbeaed49", "comment": "Malware payload (Socks5Systemz)", "value": "76f8845b41a8885dbfa3d4ebe8c48ce1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138291, "uuid": "1b0ba334-b50f-4f46-95de-851d9fca769f", "comment": "Malware payload (Socks5Systemz)", "value": "bfc38601957f32a38e17db02716d6691be4e438bbc8af562c81abe89b6b67e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138291, "uuid": "741b7ebc-dcd3-4edf-8d74-6c96634affeb", "comment": "Malware payload (Socks5Systemz)", "value": "d8070821f7200d89251950998df81aa42b309fe8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707138291, "uuid": "d957424d-9aac-4a26-807f-b2097e33690b", "comment": "Malware payload (Socks5Systemz)", "value": "23c2b96d2819780e5a20f4b500640a1eeb2f6962ab398ce6db84bfdcf352a63a3c4d49e1bf2eeca08ca71a58ae114c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138291, "uuid": "ebdea50d-0621-4f8a-b2d0-1af0bac7a794", "value": "T1436633A9B941C23AC6C386F73CA89C92C9CDFD7A0775B53AA2C9EF88749654374111C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138291, "uuid": "130f54a0-30db-4e9c-8953-2079beb41068", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138291, "uuid": "086e572e-b984-4498-8dfa-f3ef3cbe7812", "value": "98304:9ivq/Kamp+N3gVixUSW/3QldlMS4fAZCDXlveA1vv9oBDxdAsuw2ccqVncfu7r7p:kvmKaJ1XW/6MoZCDXl3ZuAsyc9VgK7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707138291, "uuid": "1b15741a-50a8-47bb-b9f9-ebbd91756d3e", "value": 6617884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707138291, "uuid": "9091b47a-1136-4d28-adce-b9cd8f47714f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707138291, "uuid": "5bf99402-d5fe-4343-8f8c-574d17d11ca8", "value": "bfc38601957f32a38e17db02716d6691be4e438bbc8af562c81abe89b6b67e49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b7790d-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707121965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121965, "uuid": "9c115607-0d2f-4065-8f11-25bac6bfe798", "comment": "Malware payload (RemcosRAT)", "value": "abbbf127c3e0b9c93125dae8688128eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121965, "uuid": "20e7c229-8b76-44a8-914d-531e44b39223", "comment": "Malware payload (RemcosRAT)", "value": "bffc98fd7510c8df041ea99b45637293f36e3e3122bbc39c3b043b85badd3faa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121965, "uuid": "711ceb4d-8c82-4152-a29d-06f83606f89a", "comment": "Malware payload (RemcosRAT)", "value": "15d50922cbfefa96f0576063ac7674c6a0094ae1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121965, "uuid": "26bbe355-9d37-45e2-b244-7ef1557175fb", "comment": "Malware payload (RemcosRAT)", "value": "c7aa12bd579aa94c9e58c0afa0be8cc8e8c3e71e1b8e3a8277f66f781a6ba086725a20ba9a55a349e7280ec01fd5f5e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121965, "uuid": "e9c11564-ac57-475c-b270-499a20a65637", "value": "T1B7659D03679D8076FF7A937B4A15A6C556F82C1801A7B01E13B83D7DE8784711E2FA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121965, "uuid": "494555d3-bb07-4561-a95a-f8dbbdd97bb3", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121965, "uuid": "7187b964-fde7-4604-b4b3-1dde669364e3", "value": "24576:nAHnh+eWsN3skA4RV1Hom2KXMmHaA35noqwLYZnvkvOHt6+8lgb5n8ydXn5:ah+ZkldoPK8Ya45noquY9vkvDNgdn8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121965, "uuid": "1ae95e75-4604-47e4-a89a-ac7860b588fb", "value": 1500160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121965, "uuid": "1afb94ad-7acc-4268-9b82-17931dfd543f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121965, "uuid": "601d01ad-3286-4168-b98f-a0235eb14f03", "value": "BANCA TRANSILVANIA SWIFT TRANSFER (008) CMSWT24019000690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f11d950-c42e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1707141313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141313, "uuid": "128ce646-de2a-42b4-a4f8-6fa80d9f6fc2", "comment": "Malware payload (zgRAT)", "value": "0bbb5d8950e6d3af916f204ea8f63dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141313, "uuid": "eff3f9f6-7ab9-4afc-be35-ecfc490bf87c", "comment": "Malware payload (zgRAT)", "value": "c0d7231617470901a6047d790b9935ae087658d6805544c9ee4ce3f09efb055d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141313, "uuid": "155b2786-038b-4084-9bc7-fd4b0839852b", "comment": "Malware payload (zgRAT)", "value": "30fb5e207e1e9a01c0acc6f4a4a828bbd3cef2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141313, "uuid": "186f0025-f6d1-4d52-9f69-65b2256b7be6", "comment": "Malware payload (zgRAT)", "value": "0f121b019313c1a95fe8ae41c86caca7ed16eaa2dc2e9da5e53e1e7870967fb1b3f3d99fad593bfd9c94bd0457971006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141313, "uuid": "71bf4b02-85ae-40b0-b123-bdb18da8f953", "value": "T1A3568E127B90CE92D63F1A3194A3511003F6ECDB2FA7F3832741A67D19273959D1E2AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141313, "uuid": "a8863d24-8c75-4407-8f1b-5041b05f850e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141313, "uuid": "b85e88d8-c764-422f-b28a-6dd1d3e5e127", "value": "98304:eMkulhD5woxAnrl8ApUn2qWfJ6E43pwyblno5:eXulhD5wznJ8A62qWx6h32ybm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141313, "uuid": "1240e67d-4a88-4665-b713-945beb5229f3", "value": 6189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141313, "uuid": "2c3f9a9e-7189-47ab-9b3b-e62520699cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141313, "uuid": "dacbc05e-021d-4285-b070-cf6f6d63dacf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bb6c51-c465-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707165265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165265, "uuid": "f92376ba-7b84-4569-bf68-ee991fd3d2b8", "comment": "Malware payload (AgentTesla)", "value": "7ef79190e9ca46cb290d6a32cdd6e83c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165265, "uuid": "b03e8291-dc1b-4170-a032-4adaf08ebaff", "comment": "Malware payload (AgentTesla)", "value": "c12a4ab95d9caaf2f1a68db084dbfd38ebd65391041925d0417b08e50489f353", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165265, "uuid": "20c9c4ba-a606-4127-b162-19b91cd8081e", "comment": "Malware payload (AgentTesla)", "value": "2980c19e41d9b21bdd43c01de23b7ad11a8a7488", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165265, "uuid": "441d671c-bb2f-4c90-9a39-c0a139c51435", "comment": "Malware payload (AgentTesla)", "value": "61eba5ca2c8b90170c755a1112e74c7f2410a94a24716a945f2e4ce2d28ab52ee9553e515a8ac03e22a86eaf8f247b75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165265, "uuid": "66fe5c33-516b-4857-913d-a75fb28b6369", "value": "T1A115AF21F5C5D075C5A323B19D7AF7665A3ABD360336C19F23C839351E722422A3AB27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165265, "uuid": "ea504ad6-01ee-424c-b3b2-6d76c5ee026d", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165265, "uuid": "e979c6fe-fdfc-4e4b-bb8d-e54abd1d148c", "value": "24576:pRmJkcoQricOIQxiZY1iaTOS2NMUhN0iTT:mJZoQrbTFZY1iaTOS2GUH0QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707165265, "uuid": "957e3715-d2da-446b-9e22-4b5359d6d76f", "value": 887197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707165265, "uuid": "ddd9486a-c7d7-469e-8b20-109037d12384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165265, "uuid": "5ce85580-35ab-4dd2-98d9-88039894332c", "value": "transferencias_santander_swift00893.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814ea981-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121694, "uuid": "786531cb-4489-4737-937a-e52246932540", "comment": "Malware payload (AgentTesla)", "value": "2c17a6ae0a63df0f1f34980529539691", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121694, "uuid": "335d3e11-d685-402d-a340-13ed2b0647e2", "comment": "Malware payload (AgentTesla)", "value": "c167619cf5cbed2e65814f911d281a62e89f6fbcf708cae8caba74ca573ea0cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121694, "uuid": "6c42d993-0107-4345-b2fa-824835131676", "comment": "Malware payload (AgentTesla)", "value": "ed5d627d90b49c0d5208236dc56780ef625b422e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121694, "uuid": "94a9ccb7-a9de-45e2-a1d6-c1223cd09d3f", "comment": "Malware payload (AgentTesla)", "value": "c4abf4c7c3d151e8cd8cc38e70429d5620b49b25cfc5f94be2e3aa29f612e142955fcb885d9ba259dcdc3d085bc91418", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121694, "uuid": "c1bf7623-37ad-4337-b861-cd43a8425d89", "value": "T12945AF1273D5D0A2FE5B8173DF6DF21025FD79A840B3812F12E81F39A6B12A1626D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121694, "uuid": "db34afc8-8b64-49ca-b41d-a593ccaf95fe", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121694, "uuid": "c3ea75dc-0f46-4ed9-bc06-eedfd0907ec8", "value": "24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaTe/5F2hom0X0Ge5:gh+ZkldoPK8YaTe/f2hoCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121694, "uuid": "1b6bd243-e6ff-4b34-a679-946a2dae7123", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121694, "uuid": "21347226-d5cd-48a0-a87b-fbd1bc0f689c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121694, "uuid": "4f9207d6-7076-421b-bc74-6f2940dd113e", "value": "Request For A Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4d0d5f-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121763, "uuid": "0204663f-50b2-45ad-bbf9-d9f7016c2bca", "comment": "Malware payload", "value": "f31288dded7802d55f35e4334ebe23b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121763, "uuid": "4095f8c0-f9fd-4e10-a219-10b314da90b6", "comment": "Malware payload", "value": "c2926051d15399319b8e2c206902ec7e83ca918fe8705be810f58eb0e84d9560", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121763, "uuid": "a242403f-41a4-45e5-bab4-d99232f1a767", "comment": "Malware payload", "value": "642c1ffdf0b323762272370ce8d4a99fb363c381", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121763, "uuid": "6fb41871-9f90-412b-8a67-9cdad59b92dd", "comment": "Malware payload", "value": "7e2f21c08e1b595ea5c9f9f74532c9a33bb4bfd1244f59c61fcfaa9c5b1c5021007dc6398e486abd92e9017db88df0d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121763, "uuid": "104be456-651b-42e3-b1ce-b5dac98f6e9f", "value": "T1C6454B26A302DB4BD23376B544A1F3364996F1906E37CB4FB81F3F6998813D44D26AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121763, "uuid": "6c942bfd-c399-457e-9aa1-d5227d11d14f", "value": "24576:BAgGXiqJcAlkN23v6rTG0b3v6rTG0CXiqJcklkNDg:Fp6vLofoJ699", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121763, "uuid": "583f415d-6f7c-4925-8e55-aeaf4b068bba", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121763, "uuid": "1d7b79a2-3412-412f-a282-6d4c08074cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121763, "uuid": "034fbd0f-c90c-4754-b267-df69307e78fd", "value": "SecuriteInfo.com.Win64.MalwareX-gen.6944.10188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f4f577-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111494, "uuid": "a44012be-1e93-4d46-9538-df8a1b20ab18", "comment": "Malware payload (Gafgyt)", "value": "48013786b3f8f9ee3cc94e4137a4fb91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111494, "uuid": "1e6ce7a2-64ad-4d79-b266-adcdf8b39b25", "comment": "Malware payload (Gafgyt)", "value": "c330bc3d9da76131ca968fd273e78afafa5d340f1903e744d25a572cdc1a31a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111494, "uuid": "341e5ec4-384b-4871-90c5-c6e5cc21467e", "comment": "Malware payload (Gafgyt)", "value": "09fab20c472fe95107cdad3446b9b82432488842", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111494, "uuid": "0d6d98f2-120e-4e1b-84e0-c400f559e1d1", "comment": "Malware payload (Gafgyt)", "value": "4ca826a422fb4a6103698e63567ee96b384f2608767a4d5fecdadeac0314ecb6aba9a02cdcc65e5a2eb9a2fd2078aee8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111494, "uuid": "e6eca7be-cb18-4406-835b-c218c2824f14", "value": "T1C7A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111494, "uuid": "5fe48c2f-593c-4a05-9cf4-0bfbf5659500", "value": "3072:wW8FUmgujld6Mkxm6AJ+4fmHmmFVcqq0GnDZT:wJFv4Lm6AJ+4fmHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111494, "uuid": "f7e48fdf-57e2-4818-a52d-e76451365068", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111494, "uuid": "599a15da-cb7e-487d-87d9-e57cb2718935", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111494, "uuid": "5482e103-9a68-47da-beac-98bc1d7eba05", "value": "48013786b3f8f9ee3cc94e4137a4fb91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb17665-c3e9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707111700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111700, "uuid": "0c80d22c-fb31-4cc9-9146-69672dfce8bc", "comment": "Malware payload (SnakeKeylogger)", "value": "a7afdc8105a71417d807b8aca17abe81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111700, "uuid": "87e02edf-cff4-44b3-9fe8-942bb3c2b9ad", "comment": "Malware payload (SnakeKeylogger)", "value": "c5dd4dced21baff9499dac6505a77527ac91dc0b0f187c20e9b960b46b3636b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111700, "uuid": "3f50a2bc-56fa-4770-978e-df4fa68b0917", "comment": "Malware payload (SnakeKeylogger)", "value": "5567eff768819446e0029180f0db34f854893ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111700, "uuid": "56d59bed-ecdc-44a8-89cc-00406c4b1b42", "comment": "Malware payload (SnakeKeylogger)", "value": "348119221a3e3fe3375a3ab271bd5bf4779523d514fb4e65772364528a422d3e4a6762953c45966e9c67445adfa9d466", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111700, "uuid": "ab5f1224-a788-4e74-bc52-02412549f582", "value": "T1D73512412198EB87C83817F1C421A8A923FA7D9AF571F29B6CC5BCE377B2B504624D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111700, "uuid": "6bb2990d-b7e4-42da-ba7a-5bfbf954496a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111700, "uuid": "330f278a-ce3b-4c14-b187-091b665341b5", "value": "24576:2pGIr9cx57i6qgyynUIuvKm62Lftb07b0SPJrvdshPof1oN:gGIrIi6qtyn56KmljTutiymN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111700, "uuid": "e12a7218-e9bd-45e2-a6af-f33d2cb632a3", "value": 1084416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111700, "uuid": "07fed3c9-3438-409f-b380-6cc4fb6f50b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111700, "uuid": "f7e3762a-f49e-4403-8d90-488fa87ef051", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f4614d-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1707144431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144431, "uuid": "b23b3b71-eca4-4ed1-b746-947ed2a56e09", "comment": "Malware payload (GCleaner)", "value": "9bf17de1beadccba10054bdc8cd9f10e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144431, "uuid": "f99e5b8d-b1b4-4b45-ad5d-f1aa6417f844", "comment": "Malware payload (GCleaner)", "value": "c6891d1b4acd7cef20adbac2287501187bd38d6f8fefdc696685c6f440a901f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144431, "uuid": "88ed9431-9c44-4f85-8194-890cffbca8b9", "comment": "Malware payload (GCleaner)", "value": "35d85ee3d25707c8dd27312590a52ba27a7195ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144431, "uuid": "dbcbe0c1-e722-43b4-bc93-fc7046e118f2", "comment": "Malware payload (GCleaner)", "value": "5bcbc1c8d1ea0e6caa76cd071f12b766fdddf51ac1c4070d04a810263a1550f61cb6507e245cdf795f4e121a1459a9a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144431, "uuid": "c68ac037-0c4b-486b-81b9-a3fa7e1eca52", "value": "T154847D03A3E1BD60D9674B728E2FC6F87A6EF5604E19776A2218EE2F15B11B1C173311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144431, "uuid": "15a96b29-becc-4824-962b-0d676f0e090d", "value": "b585adb193cc73047fae4142a994b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144431, "uuid": "6f827927-ae57-48a0-a9bf-4df18ffaef54", "value": "6144:5EjLkVjBJFguf8m5EHpG/iTzFYPfbWqEcHsv1SV:GjIVjpg88mmJGqTzFI6RcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144431, "uuid": "f4ce0a34-d90c-4603-91f0-1f7e55beaf33", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144431, "uuid": "44c2b75a-6419-4afa-8f5c-7679b8649c84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144431, "uuid": "7ffbb423-1097-4e93-b442-73204faf82df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53034804-c41c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1707133642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133642, "uuid": "e3a0053e-d7c6-497e-b7dd-c836f00b0d79", "comment": "Malware payload (njrat)", "value": "e28920059ec0be67f69ce4bb5810bf40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133642, "uuid": "313ec023-7670-4476-b785-802e99e73a39", "comment": "Malware payload (njrat)", "value": "c695b26b8aac88c752d8d76fdf577ba9f9079418f317316ff2004bcb6e28cc51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133642, "uuid": "daa5e90c-07df-4176-abfc-e11e27a5485c", "comment": "Malware payload (njrat)", "value": "fd65bd428d2ff6e4419ecbf10d987ed0649bec0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707133642, "uuid": "cdeb22d0-4092-4366-a7ba-f07f7af31467", "comment": "Malware payload (njrat)", "value": "36611cc5b6069087dc493f6869c5e7689d950cbc1a6151310853aaea30e9bc1c087eacec8786b65fa9c6f4fe8e77e158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133642, "uuid": "78385aed-1db1-498e-bd4e-5ebabfa5879a", "value": "T180434A4176E94F09E7A887FD096345006E376A0E472FD73D1A89E08A1F27787F681B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133642, "uuid": "0c74fb69-cf43-47a0-9eb2-49fa93bd283b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133642, "uuid": "04bd4713-7200-4a6a-95e6-6be9a3187e0a", "value": "768:USJ7G3o9mOSRsiwAKVZaRIYGgPQbl0l3WOgy+rkVNqBQ1/KSD1:VT0KVoIYXQev1n1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707133642, "uuid": "b370960a-dd9f-41d6-8d17-c650439f3746", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707133642, "uuid": "e26e2af8-cac6-44ed-ad57-11493b3d3a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707133642, "uuid": "8ccc1eb5-2f7c-4bee-8551-1935f826fc33", "value": "BBEupa5j.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36914c40-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121998, "uuid": "120831aa-97fb-4475-a3cb-62506e042f06", "comment": "Malware payload (AgentTesla)", "value": "1db362c12801bb158d5045ba26bb79b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121998, "uuid": "220aee91-c2fd-45db-9567-af5da91e1f01", "comment": "Malware payload (AgentTesla)", "value": "c6cb2acc9caa2e3f26f040d1e1d723899668ec80848dee41342a65c368916e99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121998, "uuid": "30b0137c-7f9c-4165-9c55-9a223a8876db", "comment": "Malware payload (AgentTesla)", "value": "e8395433bd1dfee883bb7cd63e135f6c49cba69a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121998, "uuid": "e0d0ac14-e5c8-4d4b-b750-703b6eddde25", "comment": "Malware payload (AgentTesla)", "value": "622c63bd575aa70b6222897f7af168f81d6e8a5254b293dadff4ce08c2a0aca919f827ce0893771f846f46f403e1cea2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121998, "uuid": "492e31e4-c737-4084-85b6-5b756fa554b3", "value": "T1C235AFA3F84CA2E0D4E88FB7E20B71B705371DB595561013A2D1BE263AF9C27467352B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121998, "uuid": "4d398a64-add8-4906-a60b-e5a17da7c48d", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121998, "uuid": "4acc0226-889b-40f0-ac70-1859ca393af2", "value": "12288:mYV6MorX7qzuC3QHO9FQVHPF51jgcllBqS9ZnQVOOk6yZa81F8NqTmc+5HCa:lBXu9HGaVHZ96OOYw81F8NqTm55ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121998, "uuid": "2cad4d75-ddfc-41e6-9088-a63829c49d91", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121998, "uuid": "94b0bcce-c935-4515-a006-fabb18f0521a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121998, "uuid": "50561a55-067e-4758-a539-e8e807f5d384", "value": "Required Copies of Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f7ca92-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121977, "uuid": "f99da8ff-ef50-4a82-8be7-b588bd96ee44", "comment": "Malware payload (AgentTesla)", "value": "f3cfef3c23c4832586a6592a296547f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121977, "uuid": "d06c052f-9e7e-49ad-b7a9-67b91bdac185", "comment": "Malware payload (AgentTesla)", "value": "c6e39ca11f746cb01021c316a5d6773a84be4f15f119e41db98c72b282e824bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121977, "uuid": "5a9c7e97-f24b-4812-883f-78253bb2111f", "comment": "Malware payload (AgentTesla)", "value": "ef8cd54370c34d7e862cde74dfa6ee5c4595e544", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121977, "uuid": "066e9457-62e9-446d-95f8-ab8b29942e0d", "comment": "Malware payload (AgentTesla)", "value": "00c162cd7a48bdbd2a57c5ff32e8f7a2d1f210a128ad43047e5650c129f2e6ae869814dfc057003037029e80b0fcaf08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121977, "uuid": "e6620d51-7a75-4d08-b272-0347ef82a33a", "value": "T1E2835C25278CD52FCA4F05FDAC21A114237492B24543E78DAF98C9AD302FFE95A05BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121977, "uuid": "028d7201-dc48-47fd-b335-a1306287e033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121977, "uuid": "fdb6941f-a2f0-4960-9bbe-e93668ef5b2e", "value": "1536:Z8kL7vOjG3azE8uD3Gql0PUUOjwzlYZXs4LgwogcfLnu0CvmVo9:Z8kLbOj2azre752lGzopLnubvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121977, "uuid": "09a43e2e-a807-4d57-a3b5-ec2ff1094d7c", "value": 83968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121977, "uuid": "d7abe366-0c80-4f79-9fa3-d1c7fa0f1b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121977, "uuid": "f05c06a7-2b3d-4dae-aa14-32d5c8f90cfe", "value": "GP Oil Lubricants Petrochem LLC.img.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "277cfcfb-c469-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707166640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166640, "uuid": "f52534fa-4160-4ff6-9c2e-be2d39b4a356", "comment": "Malware payload", "value": "986a643a31c23ede4fcbd9e394477882", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166640, "uuid": "6939bf14-ce2a-42bb-93ee-6f8cb5c4f0f4", "comment": "Malware payload", "value": "c6ebab403eb649d3341e9b39bb14457be023dad98cc1fe922769022f2426fcac", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166640, "uuid": "d1215505-89e5-4424-8466-720c88a6cb9e", "comment": "Malware payload", "value": "248f4d2a2985ba150c558552294b688f56ba9597", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166640, "uuid": "8ee89859-1b71-46eb-a57f-e5e2a36ac560", "comment": "Malware payload", "value": "5f363b91d432e790bb4fe4098d841aa4f5144b967d667fe4e874328f7423f3b6657eef359c27780fb474907e02eed81f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166640, "uuid": "c4134659-9fbf-4f44-b559-6f63f5516253", "value": "T163672261F7D7CA2AC7A39239453D6E7357168DC646C39283581B3A2814B3FE80B479BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166640, "uuid": "6a367c13-63af-4fdc-8753-524e3f13f5ae", "value": "393216:aNtYXGAJgLRIuxTHZgnYXwq0AxeiW1L0yrKGaDwGcwajPQ8lAoQ9KrubX51Y3spc:aNtZAE26zZxMiWqYwDahjPgzKWXep1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707166640, "uuid": "2d8c7cba-06ad-41e5-8eed-29e0b66bf7ea", "value": 31740896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707166640, "uuid": "625e6a39-b7db-4643-8ee0-67cb5171bc18", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166640, "uuid": "80966e39-63b4-4c7d-86a5-bcaf9f583441", "value": "metamask_pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b134a135-c403-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707123063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707123063, "uuid": "d489fc2a-5d24-4363-b009-7d12f140207c", "comment": "Malware payload (RiseProStealer)", "value": "8810af6cf38e6455b5ef091200108b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707123063, "uuid": "1290b453-c495-49e0-9f10-0cc10065f21e", "comment": "Malware payload (RiseProStealer)", "value": "c70eed7c30689da69a6f6a57af4e7540194186199e62e94403ffd55f471545bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707123063, "uuid": "cd2fb82c-1922-443c-b391-823f933dab26", "comment": "Malware payload (RiseProStealer)", "value": "109826d6a0002dd23804009762eb2370ed57b682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707123063, "uuid": "e2e2f890-7876-4073-9a72-39d286ca9425", "comment": "Malware payload (RiseProStealer)", "value": "743649101a4f2bad4a7bd09b6c4cdfc7b9bd4c3397b7478ee530a9882860263ff2f5125cf4cfb69338b82ec9c7565c31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707123063, "uuid": "bfc37a6f-d5c9-4156-8769-87d664895d38", "value": "T103A533FDE3934A28E86415B58FB550EC0FECF3082A5B531166ADA61E9D4FF0140EF6A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707123063, "uuid": "ee13b31b-9a6e-49ea-8490-85a28a955ae8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707123063, "uuid": "d1405198-dac9-412f-91fe-3bc0c75efe31", "value": "49152:YU4ngUr4rcU8vTEJwomKNjezlmGCTm5QaCgY+SgzNXx0bB:YU4nrgEEJJdizlPCTQvZNhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707123063, "uuid": "80cccf04-a218-4e00-b172-df3fb12d31ba", "value": 2215936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707123063, "uuid": "9c290aca-56c5-4c82-b493-ccf2f82015e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707123063, "uuid": "7db4194e-696b-441b-a1f8-24e6d0da7685", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81c2096-c41a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707132926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132926, "uuid": "ff8f6a06-2b2d-4931-9fca-88a80998717e", "comment": "Malware payload (AgentTesla)", "value": "4515b730d5db60e19ee615d59235d107", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132926, "uuid": "f7acfd88-f309-4561-85ce-834e679962f5", "comment": "Malware payload (AgentTesla)", "value": "c9241559f23410420e3cc5aca086d56b5b09f6f93dfa00a89c3596f2b4d80a2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132926, "uuid": "51757f05-9096-4ce1-acd5-478eb116faa7", "comment": "Malware payload (AgentTesla)", "value": "09e74d39697fd60d51db4b6c05c5e58e7160a784", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132926, "uuid": "fafa9abc-f314-4c89-8408-83556a9ead84", "comment": "Malware payload (AgentTesla)", "value": "ef0ebcb4aca2f3033433a19599e1fc17dcfc2ed99e65f2bb9c8ab765cccad91cc1debabc72aaf81ecc3928e9b4c391f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132926, "uuid": "2ab6913c-c593-4b16-98b7-84699739660a", "value": "T13B35D031B8C56077D6B32AB0ED7BF7659A3868661322D0DB37DC1B251DE0581262FB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132926, "uuid": "cd5cbf5a-6410-476b-99b5-fc513bb072c2", "value": "d3bf8a7746a8d1ee8f6e5960c3f69378", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132926, "uuid": "369e96bf-5ddf-49d7-97d3-3d2432ade043", "value": "24576:QRmJkcoQricOIQxiZY1iaqicPBvLAPaOOfMIE/:lJZoQrbTFZY1ia0PZO2Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707132926, "uuid": "e9def60d-a177-4458-a4f1-4a548791a243", "value": 1147765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707132926, "uuid": "0be28f2b-39a5-4469-b5cb-b6983acccaa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132926, "uuid": "a352fa51-1457-44c3-960f-d5e30a083ce5", "value": "SecuriteInfo.com.Trojan.Autoit.F.26038.27432", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f07894c0-c3df-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707107707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107707, "uuid": "50bd457d-c37d-4bad-a861-87717a21600a", "comment": "Malware payload (Mirai)", "value": "78c8eba0fdf01288faeb636e691091e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107707, "uuid": "06617e3e-b940-4e08-9e1c-45bc22fbd82f", "comment": "Malware payload (Mirai)", "value": "c9fee9acb93f7dcff571655a91127ed384c8a5d6184803f15850d56914d3ade4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107707, "uuid": "9333c806-3dd5-4c4a-a859-e809b13c3f07", "comment": "Malware payload (Mirai)", "value": "b206235cf38fb174f365640dde0a09e0ac8805f5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707107707, "uuid": "6b2bcdaf-abb5-4f0a-9b9f-ab34ee03b86e", "comment": "Malware payload (Mirai)", "value": "66ae54ab10b525543ea424484112cf959bdee126872706181251d30bc94f656feb9c8f243ca26f70ddd9eb80bd7420ac", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107707, "uuid": "9371bcf2-915a-48eb-99d7-568f90f30111", "value": "T160532A91BD815613C6D422BBF76E428D372663A8D2EF33039D226F21778A91F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107707, "uuid": "b90a2def-6905-44ec-bf58-840820234897", "value": "1536:3jRVegE8UlSJNnDfRUHZNo8eWlKQ0cDZzP:3jRVWGNmHZNo8MUDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707107707, "uuid": "14659f88-c78a-437a-aef0-50f00073fc89", "value": 62756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707107707, "uuid": "452bb470-fdd0-4a0b-9e6d-8fd598bc65e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707107707, "uuid": "03a2e2ac-2ae2-42a7-a752-57101eed410e", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5098940-c3ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707114130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707114130, "uuid": "89cdd132-ee9d-48ba-8924-77d4d4a3bef5", "comment": "Malware payload", "value": "bb95fbd316245b0b648fe31b4e231dab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707114130, "uuid": "660e92e9-0823-4f1a-9b1a-ea94c9b159e9", "comment": "Malware payload", "value": "cb06f56c1843180c2adc6a6321b2b6c5492ee4dde0c5ba39dd09bd3ec456c974", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707114130, "uuid": "169fbb34-72b1-423c-bc14-fe03571fc1fa", "comment": "Malware payload", "value": "185aa69ce5ed3948e22b0127a74d1bb3c8a1a780", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707114130, "uuid": "0d648b63-85e4-47c6-8d75-0fa02561837d", "comment": "Malware payload", "value": "564d0717263d0114c66a2f1ef3968ce57151d264501c22073bc3ea10581556d88117e05d4758797c5db8717b12235c7c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707114130, "uuid": "bf1cfd05-6861-4a31-85e3-d46366a98451", "value": "T19C360290827F4203DB4FF37A78CA8366ECEED94955219D1BD5DE83E01C081A523D66AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707114130, "uuid": "6b9d4046-bde8-48da-8c75-c1d59a1e4566", "value": "98304:/mEXIrun/uAeEIrifhpqiqZzn/LEex0JO73uvuLnbz4tFB+nW/dfn247vtmmJ1zz:nIK/uElXwZjLEex0JO73wuLbz47BKou2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707114130, "uuid": "5007556d-9b84-4c9a-9c1d-a84f97241ffc", "value": 5161978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707114130, "uuid": "34d1e326-47d7-4944-9963-ae6351b1095e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707114130, "uuid": "b976cfa0-3e75-4eaf-93f7-5bfad3b621db", "value": "bb95fbd316245b0b648fe31b4e231dab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b919e3-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707144538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144538, "uuid": "fc3e72d8-7994-4ade-bf03-7a5d785c44fc", "comment": "Malware payload (PureLogStealer)", "value": "f59ce0d867586f2c378f47dfcc8a85df", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144538, "uuid": "51895a04-3309-45c2-b92e-dca9feadd128", "comment": "Malware payload (PureLogStealer)", "value": "cb8757974d332f7b90bd727640c6509732f921a356a884d3ddb364a7b80f7306", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144538, "uuid": "91ce11e3-2692-4a9e-8b67-da55f8bfa9c8", "comment": "Malware payload (PureLogStealer)", "value": "a11027a5cf06a377eab02efa7c25343c1eaf1513", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144538, "uuid": "08d5ae3d-b145-46b1-a6c0-c01d6f45e22f", "comment": "Malware payload (PureLogStealer)", "value": "fda51f645d4b56239354c6ab6ef5b1f6eebbb373b1ce69f6de7411bbd78f4c5a900d3f88909748199a2376759fbc6b37", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144538, "uuid": "449ea533-4eed-4cc1-83dd-5af383ef4ff8", "value": "T110433B2787438C10DA6A8B71FDE48631F9217D5F996CB0F7DD4B804406E364B7AAC6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144538, "uuid": "13be0099-64bb-4e6e-8c1e-a32506e7b9d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144538, "uuid": "04ed1286-762d-42e6-84d5-b8e9c807a90d", "value": "1536:89fAXTAmzJBAlHiW+v/e8NgV1fQxMuXIxb:894DDJBAL++yKlW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144538, "uuid": "e9078ced-8b3e-4e9f-b775-92dc616f91ff", "value": 59168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144538, "uuid": "7e6a317e-e05f-4a3f-83da-e14b8614ae0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144538, "uuid": "00315f86-d147-4ebd-afc9-89d7456cb0ec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75156831-c410-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707128545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128545, "uuid": "13017868-93ae-496c-a701-4226d8eb1e75", "comment": "Malware payload", "value": "9edff6d36166a0c702e8f0db998810f0", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128545, "uuid": "baf7969e-c32e-4cc8-82d3-65c892aa2aa5", "comment": "Malware payload", "value": "cc44941602bb9f0432c0a5d5ce51ea1cab61dd31097c466db8dfe1cae11b4287", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128545, "uuid": "d92ed9ad-55b0-463b-9f83-ccd2a5378b63", "comment": "Malware payload", "value": "ab5f5e664e00b5e8396ebf049c504e079a4a8c0a", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128545, "uuid": "6e50988b-3b55-411d-95f6-679ded5f82f2", "comment": "Malware payload", "value": "96b25d6e19c309afa683f363322667a39216229c45cd531feb5dde8a6a566c359ed5f4668d4ab88702b44c800f57cfdc", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128545, "uuid": "16dedd4f-c345-4138-9b15-d20c7d275f07", "value": "T15842CF9CE530173BE11D8AF19C995E13BF826777AE72138A3D88D80426F35A8609AC4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128545, "uuid": "925f1d91-600a-42cc-a02b-02919bd1d7e1", "value": "192:lluyW9/fcsth23wISiVKvkRPUyPOyHArJpS8FxwMZkQn7ZPgdkOl9XlYQdGLUy5D:c9Hca6VKkRPUMOGtBMZk4al9zwLUy0EB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128545, "uuid": "de2faa9a-8d87-48b5-8ccd-655669200394", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128545, "uuid": "21f4bd8c-bed7-4384-a328-2b99d5c8b3c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128545, "uuid": "2456b121-5f94-4014-8821-cce9e27c455f", "value": "Payment Euro 68000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d6df4b-c41e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707134454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134454, "uuid": "e24a2134-a86e-4b5d-bd6a-6affa600b70d", "comment": "Malware payload (Formbook)", "value": "b9b5e5032d4b80ffd8ff1e2360e028f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134454, "uuid": "076d6ccd-d125-43e0-af46-1beeaec48932", "comment": "Malware payload (Formbook)", "value": "cc99566532c8e826adaf3b7c90950ca2cd28eea915b6abfb2a7d5d31e6233c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134454, "uuid": "38c52e53-78e1-4ef5-81ac-ff2780ed79c6", "comment": "Malware payload (Formbook)", "value": "674799fb53a3293c63bbd941abb46b72feaa1dde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707134454, "uuid": "b694a3ca-944c-41de-a869-652ec17e6b16", "comment": "Malware payload (Formbook)", "value": "eec2ce018031645b5da6c8605f0d453cac0d5eabd9df010fdb332498a760dfb261451e5aba8a2fadd0b71b4962b804bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134454, "uuid": "d6611e4b-8cc9-4f08-b86a-4e1618c9f740", "value": "T11AC402289A359F16F93C0FF220B4B911E3F212972616D7B95CD920C52BB3F250B44EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134454, "uuid": "30bcc75f-a409-4665-9823-69b52319535d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134454, "uuid": "cb62b5c5-3a27-44b9-856f-ef3b2cf3120b", "value": "12288:QsCl+aefZumiXlRtigIw2BNLCXqRQtHdqrt218q72dY8l:QsCga6u/ZKCcmdqw6S2dR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707134454, "uuid": "307da38b-4da8-4dc3-a39e-ed72f38697e8", "value": 595968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707134454, "uuid": "b4f557e7-218f-4c98-a01e-162a2e7d70b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707134454, "uuid": "e7c6127d-2316-4181-baf4-12b78fcc76f7", "value": "QUOTATION#012924.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1d4cf6-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707141714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141714, "uuid": "21cb0b7b-33be-4731-a635-02f8835e091f", "comment": "Malware payload (GuLoader)", "value": "999033c68d43bc42a0cff9374f103e64", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141714, "uuid": "9213a95e-40ce-498b-97bb-43b770f78bc5", "comment": "Malware payload (GuLoader)", "value": "ccedba6d1fe22b8ac2b180015c55b5f820ef67a3f1ab4eadba65ed30c58701ef", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141714, "uuid": "09b56415-3655-42fb-9a65-b84e937e1335", "comment": "Malware payload (GuLoader)", "value": "5713cac7e8a1e64b1a564dad057a39e00352c5d7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141714, "uuid": "9e9f1466-0f91-4ea0-b686-9c454edcb7e2", "comment": "Malware payload (GuLoader)", "value": "7b7702d06bac92285f21e2b717b167669ee5432c3918d86a3b9ad2a6e4d5fb81ab8a57c19dbce1c7af40b84f24a256bb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141714, "uuid": "1cc907fc-cfa6-4d5b-bbae-454809de50c6", "value": "T19115233CECD1CEDE2C04B5952A7DF90D23465E1093EBAB841CA8B8DBD6EC0995B44687", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141714, "uuid": "39cc18cf-d748-482c-9cac-068f475e2c05", "value": "24576:jfwmDRHUhNWclDYnBuK4bZscY9DjL/qmX5sDdS:8+R03YnmZscYlLCmpCdS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141714, "uuid": "3165cfeb-20a2-473c-b57b-2b3daddf7176", "value": 898806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141714, "uuid": "b30a635c-c9ab-451b-a60f-52e50b3c3574", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141714, "uuid": "40f820ee-3b73-4ba1-895f-e47ab38b469c", "value": "nP22783319.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ed07ed-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707125435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125435, "uuid": "9f62d42f-ef9d-4772-9324-b5d9fd52605b", "comment": "Malware payload", "value": "937062351c854db65017bebbda17f1cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125435, "uuid": "5590a965-573c-4c88-b2f8-fbf471daed04", "comment": "Malware payload", "value": "ccfc951f6ea27b7d825813e489b2d5d75790d95a51d297fa191083a2a8da9f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125435, "uuid": "0c4b2021-3afd-4a9a-958d-a0cd2e8dd962", "comment": "Malware payload", "value": "80983555c07eb234033c8d74b04a7c283d5419b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125435, "uuid": "9b8a38de-d185-4efb-9ff0-ff94931fb666", "comment": "Malware payload", "value": "956d5a17bd3eaf258ea71c795ee7166452c1b773fc7170fa288cb4984ce9b660cff87bc08b3770053b7dd5193dbe3c47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125435, "uuid": "d8664873-d603-43b5-a6d4-ed207e16b044", "value": "T1C7A66C3672AC0099E076D17DCE9B9B16E7723449033157DF22944A6E3F2BBD85E3AE10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125435, "uuid": "ae69fce4-5c11-472c-b97b-05f3596f3b93", "value": "db34d4c19c10f493e87edd352bb24ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125435, "uuid": "a0c25e8a-c303-4955-8e50-0e1c81a225c9", "value": "49152:YRcdceRRRReVZIIB6PGWFqNfnNvEPBZmiNauitfWnSGA90eq1SkraaB+wuC93s0b:YaJn1owp93NrJ5GBNuflNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125435, "uuid": "8922d071-fef1-4406-8381-264472e084c0", "value": 9650176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125435, "uuid": "837231d6-2b51-4b60-a889-93285535de21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125435, "uuid": "a98dafd9-51f2-41d8-8b89-e35ff522dc27", "value": "SecuriteInfo.com.Trojan.GenericKD.71290537.11271.14641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b7a6b1-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707122000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122000, "uuid": "6b6d1467-a4a3-4dc1-a852-af9f7c41580b", "comment": "Malware payload (RemcosRAT)", "value": "e1f54cb4e87f05e3ad006b707bbf7faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122000, "uuid": "59e2efb2-a10a-435b-96ac-fe27da5dd8bd", "comment": "Malware payload (RemcosRAT)", "value": "cd1ee01f73112ac8092488e3c8bd6edf3c5defc2ff087b60312ecd34a46afeef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122000, "uuid": "96f53bc3-c3ab-46c2-9590-571f5749aec9", "comment": "Malware payload (RemcosRAT)", "value": "0a903373482fb718e04cd7827f53b698b672edba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122000, "uuid": "22a790ec-eefa-4d25-bc39-76673dcff4ab", "comment": "Malware payload (RemcosRAT)", "value": "0bd7365946d4f083bae74ca2953466e0803740e7de55ead7d0b07fabea0d029c910bc3860536ee3980bb5fb5d15d46f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122000, "uuid": "a8484924-9eb1-4116-8227-04d8b3937da5", "value": "T16275CF0373C0C075FFAA92B36B16A14567BDAC798127951E23C83A766EF05B1163E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122000, "uuid": "75359a4e-572b-477d-835d-3159fe182fb9", "value": "bd3825b6e0410966f0c31f64b6c7644a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122000, "uuid": "eb3e8018-489e-44d0-ad91-8ed00968e24f", "value": "24576:OAHnh+eWsN3skA4RV1Hom2KXcmtc3q1WYpqKoBoTM8G010GloAxr0OC7DBg:5h+ZkldoPKsaccWYpqKoBoTMN010GSga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122000, "uuid": "9b7d9993-1900-47ff-a7dd-967e20b7f22e", "value": 1569280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122000, "uuid": "8ef75408-e50d-453e-9f9d-18b7be9cd273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122000, "uuid": "9d14b880-3992-4ae3-99f9-76205f75c369", "value": "Revised P.o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbb9a7d-c419-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707132640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132640, "uuid": "6327a996-8724-4d97-9e27-eb5eed0aad40", "comment": "Malware payload (Stealc)", "value": "49ce8ba723d76f7b2291aa4c963da275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132640, "uuid": "8604e2e7-bde3-43ce-a9aa-83b420ed9717", "comment": "Malware payload (Stealc)", "value": "cdc37726e1398c0927a66d0b3c56d72d76eb60a80851577f8b92d07b0993993f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132640, "uuid": "60c44c6b-9f63-4a0d-b90a-6d95c02b671e", "comment": "Malware payload (Stealc)", "value": "afc87522934ae1d32c079995b5c9f4a65a0923aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707132640, "uuid": "dec81754-b088-4a46-9751-ef9f191dfe6b", "comment": "Malware payload (Stealc)", "value": "459c331e592d5ecfc0342a3efa98b68e2b667603be36d05f1b2ff648edff3c3772c6f5000d17ca4a5d8d5cf9e5677f8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132640, "uuid": "2e224b61-8113-4bdc-b541-b2e3c51dbeaf", "value": "T1B6646D4396E2BC50D92746738E2EC6E8BB2EF560DE49777A2218AF1F04B1572D173720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132640, "uuid": "b8ddac5d-262f-45d1-b645-76cc833f5d25", "value": "8c20896f0a15a2bc693d2f11c2ab744a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132640, "uuid": "48459ab4-c5fe-4c1e-ad71-5a8ddc16c2f6", "value": "3072:+O8MnL9pWbF3b6jG9pHO7KEZasUaWv8AF+EX3W5l51+bHtRYMupIM+:988LuF3OjcpOOLRjv8+Y+bHtRYkM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707132640, "uuid": "ef235412-0d4b-4a9e-9872-7636cf5ebf99", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707132640, "uuid": "8a18de81-8354-4015-ac0c-a233ec9dab77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707132640, "uuid": "e11dc084-076e-4fa7-81af-a96cf7acfbf9", "value": "49ce8ba723d76f7b2291aa4c963da275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93312af4-c3d1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707101538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707101538, "uuid": "22006bab-6e89-471e-b5be-69b586f19283", "comment": "Malware payload (CoinMiner)", "value": "5d0fb9d3fcf1a559a5a346ce92cab568", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707101538, "uuid": "d40da7da-ad6e-4e03-88f5-7c02cf337b5e", "comment": "Malware payload (CoinMiner)", "value": "cf18f63365fe527daf3891fe264d2f345626ccccb8733c35966ca8040106dbe6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707101538, "uuid": "e7fe3359-378f-47fe-a2f0-ecb1d5454a51", "comment": "Malware payload (CoinMiner)", "value": "b2694e809d2ce81a4fc3aba099d6375bd4edfa8c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707101538, "uuid": "5ec165b3-bb77-410f-838b-83f0392b72d5", "comment": "Malware payload (CoinMiner)", "value": "8b71c11321f7ee320e7cbdd78273af0d33a41487cfa7aa552a198b84cdc090b0e6f72f3be90cca05699720dbc9e8335f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707101538, "uuid": "e3235c3b-99f0-4ca5-9085-b0178ef74f25", "value": "T1FC563390FF247F4EEC0DAB7EC54298596690BE0FC6C4159DF2515B8EA304E6BEB83118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707101538, "uuid": "fd4469c5-46c0-4502-883c-302a12349cda", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707101538, "uuid": "e5ca10b2-bb09-49c3-999d-da36c4dcdd97", "value": "98304:OornZQfD8SMbKN6QEFiThZNUoiC91w8LqBmwSmCUSgTwObu+p4rjT85KJl:bryb8SMbKkQEShZNU40iqS9USgTw0irX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707101538, "uuid": "c88a90a5-cb91-47ce-8f24-94bcbe540995", "value": 5890064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707101538, "uuid": "1d70ea68-7502-408c-8102-2bc50920f8f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707101538, "uuid": "5536604a-8af0-45f0-8f6b-55d177caa432", "value": "uxtldsktkgfv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243de799-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121967, "uuid": "feed20f9-7bc0-4cde-8558-52cf12173b85", "comment": "Malware payload (Formbook)", "value": "3e2826cad72a2a3b63d43ba27847ae09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121967, "uuid": "48ea6e6b-d3ee-4fd6-9c5f-5aa692fdceb7", "comment": "Malware payload (Formbook)", "value": "cf215d04cf5875a54110d6f1a82b3fdf98982e1663f76fa0e43ec6fab81b72a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121967, "uuid": "dc44608a-ca2f-4fa1-bbb9-bafd2315f356", "comment": "Malware payload (Formbook)", "value": "7c377a21c1da7621842fd5a25842ce1a14389bc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121967, "uuid": "4c291909-2e43-468f-b303-f6ae59a9cb25", "comment": "Malware payload (Formbook)", "value": "f8f9d7306815818b22ada217ad351dfb0f40949fd14d8513c92bce91d2218ba58a2a6972c4465c8a6266fb36497a12c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121967, "uuid": "7d0b2e57-4aa0-44ef-b038-31e4356345f5", "value": "T10F049E32D601C031F2B251B5B6BD1B7B883D4E357255A4EAA3F216E06EE49A5F03931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121967, "uuid": "f4fad311-9e2e-4526-8bb0-8d0adee4b420", "value": "3072:MgSsHkVi7vvnal3DmHnCo36AT0YJ6Tcq90rfmNpl0AstFssaCOjVa:/miaJD8D6AT0YXqYQ0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121967, "uuid": "27a91ce6-f8ad-4040-b069-a1afadfad4b0", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121967, "uuid": "23966aa4-e092-4f5d-842c-d5a17c7c1369", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121967, "uuid": "1dd863bf-2e0b-4720-882e-d3ab1943bdb5", "value": "cf215d04cf5875a54110d6f1a82b3fdf98982e1663f76fa0e43ec6fab81b72a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b0105d-c425-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707137614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137614, "uuid": "874a7357-6bb7-4478-8073-62a652108050", "comment": "Malware payload (Formbook)", "value": "a5d39d9dda55caad7fb772ef23bd427d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137614, "uuid": "ba86a423-46bf-41a4-9288-e18a1154dd75", "comment": "Malware payload (Formbook)", "value": "d04d8bf393b006febbf70991e782117ca672c6d4e97be4820fce11b18a05c13f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137614, "uuid": "44f5f23b-c91e-43c6-abac-6f45e1293a66", "comment": "Malware payload (Formbook)", "value": "024cb512650fbcbf79f081f46510aee3f6c71484", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137614, "uuid": "ab3b8f1f-77e2-4bf1-8339-80dfdf11c585", "comment": "Malware payload (Formbook)", "value": "c2e03f9c5f0d5a46defb2819c2bb254a47fa63e9391f7d2ea9a8a1d6bf63c38cd84a2156d74b1a1dc8314106062de179", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137614, "uuid": "87da2c71-6334-4323-b453-c1bd256ed223", "value": "T190E423B92C00BB65AF6307560AE118EF8CD36AA7F9B2C368DC1A5516D440CC1DAD17BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137614, "uuid": "b00ec73c-3fb5-462f-8cc0-93bc41a9569b", "value": "12288:/9p28IwfMYseYwceCXj5yxLdJt0xZqj1PrleF4jAutpOXiyW1bDob9m3/:/xyKyjsJtB1PhenupWFW1bDu9m3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707137614, "uuid": "5623a6e2-73ea-44ca-85ab-e6d88e1bf926", "value": 692701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707137614, "uuid": "6205ca3e-00c9-4275-9f3f-498afb7c2b26", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137614, "uuid": "0a819bd8-2d94-48e5-bbfc-7c118632f983", "value": "nPO IUYTRR.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5b8f4e-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707141709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141709, "uuid": "340aee52-faad-4b65-90ca-027bfd710487", "comment": "Malware payload (AgentTesla)", "value": "89749103988144ccb9f2929e03507bd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141709, "uuid": "6691177b-1599-45d5-aed0-ba79f2fa2f82", "comment": "Malware payload (AgentTesla)", "value": "d1c4ed51577fff9f376f582b5c19f7318025e1d919531fa8a096c0b675cca444", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141709, "uuid": "5ee3d71b-65a3-4400-bf24-9147e92e93ad", "comment": "Malware payload (AgentTesla)", "value": "996d5dd9861609a42320cee5b284fefdd46a21f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141709, "uuid": "012f9b97-a2a6-4116-a6d5-14ab4eb5778b", "comment": "Malware payload (AgentTesla)", "value": "f3564bd35d9e4b55af88b4ba4b7746d531b79373407499b7a903023892ef305ffcc998242d9f76898cd554a7eb659793", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141709, "uuid": "14dac033-a649-485c-8fb7-7676b8694979", "value": "T1D2F4234C18E86A8C0FD59AA818AA6DC61FCE3475C611324977AAD5B4CED3FF893C7C50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141709, "uuid": "98b93a6f-ad0b-43c1-ac8d-b5416726023d", "value": "12288:DLs19C0b0UHNg1gw6mu9PY81NIzCC8ORxzz1A2y0gi+QN1ztN1JletWIlRvA9hyX:DLc0UHNg1g9PY81NLOXz1zgoN3NH+WIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141709, "uuid": "6b86832d-9889-47d7-b031-81d79ea122f5", "value": 771495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141709, "uuid": "b425a080-8259-4b5f-876b-25fb74c38196", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141709, "uuid": "79516c99-7d15-43e6-92fa-5fccc50a605d", "value": "nF%130YAT TALEB%130 Y.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf1c858c-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707111516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111516, "uuid": "95fbe842-34cc-49c6-a6eb-b2e0fd5a44de", "comment": "Malware payload (Mirai)", "value": "a81d4b567f46abaef37b56a97d59a6d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111516, "uuid": "3e4915c9-abca-4f36-a12f-74fa5c7627f8", "comment": "Malware payload (Mirai)", "value": "d2178eea98b5c52f580c5ac640dd06bcc0eafb2b8640d6889f6583b8a35d0a08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111516, "uuid": "7115d5f4-2f99-4fb5-b117-bcd9904e87ff", "comment": "Malware payload (Mirai)", "value": "dd1c3110b0dfd46622f98f3435ff89bc19af1c17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111516, "uuid": "77aa76d1-0af0-4465-b038-453afe40e0dc", "comment": "Malware payload (Mirai)", "value": "01781468debbf0db4834ee28097c32b179bc04c24bfa1f793d62653941559a74b8633f35ccf3a7756eb7c0436a7cc73c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111516, "uuid": "ab953648-ce5f-48f3-a223-82d56aeff665", "value": "T148B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111516, "uuid": "aaef8eb0-bd02-4459-be65-71849fe86f5d", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZ3oamm/QcuLB1niDNb:YuFX0GIk1MHyph4amm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111516, "uuid": "d74aba7b-3a65-44af-82f7-04c463db63e0", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111516, "uuid": "74a9642d-7c4a-4244-9d3c-076b68ad3628", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111516, "uuid": "6809edf3-2e41-4e9f-ad35-edd9a631b693", "value": "a81d4b567f46abaef37b56a97d59a6d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f8b997-c40f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707128253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128253, "uuid": "71ef8c07-4793-43d9-a83a-026ce2302fde", "comment": "Malware payload (AgentTesla)", "value": "d1899b57cce9ac44d78fb7ea8930f335", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128253, "uuid": "fe19ae6e-1cbf-4ba3-9c89-b9eabc15a55a", "comment": "Malware payload (AgentTesla)", "value": "d29ea53ccf63637d549b910dc8775e972b6834763ca8bc94eaefa0bc32302028", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128253, "uuid": "85f1b860-5b74-46ff-a8f9-08aec4dfe818", "comment": "Malware payload (AgentTesla)", "value": "5bdfc15493841535264e8252221196f4ef2e056a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128253, "uuid": "9399cf0c-aba8-46f9-86a7-d10c5af936bf", "comment": "Malware payload (AgentTesla)", "value": "c0ab1c1687a38369ef329a211c959e51ec05c70e6df17b9ef6a57c6d340f9114cc73899d16a18e123c6d869a8ba52e5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128253, "uuid": "deb69761-4826-4c26-8bca-adf4827dc56d", "value": "T17DF42359CBF9CAF4ACF0C5A72C1054EAF5F22B495C11AF974E11D46BCDA33A9B408493", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128253, "uuid": "145732e6-41ab-4c17-a1b6-a184c56cd057", "value": "12288:L6bpryry98AFN4JpFCxTcHUsWhN0XQGUzaN+HsUl8EVmtC0xtBUVUyb3Su:L4p4yNNk0bSXTUzq+HsUl8EixtaUyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128253, "uuid": "94c477b9-c0cc-4d51-b590-a20b06ca7585", "value": 768204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128253, "uuid": "71594e98-c320-41f7-b8da-4bf96f66a447", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128253, "uuid": "3ae257ba-e471-461d-b1f6-429a3d4736d7", "value": "Dekont_html.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87f63c8-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121760, "uuid": "3e41f294-031e-42a4-88d8-b14bf583f17e", "comment": "Malware payload", "value": "6dd80d6eeea8fcc51a04d87b904b54c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121760, "uuid": "0ac85a7d-65d0-432f-81c7-622d3c796ad7", "comment": "Malware payload", "value": "d49e2ccf0ff7e86ddddd3b33e2b595086c071385e629c4a5b4f32f73a29b8e2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121760, "uuid": "49bb4565-4f4e-4cc9-b0d8-4d5a31d9f5da", "comment": "Malware payload", "value": "d8a55aaed7d54777e2a4aff023fa391031c06108", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121760, "uuid": "5ffa8faf-96c8-49bb-95a6-6eea6c0cc2e9", "comment": "Malware payload", "value": "1cb6d29017c2904ab3489b1a58885b31b5c2589bf8f87fc2e88f963aebcb9f9f251778ab9b66dd71a66b2e5c4f92f1b4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121760, "uuid": "475e5a6d-2b5c-42ef-9e45-debce1acd743", "value": "T18225D001E0924070CF282571BCAA7A5B45293ED9AF6405DB73C8DD5DA7F62C24EF6F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121760, "uuid": "8531c5fd-ca0f-4377-a419-6f46d871d049", "value": "53f88f4a1afabe715dcbe6c0c694eb66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121760, "uuid": "ad9316c8-67d6-48f7-8cc9-69c13cc5959b", "value": "12288:CqTnxNROKjZRBL+ihmBR503BKltuCEEuMdxcdj3Fl+NOE1EHJudeJIGlL2TwJyFX:CSnTjq503BsH6dRl+gMdgaToo7/4r2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121760, "uuid": "67b54b61-09f1-414d-9d1c-bad9292d27a6", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121760, "uuid": "feda4f21-8f38-47cc-8b79-739cf0db57e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121760, "uuid": "d25c5943-e305-4957-883e-ee66524d6b40", "value": "SecuriteInfo.com.W32.GameHack.AL.gen.Eldorado.7621.26923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c979d29b-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707120526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120526, "uuid": "5dc69a57-71f4-41b0-968f-38c93f80af2c", "comment": "Malware payload", "value": "5c231c1594fd3283ede8b07b7fe6b020", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120526, "uuid": "4decd29b-2d9c-48f2-8701-41183a19594c", "comment": "Malware payload", "value": "d55e642ceec5c0042491bc914b25f9fe6f7a8086d0714db7109bd673917d2560", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120526, "uuid": "cbda0831-f2b1-405d-a82e-d427b49d5651", "comment": "Malware payload", "value": "aebf1148a5ad3ff3a8ece27e87a7ef4877561ceb", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120526, "uuid": "46938970-2f3f-4b6a-b844-32298b8dca4f", "comment": "Malware payload", "value": "55a1be5b5f3bb3b8e87880293327addbeb84dfb0620f34a6533c958399de0c2ea3f79f5d5a6059d8566ff96dd0e53a4a", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120526, "uuid": "779958ce-2f79-453f-9c19-dc94321fbcc9", "value": "T1F54423786CD5B06843EED4840619F39CCF77A29B04D97AE580998CE3EBC15CDD0B98B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120526, "uuid": "e683db22-6ce7-494b-855c-bb3a543f8194", "value": "6144:Gc9Ettq0YtooksymV+ncBCI/DAeYhQn0UfrgE4Nnvpx:GsEtiozstV+ntIbAhQn08gXpx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120526, "uuid": "a4019c51-1143-469d-8d39-93768507a649", "value": 257578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120526, "uuid": "8e8d5ec4-21cc-4384-97a6-e81f2c74e99c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120526, "uuid": "3d0eb50c-4745-4f93-9889-94b794c683c2", "value": "Kingston.VGA.01634.5944.383.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6160bac-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707144546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144546, "uuid": "96a5c4f9-06a2-4c63-9164-2b8019a10bf5", "comment": "Malware payload (PureLogStealer)", "value": "840a418e58256cdf8b840c72dbb8fd4e", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144546, "uuid": "b312bc1e-884c-4507-a8f8-572fbaf556db", "comment": "Malware payload (PureLogStealer)", "value": "d77b6d2f92f9ddf546f7eb08af9344029714949a747287bce4fd1757b132183a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144546, "uuid": "77e60663-cb07-461c-938c-17da9ddf7a1c", "comment": "Malware payload (PureLogStealer)", "value": "0e4e4d52965a565795b76da07fc6924cd1a0e5fd", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144546, "uuid": "d412069b-de1b-4c83-b687-f75e3f6e7a9d", "comment": "Malware payload (PureLogStealer)", "value": "d1989e6d1eeeefb7efbf47ad330bbc90c1cd1778a01abf3458bbf6a903d5d3436bfa8394419321fe7adf98c90f5fe002", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144546, "uuid": "029dce26-a057-4549-8a4d-8002908a1f90", "value": "T10A65128A2B050915CBA6A7F199B39B000A14FAF35423E35B93CA957D716F66F0FE1313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144546, "uuid": "1b8a24a9-b4b1-46c8-bda9-7aeb9523d217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144546, "uuid": "3dbe9753-a270-4df0-994e-9b9526f8d729", "value": "24576:CqLXYj0ldHERChxrVN2jwemvIIkMSKTZKnK45HJUhSgDo/Yq:1LIj03HEwPHzIIpRknK45yAgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144546, "uuid": "805af794-ed09-427d-b750-461be5e7933f", "value": 1512960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144546, "uuid": "717c088f-e21e-4419-9838-bbea12acc074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144546, "uuid": "79bc041a-c3ac-430e-b13d-c5c82262c8d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6976f7-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144150, "uuid": "66993bb7-75dd-4da2-8f6e-5108f2a90142", "comment": "Malware payload (AgentTesla)", "value": "5b43ef2d931de1993c4248bf399c1fd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144150, "uuid": "76f76fc2-0a7b-4ae6-afa4-21a309420e89", "comment": "Malware payload (AgentTesla)", "value": "d8286c3d02b19e69b2b8520eff324fa516dfb49320450e3858c3570871bb78ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144150, "uuid": "834e7ea9-52c4-4c98-81eb-8af1b60b94c1", "comment": "Malware payload (AgentTesla)", "value": "ed608317e496b4518c80bd4cd57c8172df8cd484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144150, "uuid": "e3e16370-a90c-4190-8f40-3377411b13bf", "comment": "Malware payload (AgentTesla)", "value": "9723e599528a6bf4a2397f1694eeaa5f0a71b92355e9dc90a076d387901e1063799053b12a1fcd342617943eeafa5822", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144150, "uuid": "034f48d4-2092-45bd-bcbd-4aee39f36a3c", "value": "T1C5052248BDA45B81C67F0BF91955E143CBB4822BA503FB6DACC378D9A462F608B11F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144150, "uuid": "66a8e2bc-4183-4ab5-a538-bfbfa50ee4e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144150, "uuid": "3218afc1-3d06-40c1-a76e-05eefd33ff4c", "value": "24576:yV68yq0N46w9Bk+pO4rhiRsUVI6AMH9cx:yVsqCiDpHQR10MH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144150, "uuid": "d70f3991-f378-4cea-b81c-34a7fb3f7213", "value": 799744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144150, "uuid": "fb5acc49-7c89-4b00-8c40-5c47415eefc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144150, "uuid": "2e6d7a1f-cd23-49c8-a8fa-efa3208e60f4", "value": "DHL AWB - COMMERCIAL INVOICE, BILL OF LADING.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ddf2f57-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707121983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121983, "uuid": "15b0fb3b-be64-4cbb-82bd-f633348337af", "comment": "Malware payload (RemcosRAT)", "value": "7e207929b2b6ff782f8d6d63dc321d76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121983, "uuid": "a7efeefd-b492-4f5f-8c75-2491b734ca51", "comment": "Malware payload (RemcosRAT)", "value": "d844d6f1c735e67e30bca9b960c96ed78c1583cfdc43fb76f3b70bbad6615d2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121983, "uuid": "adca5e79-fae4-445f-98e7-4732750f6b6b", "comment": "Malware payload (RemcosRAT)", "value": "45a8258b3b62cf08af7510dc3e5791b81d426ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121983, "uuid": "f122eb78-bafc-4daf-8ef4-ac9171d9f68f", "comment": "Malware payload (RemcosRAT)", "value": "1d5e409344b5fd1812a0037328cdacdbef1863e855f10f598a8c9c995057a59ff4f8c23734edf15b4d51b081216a78f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121983, "uuid": "19d095da-7b2e-41e6-a49d-034fb3e59396", "value": "T18F45238673A41703C17F67FACA750A5263B7765A2922D20D8C80B5CF6ED6781C603B9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121983, "uuid": "4a884d44-2ff6-40de-99c0-b13e8fadef15", "value": "24576:b2OIT0fJz9LmAC+eMmEwFHDeQ0NVyQyYVJWLY64xVqloMG+CGEookiJImnfjp8:b2OIGJz9LmN+ZmEMHDepNVXyYVIsmlo6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121983, "uuid": "7c985ea4-188c-4d75-af42-f16f820ddcdc", "value": 1168384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121983, "uuid": "87a5b5a2-eae7-4550-a97d-ef500cf24959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121983, "uuid": "6ede735e-f51a-4400-a7db-fa6edac4bcee", "value": "Online Banking Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c90b03-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121970, "uuid": "f96d25b4-c44e-4e8c-8a86-db8a58c02058", "comment": "Malware payload (Formbook)", "value": "7dd7189459c35adc441bc7408bf90c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121970, "uuid": "a77b3b51-01f7-4284-ab34-7dae6eb0018e", "comment": "Malware payload (Formbook)", "value": "d849acb7a1f4e8bc981c3d9b70322732277d50cb68580de406eac24327f76f2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121970, "uuid": "9b92aef8-b7b1-421b-8175-c96c8a610049", "comment": "Malware payload (Formbook)", "value": "85365cb027d099da5b407d00687dd59fe30b6e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121970, "uuid": "9ad4ed16-11f6-43dd-8768-76ca0152c583", "comment": "Malware payload (Formbook)", "value": "edb8438d142ea2a2a145fd66ca7f0433918b8f20eb39e79b81eeecd835944896e7cc90f133e59b0436236628ca999bc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121970, "uuid": "ea900073-46cb-4a59-be36-7e2daeb708e4", "value": "T1F604AE32E641C031F2B201B5F6BD0B7B4D3E09353255A0AAE3E51AE16EE49A5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121970, "uuid": "ead04203-4f2c-4029-aa61-d54726644f57", "value": "3072:bmImE9JYp/evUk3hiEkCqJrVgj8esIc1M0Rb799zoByKeLh8aC:v7AKhbtqJrVg78vVPoByKeyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121970, "uuid": "34b81597-3843-4985-95e6-602e0f8d1cd4", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121970, "uuid": "423ecb6e-be04-4b38-8288-ab9e24dc44ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121970, "uuid": "1a2443ee-f17f-46ed-aeac-dcc429af5765", "value": "d849acb7a1f4e8bc981c3d9b70322732277d50cb68580de406eac24327f76f2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f79419-c40c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707126929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126929, "uuid": "ed50275e-57d6-4f33-9f7f-c46054d0789a", "comment": "Malware payload (Amadey)", "value": "e6399303ceaa23310986ca0f5f6444df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126929, "uuid": "8b94bc51-abfe-4928-87a1-505117488dfd", "comment": "Malware payload (Amadey)", "value": "d9e82b2bbf5ef1628749c4703f5d38d74b83994cdee1712f5429af889f7c1bfb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126929, "uuid": "c7f2d86b-833b-4254-af7f-bf1cb0598e8d", "comment": "Malware payload (Amadey)", "value": "129b77939bbf5f50cb2f5f4248dd9f4416c15143", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707126929, "uuid": "05260cbd-bf01-4f3f-b76e-4fcd5149a83f", "comment": "Malware payload (Amadey)", "value": "df8ec70bfd9783a517a50f6cbef66938f66f3d5ec4c9bb5c9a3b026a9f3f0166689992a418f0866893d5646859de41d6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126929, "uuid": "bc204b6f-4781-493d-8e7c-c8995a7d0f12", "value": "T16B34AD1033D1D072D167113589A5C7B20EAB7866B663ABBFBFD61A3B2F343908A1570D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126929, "uuid": "9833ea82-4dd5-43a9-a473-d8d4cab7ce70", "value": "ebe35e0085e613a421d4abea9476d495", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126929, "uuid": "7989c938-3089-41ac-810a-192ea987949a", "value": "3072:VD5vK2O4jqKgfZ0njX1CvEuN9qQjH5nKfMdptyD6P0s4iNc:Vlv9O0jXhurjZKfMQ1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707126929, "uuid": "c595cc80-e257-4ad9-9b85-6d02535d7628", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707126929, "uuid": "71a60619-28b1-499a-82fc-6d94599ff683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707126929, "uuid": "faf282cb-6e68-4a2f-a7c7-51c43c397276", "value": "e6399303ceaa23310986ca0f5f6444df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5bf1d71-c432-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707143310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143310, "uuid": "dc8f92f2-e5c9-497b-942f-870af3788b68", "comment": "Malware payload", "value": "40c7af325dc75f0d7722c16242e97c64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143310, "uuid": "59e31a57-c47d-4f3a-9384-0d8456464e81", "comment": "Malware payload", "value": "da9f7b1b17982c66074aa17f8cd31d31f79a641b4f523bd7aaad44042ccb30c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143310, "uuid": "906bf161-3828-4f5f-9a81-95ea8813c5b2", "comment": "Malware payload", "value": "f0b06b539b63094168149b9a548f019d4f9cea72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707143310, "uuid": "86480fe5-54e5-47f2-ba5d-9d9fd20d1428", "comment": "Malware payload", "value": "6c8de32a712d8f3077b265711c49d15b96ed02829093199fd3d9562910d5946d471dfdb15f672a53dc7b89141d0ca5ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143310, "uuid": "97a5bc1e-5c67-4ed9-b2d2-12202de8221e", "value": "T18347333FB328563EE46A4A31097393505ABBBB26692F8C1E07F4481DCF625711E3F625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143310, "uuid": "208dfe39-ae3e-4fa1-9813-617285076c9a", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143310, "uuid": "8699886c-bb59-4fe9-b7a6-b396478f32d3", "value": "393216:+66SJBlyx6K/880mqEYDiKZU6ALDxJzuGJBQML2HnojSWhC4Hd1G+hK+CkeIWNYD:h66BojOLDyLN4GNL2HIhrHDPwl0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707143310, "uuid": "33790aab-4254-443a-bad4-f09577a15659", "value": 25179144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707143310, "uuid": "e90e9b2b-2d54-47c2-9fb5-de3d928465c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707143310, "uuid": "4aab2e27-398c-45cc-8203-3f6987bfc733", "value": "SecuriteInfo.com.FileRepPup.29063.19340", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c544f286-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707144142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144142, "uuid": "847b0caa-2ffd-4178-8837-e1d77ac6ff16", "comment": "Malware payload (Formbook)", "value": "74679b9a067ff8a4d6be2ecc937e17fd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144142, "uuid": "bca4ffdd-dd5b-4da8-9492-b9447b5ac41b", "comment": "Malware payload (Formbook)", "value": "dad852fa7b2f1e7bbc75af7db63e3fb3aac2ae8d955dabb6e0d8493d0b900169", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144142, "uuid": "474df5a8-9982-4a61-ad01-583ff13e0d57", "comment": "Malware payload (Formbook)", "value": "a71515e332b4166132579e8bc122769a7e8eaa40", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144142, "uuid": "165a0fdf-f366-43e7-b417-c23a44215f3a", "comment": "Malware payload (Formbook)", "value": "cd0dee510f2aa5ae534e3a2551e30def8f1c4df73c1053e5179ed01d0c3ef1034a4bdd296df8d4e1d29acef54967c74c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144142, "uuid": "efb3f3df-8326-4503-b311-1e2a7aaffcc4", "value": "T12845BE9D7550719EC9A7CA32CE18EC3097112D66831BD20F60E73CABBB7D6939A101E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144142, "uuid": "0072eae4-e488-4d55-821c-7db27ad5943f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144142, "uuid": "0256971e-7b17-4c13-8584-ff33ed727b6e", "value": "24576:23F9cxTufND6j/kHe7a7NZbBYkFZK9pkrwPNX6KKKKKKfj6:WtfND6jkD7NpBYkFmpkrwPB6KKKKKKf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144142, "uuid": "cb6c22e6-9efd-40b5-bc10-311bdf47eb00", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144142, "uuid": "1192c167-f320-4704-90f3-90d52a6ea314", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144142, "uuid": "2aac8843-4c42-4645-8780-dfa58a3ca695", "value": "DHL Delivery Shipment Notification 302474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d4c791a-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707144021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144021, "uuid": "8acdb2cb-e187-4441-ab13-c434ba3ccff1", "comment": "Malware payload", "value": "d996efb1c14ac694586c2f4867ede850", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144021, "uuid": "9653d323-612f-45b6-8097-fa72b41fff2d", "comment": "Malware payload", "value": "dae233030db8ae30501afe0f09d42a60245839e3055e0e3729d11e2331b61e55", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144021, "uuid": "dc5120f5-b264-4604-94f8-27f390aff6a6", "comment": "Malware payload", "value": "de8c23bd3b04635b9a709491cd89a010eb9cd365", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144021, "uuid": "b698dbce-0044-4d24-9de5-e39d4152823d", "comment": "Malware payload", "value": "5193e4565a179d63e7c46ed26b014b641c411313c39d48e5acdf2191d7d34b62a2d51296e1065bfaf698b230eb83a9f9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144021, "uuid": "f6751e49-91b9-49fe-8ed1-396ca4c0531c", "value": "T134112A9953781E7EC4B342B1CC355D0C89B6CCB34E4EE09ADE733588C9201A22F85659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144021, "uuid": "a2b01a26-1bd1-43ea-9394-11d60537d566", "value": "24:8rBJlFAkQ3aACaC6J6k6Jm1AOYgcEmx6O40uKITfc64T6ka320:8VJrAkuqHMxOA+r98Tfc3Tha320", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144021, "uuid": "4f3f8f35-ea67-48cc-91d4-ce17a7cb057f", "value": 1050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144021, "uuid": "85479523-dede-4d32-8e4b-4c5e88262570", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144021, "uuid": "bbad2842-4bd2-4574-b428-f21662350951", "value": "598255347415042.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf53cde3-c3ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121395, "uuid": "959f6fc2-3dcc-41a5-a41b-470efd57b6bd", "comment": "Malware payload (Formbook)", "value": "86cc523dc15e1863e3afdc66d64262d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121395, "uuid": "ee7eeece-115b-4217-af88-a18cd51ab9e7", "comment": "Malware payload (Formbook)", "value": "dae7c8ae10158c7be9ae7a115ea9b8fd40b6d3f85cace0cc10feb9ae8d8539a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121395, "uuid": "0bedca69-b648-40cf-abb4-e2ffc76368b2", "comment": "Malware payload (Formbook)", "value": "9d5b31adef80a7c4bfb84b0b07717fb1786a4552", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121395, "uuid": "44b39f51-cbe0-4e9f-8904-940112b8f237", "comment": "Malware payload (Formbook)", "value": "8d339617bcce4292b315804b377ef8300507580c104bf89b9e08dcf4bf869b38c18ff4cb626a690e94b354e3b14f4e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121395, "uuid": "c6e9cdf3-142e-4be4-9678-12e3fd347194", "value": "T157E412A537F91F2BC47CCBF425A6C54983B1B56FA522E61C5FCAB0DF5826B004B02A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121395, "uuid": "b2ad5279-0888-4d7b-afeb-ad9103822310", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121395, "uuid": "954c0821-c653-4f8f-afd4-1d2ce241c4f6", "value": "12288:9Nd53rD22qXLGzsvYisr3CtK5rb+gh9GDdTzuNwp0CdnVC7nJb:/rDkyIv0rF3pkDJ0m+nJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121395, "uuid": "9502969d-bead-44bf-9bd0-3399fa85e807", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121395, "uuid": "a8c63b39-b94f-41a4-9bcf-09a9bd8331f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121395, "uuid": "1c17d240-aa18-4d7a-956d-7b8ee1c264af", "value": "REQUERIMIENTO DE COTIZACION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16dbf62e-c441-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707149433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149433, "uuid": "b254a478-8fcb-4080-857f-d11870d7815b", "comment": "Malware payload", "value": "6a5b77f1d6d55fced8743a30c1b9147d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149433, "uuid": "9b1bd7d1-e754-4436-902f-8ff5ae803086", "comment": "Malware payload", "value": "db21c9807badf4f7f01fcf3fae5c1a3bce98cc8edae652708fa3a0b025ca342b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149433, "uuid": "6d00050c-193a-4c41-80c8-5e1f1a4b7d91", "comment": "Malware payload", "value": "ab8b9002ee817def51039474331a3471e89be232", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707149433, "uuid": "2ab60fcb-ad27-48cd-8f63-96331759fcd8", "comment": "Malware payload", "value": "fd9be7bad0cd74f92b0119942217377353111db0b3b58e6a1802d6c3acde01228f7efd8191cb1440273a6d3073d706e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149433, "uuid": "2e3ec658-3b34-4143-9c68-130bf032743c", "value": "T1AA23C75423F94A26E3FE2FBF2471614443F0B613BA12E2490EC2B4DF1A62B555A05BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149433, "uuid": "a5d71843-9639-43b4-826e-eedb4838b86d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149433, "uuid": "57e44752-4ef7-4b11-a0f4-82758456d974", "value": "768:G+Wc1vwiROs1l7m/qpLcE8YYYAze/mU7EnkEcliMr/m9BOk:G+WGwHsmyVcE8YYYbX7FEcl3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707149433, "uuid": "4e1b6bf8-eefe-4355-a70f-8647ef129d8f", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707149433, "uuid": "85ce9152-be6f-48df-a44a-829bcfb06ea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707149433, "uuid": "1d32326a-e15c-43a7-b23a-88f2a59daf9f", "value": "SecuriteInfo.com.Win32.MalwareX-gen.21003.9129", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484dcd18-c3c1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707094540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094540, "uuid": "c9b0dce7-66da-4a71-b57d-29c045ae052f", "comment": "Malware payload (Mirai)", "value": "175bba4d7e223524a0a0f9733dd19a4b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094540, "uuid": "ac41de1c-b5a7-4897-a43a-797565beebda", "comment": "Malware payload (Mirai)", "value": "dc49989cb81738d610644d2026af432284710e2c3bc40e7a85e78d2fd406ad75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094540, "uuid": "aea6905b-0c8b-4b58-9d1f-e27d6df2f844", "comment": "Malware payload (Mirai)", "value": "e5f5987ead0d94444eeda64cf19ee40f5d2a1345", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707094540, "uuid": "7fff5270-0ed3-4a29-8cdb-fe13b99b3d81", "comment": "Malware payload (Mirai)", "value": "223b4207cc06175dc813b6d05e3514e60ec2c35a62cfe065ea686823f0fa4d06a4ef064350d0a98898eb8feed3064e68", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094540, "uuid": "b36b3531-2f83-4a55-882d-df24252052da", "value": "T1F9E33C56EA418B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094540, "uuid": "e4b14581-5b83-41d3-be92-d9f860de7cde", "value": "3072:yJTc2PBSpmW7Oabvzj4dlRsh8ZQIld8MXkkTM/9zY:yJTcGqOabvzj4dLsh8/8MXkYM/9zY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707094540, "uuid": "a3eb6107-297b-4174-9aab-05f6258a96ed", "value": 150602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707094540, "uuid": "45862895-1204-45e4-9b58-28fc6e1942da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707094540, "uuid": "c5c65654-94d0-4cbe-a637-c21f4a08b8e2", "value": "arm7-20240205-0055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9aa0165-c3ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1707121332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121332, "uuid": "c6086293-ca0d-4229-ad52-8b7c1162dd23", "comment": "Malware payload (Loki)", "value": "0eee6e310c55572d197f030f6fb849ba", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121332, "uuid": "b691ce53-6843-4397-be79-fc5696b1d35e", "comment": "Malware payload (Loki)", "value": "dc6d10422342653005d2281868d6f2c818ed4585740e4db3d06df36ae415f31b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121332, "uuid": "7842fb29-f49e-4091-a05a-ef9fdbe9e281", "comment": "Malware payload (Loki)", "value": "6c1da0029f1a4a87fa6063631a9c7717efaa5444", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121332, "uuid": "d24649cf-027d-47d6-8e2f-358578543e05", "comment": "Malware payload (Loki)", "value": "5b4adfb47beb57920b8aa11dd5a681709830b0d4123bb206bc876b53303b67d9620a9fbd1deaadbfea95b58c78fda1f6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121332, "uuid": "1124de6f-67ce-4f12-9da2-8113e9c71388", "value": "T1C5938E6DD34B01698F621337AB571E5442BDBA7EF38412B1346C437933EAC39A1252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121332, "uuid": "a05ebf29-7752-4700-86e8-1fc281fa1a60", "value": "1536:7wAlRkwAlRkwAlRdwLWvq8TRBSXcHq+lp:7wAlawAlawAlvw6vq8NzHq+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121332, "uuid": "4356b841-2c63-4595-9093-9b0dea2ed193", "value": 95271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121332, "uuid": "23cb3494-cd4d-4002-be5c-7fd0e7263b83", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121332, "uuid": "15cf5f39-f636-45e5-ac94-46413b753e89", "value": "DC-Parts-12C61.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016507a8-c43e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707148108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707148108, "uuid": "63331b85-25f4-43e4-9ec0-a53fd168dc9e", "comment": "Malware payload", "value": "09d900d9fc2b25e6b2e4f63b5e608079", "object_relation": "md5", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false }, { "name": "TA4557", "colour": "#D1911E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707148108, "uuid": "8b09a17f-51ee-4360-bf3f-54ba21ad49ca", "comment": "Malware payload", "value": "dc8727083a4663a810525915039d21733f1fbca2926aeeb19f0815ef849f3056", "object_relation": "sha256", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false }, { "name": "TA4557", "colour": "#D1911E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707148108, "uuid": "7d7b5e29-3f70-4578-99df-77db317b34cb", "comment": "Malware payload", "value": "05fa1fb457595ced5901db8906870c6f1cd60e4c", "object_relation": "sha1", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false }, { "name": "TA4557", "colour": "#D1911E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707148108, "uuid": "71bf1102-0ea4-4cee-b982-e8cc8fb3d0ed", "comment": "Malware payload", "value": "9469c9a935f94c6a8d17b2e9eae0ad81c5010e32ac9eebd8d38ff311a6e067d6890ebdbafd8bc1e65e424077f74c51f1", "object_relation": "sha3-384", "Tag": [ { "name": "More_Eggs", "colour": "#238A65", "exportable": true, "hide_tag": false }, { "name": "TA4557", "colour": "#D1911E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707148108, "uuid": "75171171-7ac7-4f6a-b704-e2dde83ed2c4", "value": "T17D74F0A78D09275C5C74532CD72E9E25EA8009139C4ACB453B9D9FC5AF32E72C3A9CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707148108, "uuid": "0e86f490-c8fd-4fee-ab68-e88d2383eecc", "value": "6144:PY1k6MB13n77UN4AHaSECqCPeS2nG+mQkFVsBTrsqBL4xMK3+ZH7yQgBV/L:jBr3PYPl76C2OCLKf+R7yQYVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707148108, "uuid": "59a46591-7f43-40d5-9eb2-3d66e8c64ad1", "value": 356164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707148108, "uuid": "10a791b6-22a1-46ed-86cd-23d1a7de3f4e", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707148108, "uuid": "e4ae18d3-dd49-48aa-8118-f87f21bfe496", "value": "algj34s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d12b8bc-c3e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707110520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110520, "uuid": "eeb3783c-6235-47a8-aa3f-64c34a9e7785", "comment": "Malware payload", "value": "86c5bf05043374f9e2a9a726ffaa7acf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110520, "uuid": "34475a23-622a-48c3-9ef8-c84b0b78a2e9", "comment": "Malware payload", "value": "dd04bc0361d35fce36861caff8c098856a99cb2c0c1288145c460198bc1c0c4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110520, "uuid": "9d45e8af-f8d2-40b8-b9f0-2ff24c0d5bf0", "comment": "Malware payload", "value": "7d401abe97f43a1eefc9a0080583d138f32a41d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707110520, "uuid": "a902d188-66f1-46fd-9a2c-6a396a256ec7", "comment": "Malware payload", "value": "1772daf7d7117581486222460e24e09151694945672256f66d2f3dbbec8a7478ad784711e3f82f23833cc65d62aa52d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110520, "uuid": "838fe27b-04c6-4392-a1e2-949d7991462a", "value": "T1E5F59E11B6518122D8D300B7D7FDBB7D4929693433B944EB67C429A52C303E2EEB7B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110520, "uuid": "c238dd46-54c2-4eb3-94ab-b3cb7dfff7f8", "value": "0636fba589960b706a9df19d2f4ac59d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110520, "uuid": "f62ed504-432c-4ba0-bfde-973ee97ca8c4", "value": "49152:2OCOmzqbqKqNkLm2h/wJsKTruy3wrgktVic3HDz5DMcRc/s+kobXnz/q/xnd/c/T:+OzqrkL6ruygrjVic3HJCfgqFjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707110520, "uuid": "f8692a03-a1aa-4453-8020-ef8a9ce7a46f", "value": 3490224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707110520, "uuid": "6db3f20f-f507-4b6f-914b-7917b7c9b2fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707110520, "uuid": "69d66942-b55f-419b-af77-527cf1423eeb", "value": "SecuriteInfo.com.W32.Sdum.Z.gen.Eldorado.25863.2561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93dc285-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121761, "uuid": "8ffbad10-5429-433b-bdb9-d1725ea32f8b", "comment": "Malware payload", "value": "8bf3b8190be52706ab644c22e3a6c7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121761, "uuid": "bfaf21ab-27c9-4342-9de0-bd2d59a710c6", "comment": "Malware payload", "value": "dd657507c7a1e539b2b27f4da9cd7b3ab4c34235fdf98a4681c12bb40131b43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121761, "uuid": "a68b01ba-5918-46d0-a64a-ff33a5f0fc82", "comment": "Malware payload", "value": "0478a93010f2a54ac1f6402b6f5f53f17f964815", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121761, "uuid": "70b3a517-18bd-4461-83f6-1ee89d5de923", "comment": "Malware payload", "value": "e9c88adf9e7ef50cdee25f74c876e3d0c832a37b901be19816382ea31c9a4993f119ff7bb3e48f4a9cf1ce53c9558630", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121761, "uuid": "e886c5fc-f40a-4802-be2f-cd485018b108", "value": "T1FAF4F7D6869A8210EB5F517AC992073BBC04B4F3536408E7254BD6236B18EFF71F9DA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121761, "uuid": "53eaaa60-7a0f-4832-8222-217aea4b00f7", "value": "fc7bf335bf51ed3b7e16d44bf5b35838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121761, "uuid": "ab938131-e3b2-4568-8eef-e153f4f31e77", "value": "12288:jp4YkeTEbiY0ylbToiJfJulj1CBMeIFjKuQdGhSaApNrWSvUghmjpoVb3/k2JPQq:GeTm0yNToiJfJulj1CBMeIFjKuQdGhSq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121761, "uuid": "133d5979-12b6-4180-9e08-aef1ac7e73b9", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121761, "uuid": "9f79c798-eaa8-4ccc-8658-fcd909b6dbd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121761, "uuid": "d9541ef8-3b36-4ecc-8ab6-f8d65a8f4b16", "value": "SecuriteInfo.com.Trojan.KillFiles2.2471.17424.27552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e0fd16-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1707144433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144433, "uuid": "b8b88bab-8e2e-4ed3-884a-5a9a2e6f7e83", "comment": "Malware payload (Amadey)", "value": "2162b919de8069612d4857f947f4dc56", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144433, "uuid": "1a797d58-69ee-49ee-9b4b-879efb10d255", "comment": "Malware payload (Amadey)", "value": "dd6a120bfbd75b5db0800585471e7ec52913d4fda536182f253eac5198a67440", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144433, "uuid": "b707c844-8724-4db2-9799-d0005bd6c2d1", "comment": "Malware payload (Amadey)", "value": "56e4d8ff13578c83d546e118527c1a4c74ffa44a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144433, "uuid": "6cc60ab1-b011-4874-8b41-4a931690716c", "comment": "Malware payload (Amadey)", "value": "82721c6fe12efb07e4e093f0f85ddd8b47f0d6f88065300ad82414f788ae0f65e39837632e51c5a194cc7acb098ee2bc", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144433, "uuid": "485bcd4c-49f2-4443-a1d6-35eaa62b5c7d", "value": "T16646CFC57AE09E1DE34E1B36C0A2001593F2E68253A3F71B2B9663AD7C137545E8D39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144433, "uuid": "bf62de00-f736-4497-8f51-83ae835795f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144433, "uuid": "c50b80b2-b4de-40af-b669-8a274d4e51aa", "value": "98304:7ZO2V0LfgsKCC+ixAcybJlzibXBBDql69wF/:7ZO2V0LfgsK1+ix2XsLql69Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144433, "uuid": "4c333b2a-b68d-4d1d-8a71-6cb1d69ad1fd", "value": 5616128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144433, "uuid": "58f570f6-31ac-448f-98ea-04657d464f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144433, "uuid": "ac583079-27c4-46e0-a354-3242c9b6b4f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52eb7265-c3f2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707115603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115603, "uuid": "8475e2c9-bfb0-4a9d-90ea-670213294aa5", "comment": "Malware payload", "value": "b2474e803fa38f4e0ef97b4d3022371c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115603, "uuid": "de1fef89-0b3f-4313-b3bd-0c8ca8b7d590", "comment": "Malware payload", "value": "df035dbf1a32469699c8c8b3c04b49ab8aad5ced1e874a1c21b918e1c606d797", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115603, "uuid": "4acf55ba-b754-42cf-9751-342eaa5a61bf", "comment": "Malware payload", "value": "9f61926a398825afb4ce1b43c1f9677660248356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115603, "uuid": "9317189f-7e94-4be7-8f88-c2534d51e4b4", "comment": "Malware payload", "value": "7e60399505c1c2a2f073bd1076639517288763ce10e147b9319e831898ddea269a267ff521db5fa2d9ebbbf13953bee4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115603, "uuid": "ecd074b5-37ae-4cf4-8a4f-84c0d23da0b9", "value": "T1B1947D31F6EC81BEC023BC76B8E25C08146AB5D9063D1937FDCED9652AC49F472A8974", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115603, "uuid": "44f64aa3-504c-443e-b7ac-407b0d291616", "value": "382a4d7b99200ee7e9686d1f1cde0258", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115603, "uuid": "c9c8a0b1-3b96-4fb4-b273-2511d25b209b", "value": "6144:XIf3p8R7PnmgV4FR6xQuId19qazA/vQE+b3Q1Cjqi0:YfpyPnmgV86xQuO+azpE+m80", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115603, "uuid": "6ea709e5-31f6-4260-a1d9-52f8a9f56582", "value": 431616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115603, "uuid": "38470b6d-0fe1-4be9-b81c-18afa3105564", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115603, "uuid": "520b4814-7ca8-4f2f-9731-1945029d6f39", "value": "b2474e803fa38f4e0ef97b4d3022371c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e215267-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707122011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122011, "uuid": "16bab060-1d72-4697-a66c-2840f11150d2", "comment": "Malware payload", "value": "4b2f56c71a2cef595b129f4ea6d6524b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122011, "uuid": "91106d4d-c3ee-4563-aea9-ee9a27899e26", "comment": "Malware payload", "value": "df1f49f2cf6753b8a154c97fc5b4edcdefded5a4c12cdee5fcd4dc7b648cf1d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122011, "uuid": "8bd5fd89-b390-4ab1-b3d0-9b97f6eb8db8", "comment": "Malware payload", "value": "9e1b0414aa38354150a18490a7c49e581a3dd042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122011, "uuid": "958c5c9d-98e6-4523-a366-2a9e2d727460", "comment": "Malware payload", "value": "2ab2f2f58463b56761d906634689d8495096223b7fb416ea0c3b4aebdb76f6baae0624878092b50f823b8f7ef4793b43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122011, "uuid": "9b9fe46c-c7b4-404f-ba8b-a196aaf827fd", "value": "T10FE42221FB394B96E83E23F80652550853F2A69BB566E32CFCC631E71565F01CE50BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122011, "uuid": "c8cdd23d-cdcc-4753-963b-22597d19a29f", "value": "12288:NED/qNN6uUXETiT6cRh6EX2dEsoN6ec1pFyWQSpzcwZZnlho578ow94Qs5:+TsN6rKiT6whfX2O9N638WQSpbZZns4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122011, "uuid": "7f75e2f6-f7c4-4451-93c5-d612c79f7ab8", "value": 706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122011, "uuid": "8affc2ab-2870-492a-9b5a-5324d471a3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122011, "uuid": "736d5502-7817-48e7-8e9f-d41320f0d00b", "value": "VTYPA6cIW9IHyVa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d22fc51-c3ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707113795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113795, "uuid": "26efd8f5-41a4-4ce5-b8d0-773da9ff1f78", "comment": "Malware payload", "value": "1c668f5d6f2054ec8e0598cab1624cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113795, "uuid": "dc70fa96-5b93-4b78-904e-f4e20fbc47b7", "comment": "Malware payload", "value": "e03d030e1ba3c05547deeaf7d0a0af745ea33020055f0597500d8d7951c2d9dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113795, "uuid": "b3520c2d-93e2-4a2e-ab25-55b336618d38", "comment": "Malware payload", "value": "690db671d045042d112c8f3d3a29b9a5d4c41758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113795, "uuid": "74bd421d-4443-49e9-ace8-5bb94a9fd2a8", "comment": "Malware payload", "value": "56ced9b70357c54e1fd45957b1005f2a443d38c70111883e6a266410d20044e93b7959344c2750c631bdf06df1cdc51b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113795, "uuid": "1e0b8c54-6b02-4524-b198-47f31ce5d86c", "value": "T1A436F1B758150652E66C297CA41820C8350C93F689DCEFC5BB6886B7A7F0B7562C07FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113795, "uuid": "f979672b-9a61-4113-bcd4-656639db1924", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113795, "uuid": "aced99bf-585d-4115-b56f-e4cd41c96a04", "value": "98304:FZC8GIY9g7PaSBiiwZclBdLHEzr31un7toLAWoB0BF:F08b7PLIiIcBdLHWhuuMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707113795, "uuid": "12caa5f2-1774-4f73-8698-bed62c56a8b6", "value": 5267456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707113795, "uuid": "4372c0c8-7420-46db-9898-559d8ee5ece1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113795, "uuid": "29fc1af3-9181-4a49-8afc-0d546f3c43c4", "value": "Shadowsocks\u5c0f\u706b\u7bad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32c08d9-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707120462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120462, "uuid": "6863ccf7-7f88-4e4a-9aee-e7d78e6606e9", "comment": "Malware payload", "value": "cef7291466073d94ae47e570ac61462a", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120462, "uuid": "92481153-f22e-428e-b0ee-1f1a0bd40d4b", "comment": "Malware payload", "value": "e26a3c855f14e0850e19a9cdb8fb82c73d030f4db9a8d3ea576f301b00329b6d", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120462, "uuid": "522863b5-14c1-406b-af2b-0ccfae6464a9", "comment": "Malware payload", "value": "8bfaa145271a664c2f16d628a69a6c945b476cb1", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120462, "uuid": "015786a3-c8a1-4fc2-aa70-cb04c01969c8", "comment": "Malware payload", "value": "c8f6946629d8fce5b7156eed13d8412f1868c6f1a73eea97d7624aa0e28dfd2aec86c74e1232cd9dd7ea0b97158b0fa5", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120462, "uuid": "e9328aa9-693d-467c-a9a9-529bdd7c8872", "value": "T13411E186832B1B40D2591AF2530B32D8CFC543D60686E79D7D091733891D1D3EBE36BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120462, "uuid": "54f66bfc-7a5c-43d6-9947-4e02614cf606", "value": "12:5jQw0iFHgGuSQ659y+FQYy01mc/QG36KNUwb5KIGjK5JZCPA5O1sCgfdFHrPw0W9:9/0GuSb10WQ+6KNh1KIGj0ZYEOOiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120462, "uuid": "16f51cff-2314-431c-adf2-6dd2b31b7caa", "value": 1057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120462, "uuid": "fe9f5841-a640-4851-a65b-41728a34dc01", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120462, "uuid": "859e19b6-1d09-46e2-81f1-bd2891e54f66", "value": "RLDTLLRLDTLLRLDTLLRLDTLL.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7337a3aa-c468-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707166338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166338, "uuid": "85345643-3a86-469d-9788-d15fa7c9711f", "comment": "Malware payload", "value": "f63665d934a38baf96ab5a9efe1d31a6", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166338, "uuid": "7923c1e9-bfd1-4bb0-b7c8-2195dbb6e43e", "comment": "Malware payload", "value": "e34617f6a521e27c8d951a7de3500c7d9b5a267ec9643163497e96b36c3eff62", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166338, "uuid": "c82d97ad-0cc8-4753-9030-0a94dcf72ae9", "comment": "Malware payload", "value": "501f3f72f12d6c2accbdd8ca26fd163568d442cb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707166338, "uuid": "92323038-5849-46c9-8f4d-1927909f9d78", "comment": "Malware payload", "value": "66eb8fcfe6de9340e8d174dadc89f674e2955ec21eeba2c313bc1e2d92b425ac0b2a89d01a5841fc295c2df10038d99e", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166338, "uuid": "6e3ec869-2099-4916-a1ea-c03d66e5ab3a", "value": "T125672261F7DBCA26C3B75239463D2D3756268CD542C39687190B3A28047BFF84B46ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166338, "uuid": "21627bc4-9a1d-4c95-840a-4e0ccd972c44", "value": "786432:miW9Sl1SyTSgdZVEkCcIJJoantKous2UwmLqrENkM:uSx2gXnYoantKous2ULqrRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707166338, "uuid": "f132e041-f905-49b0-92d1-a882ad73b6bc", "value": 31842939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707166338, "uuid": "e949b15d-4e55-4ffd-b030-8ffc9c783d2f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707166338, "uuid": "144628e9-f5dc-476a-a2ec-5170f4d053fd", "value": "metamask_pro.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27aee4bd-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121973, "uuid": "25901a72-0b7a-437b-8870-65eeef8b08cd", "comment": "Malware payload (Formbook)", "value": "739eb909ca41243d9c1c65fd4b275347", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121973, "uuid": "06ad80e4-4a34-45fc-bdc4-541a3f9a1538", "comment": "Malware payload (Formbook)", "value": "e4ea5ee7cbc31f266f1983f5b050449ac24dd6928fd4fc477da2542e994650f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121973, "uuid": "9f627a0e-fa65-4ced-86e2-ea6fe984887e", "comment": "Malware payload (Formbook)", "value": "376d383ed5b1afe19a3bff494164b85fe12f85e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121973, "uuid": "e456d63b-66ac-454d-b3e3-327aeacf351b", "comment": "Malware payload (Formbook)", "value": "403b5041dccfe5eec1803455242c43fe8e5d8ecfab373970959300919fd4e7d0ff8ca4c9aece481f25f9f2319dab1e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121973, "uuid": "b7098ecc-f726-4673-9ce9-8346b9a35114", "value": "T15704AE36D602C030F2B215B5B66D1B7B883D0E357294A4EAA3E12AE05FE48D5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121973, "uuid": "490c4c22-7f65-481a-8e6a-888cf74b41ae", "value": "3072:6h5MEfXo5Fwd38wi8kHaJ47Qxp00CABkW+ALRYpnz:6xFR8b8QaJ47Gp0BGkW+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121973, "uuid": "a7aef488-b763-489a-87d4-cc3172b61d56", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121973, "uuid": "592f2b78-e821-4d93-ba1f-881807a3ba79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121973, "uuid": "cd8adaf8-c662-4b45-83cc-a23ef5895f9b", "value": "e4ea5ee7cbc31f266f1983f5b050449ac24dd6928fd4fc477da2542e994650f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd8d144-c424-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1707137126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137126, "uuid": "c85c61ef-93fb-4cc8-aed0-b78921706c0d", "comment": "Malware payload (CoinMiner)", "value": "45969dc341d9299c070e79f350e18f25", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137126, "uuid": "3d860708-24fa-487b-811f-e844f3183f23", "comment": "Malware payload (CoinMiner)", "value": "e4f3b0ce445afa5e9aca82f24a9c6af3efd33134dd4c56ed0bfe424abacf0514", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137126, "uuid": "8477a464-b17b-4c4f-a395-1be74aa8bfd9", "comment": "Malware payload (CoinMiner)", "value": "eae733904f51c027a9d5a5e2358f5a88e06e1785", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137126, "uuid": "162fc679-28a0-4344-a50e-2481156e7a73", "comment": "Malware payload (CoinMiner)", "value": "fb3340783ce5447cbf01800f2582a5792c5d8008fd96c625ac94dacf283c192c2ae1590eef4fd54e832d0e826e127e30", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137126, "uuid": "4d64aacf-70b9-414d-ac6b-4dfde71bed64", "value": "T100764B03F8A634FAC5BEE13582519322BA7134A943313BD7DF9496A91662FE0763DF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137126, "uuid": "ab6b4cbf-b2a8-4cdf-9830-ac135fad14a0", "value": "6e2b8a2fda32523621268a4d0670f390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137126, "uuid": "4be226d4-6514-465b-a0c5-ca91ce82b210", "value": "98304:HgtAhhNfXK98lFZOYhjdrT54ZG7qI0WTiXD/cNe:HgtON/KelFZOMRYG7B7TiXoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707137126, "uuid": "a9cc2d60-536b-4479-a040-d53211aa4c8e", "value": 7710208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707137126, "uuid": "e06a7777-c453-4177-ad8b-88a5e9dae341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137126, "uuid": "7a1e10f8-e2f6-48aa-9293-5d81dc5cb7e0", "value": "SecuriteInfo.com.Win64.Application.Agent.OC4RUD.27595.27519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e91501-c42f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707141732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141732, "uuid": "e9471482-2703-4e95-a22f-5bd49f30010d", "comment": "Malware payload (GuLoader)", "value": "63630178c8d73540c9df22fa0bb02b5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141732, "uuid": "24b8de6b-a6e3-4ce8-b4d6-7e596439e6aa", "comment": "Malware payload (GuLoader)", "value": "e556aa9afdf40129baddcbc31178553b8d2c43594e81dbf8ce90deb70d95c047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141732, "uuid": "e1963369-4be1-409f-952c-19a1f8ab6c1c", "comment": "Malware payload (GuLoader)", "value": "9052f35da80c91d79e546dd9009950bee9153f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707141732, "uuid": "5e3b9be9-56d7-4d01-8aa7-e222ff76f24b", "comment": "Malware payload (GuLoader)", "value": "0d46dcbf307c881cc5802667392c2c87b5bd5b664a3212aeebab08ecc25ec23c98e51bcf0419c33a9ac626946360e916", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141732, "uuid": "e9d5b0da-054e-4b2e-9ab3-418c83514aa9", "value": "T18325E081E2DC8696E4A3AF7244B79E3295B736BC94F4451E199CB6323BE3353002EF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141732, "uuid": "f1db736e-3f30-4a8c-84e9-0bdca6b93817", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141732, "uuid": "730b4044-6ff2-49bc-aca8-decf9eec400c", "value": "24576:5+avBXTCaZRgaQ1NREePioSAaowpfZvUhoJ4B/F3YdgDmIcT:EavBXT41BtSLowwhoa19YdkcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707141732, "uuid": "b26f76d4-1c03-45d0-8dca-70cfff98b022", "value": 1040344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707141732, "uuid": "ea3ef218-fcbe-4659-ab17-0769601280b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707141732, "uuid": "21f5a02f-d4ad-45bd-97e4-13b6b5c50de3", "value": "rP22783319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2877e444-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121974, "uuid": "e8e8e2b2-e53e-4000-8f72-2ab0c41a4750", "comment": "Malware payload (Formbook)", "value": "c3c83919b81f234d76c5ecdbb548fc93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121974, "uuid": "6be2cc12-810c-43ae-b9f0-2351f35c995f", "comment": "Malware payload (Formbook)", "value": "e6a462349a069f73fc1c7e22d000946aa4309482a8babcab333aec8b4883fe76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121974, "uuid": "eb7d0401-0c27-4c0c-8cfc-d977575922ba", "comment": "Malware payload (Formbook)", "value": "8ea9253d217ed5c0fa013c7f295f1d029e4e5270", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121974, "uuid": "1a6e0c10-1702-426c-87aa-70d5d9ff0c3b", "comment": "Malware payload (Formbook)", "value": "f8d4896c8dd3f5108452b44ece2b98ef8b145acccecb443302d7a0c22418b15ef17814b7a74a534520fb838493847275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121974, "uuid": "65203ac1-8b93-4273-a69f-8c6a5278b96e", "value": "T1034422BFBA314314D4705AB17CFBBD8098A159955FF07F8B26220A5B3910A5730DB9CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121974, "uuid": "f5623f91-9117-4f96-962e-af9ca24a9f27", "value": "3072:AzQ4w+olGpAruGyxPPjU9W4KeaGct3JWLE3P9m+6+UOCmFC17HZTZfisy/nUBi1m:5zuArufczKycZbP9m1meZfRyl2+Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121974, "uuid": "cc95141f-cb9e-4ca8-84b0-e64352a02549", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121974, "uuid": "57869b34-c1e8-4abb-a1e0-f195fafdef7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121974, "uuid": "f760ea88-cd11-4e5a-936d-90580b4ccc6f", "value": "e6a462349a069f73fc1c7e22d000946aa4309482a8babcab333aec8b4883fe76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67c2069-c413-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707130051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130051, "uuid": "3bd0b733-83cd-4cc9-8212-6bb0e9eb0911", "comment": "Malware payload (AgentTesla)", "value": "25f6109857b281a37a39c2f22d112e07", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130051, "uuid": "3162964f-0955-499a-9e96-460fbea646e4", "comment": "Malware payload (AgentTesla)", "value": "e70e1bd882581b134cb393096ef6121439018a1cbcac26010527ae5093d3d4ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130051, "uuid": "72180c46-cb31-4eb7-8cb7-1391e490194f", "comment": "Malware payload (AgentTesla)", "value": "8c06711d003e7c0210b435e846721e40fdf9d37d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707130051, "uuid": "02b1f443-37fd-4ec1-af8a-2f8788b06052", "comment": "Malware payload (AgentTesla)", "value": "7caaf5b2ca48b85c7041b7d14ea278b562bb207a9ea5af5f1354c2870d8b248ff99b2f09332eb02cadbcad26b895426b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130051, "uuid": "c5bf506c-4268-467c-be6e-02daf577bc75", "value": "T178442EE1326C8383D0A19DB14FDB467067F139AD98F0520C75F9AB1E97D2392588CAED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130051, "uuid": "6f99a86d-6824-49c8-ae65-ed014d254fdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130051, "uuid": "735fda89-487a-4262-a0b1-536661db54d5", "value": "3072:ftuUShn284yhItQxkEREfk/CS+9wqY+mhhhmitqOK3rTIXAJ:fkLh2PEvxxekFKicTqAJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707130051, "uuid": "cc83a89f-5b93-433c-8570-cd5d33cb416f", "value": 271944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707130051, "uuid": "f40cf0f2-6446-4dd8-af42-f6c627602f27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707130051, "uuid": "b03b647a-b30b-4317-a519-e80041008ab2", "value": "QNHbH77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caef4d8-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707121981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121981, "uuid": "c1bd7168-f989-4910-8d91-2961ff30064e", "comment": "Malware payload (AgentTesla)", "value": "089d07c80de6ab0480343b8fd274c3ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121981, "uuid": "81b257ae-0a50-47b5-89b1-5149006128af", "comment": "Malware payload (AgentTesla)", "value": "e7cab83d92e13519faadc1c7b96fc9f5d0f1a5b124e3e7b0042b0b30d7d4496d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121981, "uuid": "3e50b3d9-1994-436e-88fc-9277fca0a168", "comment": "Malware payload (AgentTesla)", "value": "760df3adeff27f9016e55f93692aebab725f9297", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121981, "uuid": "e7658f0e-f235-4d4a-a929-da261e9d8b0a", "comment": "Malware payload (AgentTesla)", "value": "ad2770af3cd6d141285d6aa7bbbf3d4a34ff250a28531acaaf48ead626b68e833c5a1b2a24dd77d8186f661e95c2e5f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121981, "uuid": "4760ebf7-6e5c-4c52-a0ec-9f1c78ac6366", "value": "T146458DB36399D0F1FFA6A1736A16AD26477C79AC10E3841E12DC197BE83406253FD263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121981, "uuid": "fbb4877f-a928-41d3-948e-d4eb8866ed3b", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121981, "uuid": "430fb958-c65e-46cd-b352-f8a2665c949b", "value": "24576:5AHnh+eWsN3skA4RV1Hom2KXMmHaqBhMS7KOwnS5g5:Ah+ZkldoPK8YaqBh70N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121981, "uuid": "65c57072-d140-4947-ac41-b9f637b33578", "value": 1196544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121981, "uuid": "3e279110-83eb-4521-a0db-0d11f847b13e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121981, "uuid": "f22b13df-72a0-4040-9f98-6d6f2eb5846f", "value": "MEG ORDER C-2227 450002 20240130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c662bb-c40f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707128308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128308, "uuid": "2c5c5d85-a386-4814-a1c5-7a9e7557b9e0", "comment": "Malware payload (Formbook)", "value": "ea69a8b918950efe927622cf68d789c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128308, "uuid": "7d5c9e86-a3ad-4317-a89a-5ecf0ded1014", "comment": "Malware payload (Formbook)", "value": "e7e75eae5d4bf17651e97bb0119c666e8db5c4f52fc60e5bf9d3a55155c2dd47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128308, "uuid": "ef3bd23f-f771-4c21-8898-3466963b65b7", "comment": "Malware payload (Formbook)", "value": "8d5a236ca0c4d8c270a9c96356a16afffb4874d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707128308, "uuid": "4a4885a2-8e95-4753-bfdc-f2b85ceb56d3", "comment": "Malware payload (Formbook)", "value": "ddca8294bdf11fd4675f980aada213a808d32b9d565557970043aead99409a973bb146dc2e6bacf32476464383f46933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128308, "uuid": "3f5cd3ef-2262-4988-aa29-a698a5dc3acd", "value": "T14F051214742C7A67C8BF0DFA1C52A196C3748572AC87F7D78E8370D5AAC9FA4520168F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128308, "uuid": "34772308-b6d7-42a3-88de-8ad8318fcda4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128308, "uuid": "55d51646-ebc3-498d-a208-8878533cc8f6", "value": "24576:VV68yq0N4aPT8Ul2tct07v053bxJ9c4cx9cxS6P:VVsqC/P7T07vu9FcxJ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707128308, "uuid": "deb36a13-57bf-40f2-9dc7-84f9777009d4", "value": 805376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707128308, "uuid": "44da057b-b596-4eeb-8c21-c87621c3e9cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707128308, "uuid": "02cdc1f5-ad8f-415f-995f-0a3805573989", "value": "SOA.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffd441e2-c3f1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1707115464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115464, "uuid": "bf1e06d4-7e8b-4740-aca1-a64f144a3e36", "comment": "Malware payload (Smoke Loader)", "value": "214051e018578d46257d8fe3264f8f0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115464, "uuid": "cf11e932-8431-47c3-883a-0a6953c87632", "comment": "Malware payload (Smoke Loader)", "value": "e8111bd4b0bb54850153fd0e3365208be0be25e44c9fe2931eb0e9e05b878b41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115464, "uuid": "9d8f3ac4-ab8f-4aec-aa19-018816b73551", "comment": "Malware payload (Smoke Loader)", "value": "4944ce17a13862fd7708b241986903ed383f5100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707115464, "uuid": "9bf8d482-dcf2-4039-b258-991762a9f4c7", "comment": "Malware payload (Smoke Loader)", "value": "ca9857aef9885ed7ff7598a9ec5e7964a72366cbfa1013cb289715821eb54635fb81ef51827593914e6de6073df3383a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115464, "uuid": "c4fc554f-2812-4f4d-a2c2-e037f42c3fb1", "value": "T18434AD1023D0D071D1A721358975CBB28FBA786276739BBFBFD51A7B6E347908A24309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115464, "uuid": "63fa7f85-5c5d-4357-a6dd-ed7e916dab46", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115464, "uuid": "34dfac12-9793-404b-ac11-eae0836f55ec", "value": "3072:97uOsKcdFdzR/9sA+cqRLogGXz5vib/8WrOoGbs6P0s4iNx:9RcFdzR/9sA9z5c/8iO5s1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707115464, "uuid": "b3da5bd8-344a-4b56-8f66-0b04b6d548fe", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707115464, "uuid": "888dd52e-8433-4000-911c-777523c0d804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707115464, "uuid": "2fa72f82-642b-4901-affd-7153ae41579f", "value": "214051e018578d46257d8fe3264f8f0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a8e054-c45c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707161113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707161113, "uuid": "1ded3174-0a18-4433-b9c8-cd92563ec985", "comment": "Malware payload", "value": "a429940daacc132b0ce1a37272da65cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707161113, "uuid": "180e3c27-bd2a-42a6-af8d-78cb6bf502ac", "comment": "Malware payload", "value": "e8b42cbbab5fa34e876ce9875b259379f5a6b0ff00d5183886a0697e7f871b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707161113, "uuid": "56581611-7d27-41cb-a1ca-766666d35245", "comment": "Malware payload", "value": "b84fd13b19a293c0751dc8fd6fec1d600d3a393f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707161113, "uuid": "f32fd741-a340-45e0-846f-36080f52ee8d", "comment": "Malware payload", "value": "47d5d6176f3def93449867ab72bbceef423ce8c0551069b7dbad7b41ecbb48e6be47c31942311c9b9e7055187dec9f28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707161113, "uuid": "1e718e53-e23c-4b89-b1b6-f470dedaf088", "value": "T18355B04BF392BD5DD162743CC4A6A37397727824472287DB378F8421EF4A2E09E66784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707161113, "uuid": "aac66c6d-8143-4d0a-975a-8772cf898c85", "value": "857f82086a0c92b4d507bbf307f0f018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707161113, "uuid": "5ed4d0b8-fc15-4c87-ab41-504d0321b2f0", "value": "24576:rIAe82LW6ns0lXfnRu2kZAhJXfeWCTLpXph+eDBkTl:rIRlLXns0lX1wwuL1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707161113, "uuid": "e4bced14-0d86-4497-a889-779765ad52a6", "value": 1383936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707161113, "uuid": "6e3b73bb-d0dc-4b3a-946c-6ceefe30d701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707161113, "uuid": "1f8780f0-3f2f-4624-b912-cefa41dc78ba", "value": "SecuriteInfo.com.Win64.Evo-gen.21632.23809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964add50-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1707144063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144063, "uuid": "79f91c09-f6fa-433b-acf6-c1a00e15b239", "comment": "Malware payload (SnakeKeylogger)", "value": "40072478a55c3c4ab3faa21e333bcf42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144063, "uuid": "92f2939b-a9bc-4f91-9e05-67bccde11154", "comment": "Malware payload (SnakeKeylogger)", "value": "e98837d8a5c7bde223cc25822eea7c8a42f2ebfa4afb69a7392779ac7f5399dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144063, "uuid": "e63bb678-52dd-4bcf-8f01-675472d726c3", "comment": "Malware payload (SnakeKeylogger)", "value": "8f32107360bfa1d7a89bddb24da1edb6ec539a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144063, "uuid": "a96548dd-913d-44c9-a55e-8a1b6acaa553", "comment": "Malware payload (SnakeKeylogger)", "value": "530be1f21a1cbb905f1ace5ee3264dd10623c2b771e640cfab0922686b0f529510b093fa5c1af7f9c0d3ac080f490f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144063, "uuid": "e3787727-c6b6-47a1-abeb-677603406890", "value": "T171256ED1F15088DAE96F0AF1AD2BA53014A3BE9D54A4810C599EBB1776F3352209FF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144063, "uuid": "d57f5c01-6a38-47fa-aea9-365fb92d73ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144063, "uuid": "ce0720c7-30bf-4e05-9402-8771f6129893", "value": "24576:y4V68yq0N4DJYNYZrwxsTDT9ebdHG9cx6:y4VsqCc0YRwxOT9kHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144063, "uuid": "e2e0a082-204b-4504-bad1-adda0a30b10e", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144063, "uuid": "a8712cd8-022b-473f-93aa-c0f0869adcb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144063, "uuid": "3575fe36-c108-4f06-b674-03205561fca8", "value": "\u015eubat Sipari\u015fi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caac0148-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111509, "uuid": "742c8d9b-46b5-4120-8c2a-0e9b91ef6667", "comment": "Malware payload (Gafgyt)", "value": "d02d9e7f5a17f54f26a05f7485e43a56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111509, "uuid": "8b762007-5055-4fbe-8da3-6f88c217e5c6", "comment": "Malware payload (Gafgyt)", "value": "ec6a4682a36371b7346f3f8e6324eb11bf64318c468aa1cea3d551659e4ad091", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111509, "uuid": "db259e74-1ded-42b5-a432-4c9c9a2bf19b", "comment": "Malware payload (Gafgyt)", "value": "7519e0548698a1aeabf7534bb0b92bf016acb686", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111509, "uuid": "cce72f9e-cab0-4816-9e47-b6deb2404129", "comment": "Malware payload (Gafgyt)", "value": "3005e53a56f6a9a2338029463bb6a595297c51e6ef2d195bf514580ca47a50f6099b1d067b0874072a85fbb5be1f2d84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111509, "uuid": "cdac5fdc-4502-4618-b88c-64c67ae99e3b", "value": "T1D7C3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111509, "uuid": "b031e337-8c81-467c-a7f8-de6a780a663d", "value": "3072:4jDy/+mh1vtbPIKaGbpcUPium7/L7QsvmGfIiNb:mOJ1vxfaGbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111509, "uuid": "a03906d3-45fe-43eb-a270-cc416c9a5ca1", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111509, "uuid": "f187ea16-6797-469b-bf9d-89a4f6971e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111509, "uuid": "1f8784eb-a43b-4898-b09a-cf09b6e02242", "value": "d02d9e7f5a17f54f26a05f7485e43a56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aea1869-c40e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707127642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127642, "uuid": "0c0cb742-ed61-4c61-b498-2a88ccd4e438", "comment": "Malware payload (RemcosRAT)", "value": "ebcf5ba089b6a3febbb3dc36c63f1103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127642, "uuid": "225f2a0d-1397-400b-b2b1-928b66037f64", "comment": "Malware payload (RemcosRAT)", "value": "eca1cf6e582480197bbe12d5a000bf1f75bc76e39f492af6b1330970e3c15cce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127642, "uuid": "0647d8ec-8da9-4b08-832a-086729172382", "comment": "Malware payload (RemcosRAT)", "value": "ae9874657f9153ecda2ebeed290392a6b8094507", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707127642, "uuid": "0459382d-fe39-4842-a8f2-f0bebfefe58f", "comment": "Malware payload (RemcosRAT)", "value": "694662a3eb7e26554d9d9e3b66b0c14ebb9dddf4f36becc6bd8a96943963dba61ba22cfadb0bed766a5761309e56bc8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127642, "uuid": "6e838284-6117-4deb-88b4-79e71ea51f82", "value": "T1DD3412982F66EC95F2C090F45801E1F072EA2C6A1EA3664D0BD4BF57BCBE550BD97063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127642, "uuid": "cfa2ecac-82f2-4a95-aaae-e5363d23d521", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127642, "uuid": "64b43ae7-0ec3-4b32-930c-83a1dbcc944b", "value": "6144:Tmvl3n8iOiB4RBucKa3h80tK2gBWvADGGw6j1:CvlX8i8RB5JvADGGnj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707127642, "uuid": "7982c934-9acb-4150-9a47-599643cd3242", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707127642, "uuid": "fc28adea-569d-4389-9f81-dda918a66e37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707127642, "uuid": "b53f234a-059e-4694-b3a0-71e63728cae5", "value": "bTwX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16e8bf6-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707144511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144511, "uuid": "eb90a7fc-af6e-4ddc-887a-bc8a0e0f256f", "comment": "Malware payload (PureLogStealer)", "value": "4835534b0922349a092726e541ff8bb9", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144511, "uuid": "6ebfbf23-8f05-4cdf-a3f5-d8610dcf458a", "comment": "Malware payload (PureLogStealer)", "value": "ecc79919e41b1ded8a01aa38ede45755f216d0f490c44f7e1386c9f140daa972", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144511, "uuid": "9baea963-4a8f-4421-90ac-2187b099a15e", "comment": "Malware payload (PureLogStealer)", "value": "27ec0fdd569d17d526ae7c5308a11a89cde53d6d", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144511, "uuid": "784fea3d-8387-44d8-9e0c-ba3e99169e70", "comment": "Malware payload (PureLogStealer)", "value": "a0eb8dd12b49815a3a3cd01f276eed8634ca940284f25b814525ee73a43287ca14875b4c2ddefdf2e02c62da09b6ef55", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144511, "uuid": "aadf6c5b-21cc-4ca5-b19f-779f5d4381a6", "value": "T136D42321FF9B9FB6F2A6DBBB12CAC75F116EE814D4A1811220451541683FE3D163F32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144511, "uuid": "7f26e3e1-c9f8-4add-98ad-bc41e57d1530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144511, "uuid": "c1f332aa-e99a-4863-a27b-abcd1bb67f8d", "value": "12288:Y7I2Ipj106ISoP6wJjb0Pc6mwBl8N3BM66qx184aHGs2pW2/S:ZmRpP6UPhQBl8DM61x1P1WUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144511, "uuid": "8f4dc266-76d5-4164-aa4f-95be78b68bc1", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144511, "uuid": "17a8aebc-3232-4d46-a687-12a1407b4cfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144511, "uuid": "e01314ae-e5b7-47c5-b7a9-6e495feaee52", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d8848c-c3f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707116298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116298, "uuid": "8c15de6e-9c61-4b08-a93e-ce9204537a18", "comment": "Malware payload", "value": "d6c8bc35bee322ff04f227bd4dd90eaf", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "shtml", "colour": "#C89450", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116298, "uuid": "1c7d66dd-b6a1-468a-83c8-a19e1bb0947a", "comment": "Malware payload", "value": "ed7a67d757c03c1ee6143ed2d6de0964efc0939251865e641162adddd9b3cb3d", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "shtml", "colour": "#C89450", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116298, "uuid": "2abc1aec-7ebb-445e-89e4-0313575b6f2d", "comment": "Malware payload", "value": "c8207e45d82ac6059625d8096944f54a7e3caac9", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "shtml", "colour": "#C89450", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116298, "uuid": "b626f9df-932b-4979-9b70-af3050d33209", "comment": "Malware payload", "value": "15fd3ce3f35089870e8155ed9b8e2eb2c66b1b3dd38bb5600aeaabe6346336ad2be1689b55f8584e23c0c7b5814f1d67", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "shtml", "colour": "#C89450", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707116298, "uuid": "b3c5405b-0309-4ae9-865f-034893a7e9f1", "value": "T193F4CF2C7D21289CB879892AF0953B539A581C87F4684DB7F55E20C84F9B63C24F7E1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707116298, "uuid": "e19261d0-612a-4af3-9347-0ee331bf373b", "value": "12288:xYrvVEkV9lAnCuQTUXUbD5AIeZ71trPoq5UGcOOwn1TGzsu:xYrvVEkVGCuQOUbFAPZRorEasu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707116298, "uuid": "cf334754-1b2d-4843-bea5-417386d2eda3", "value": 782432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707116298, "uuid": "05a925fc-ff9c-4c09-9f94-cd4510aa0a77", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707116298, "uuid": "21a0fa26-82e2-48e0-bff2-c1ec47d05d94", "value": "Certificate of Insurance 2024.shtml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f99eff-c44f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707155692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155692, "uuid": "f008a0b9-2ce5-4893-8eff-693925c10018", "comment": "Malware payload", "value": "e12a45f5bfe2cd460d7f12d53dc45992", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "http-injector", "colour": "#815C64", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155692, "uuid": "a252443f-048c-4c36-a48e-4dc8536410d7", "comment": "Malware payload", "value": "ee72cf3b1a60a23d9ac421d45404a51395228c999c8797a6a8313f0bb2c871ef", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "http-injector", "colour": "#815C64", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155692, "uuid": "a2563c4d-5858-4326-9e1a-821a0c636d15", "comment": "Malware payload", "value": "a7e050bb6f702d818e094daa910fd6a5edb0fde4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "http-injector", "colour": "#815C64", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707155692, "uuid": "1268e3e4-4b89-4957-a6c3-b3b2e972bcb7", "comment": "Malware payload", "value": "fd2050c78d6d7332c1b09abb816c38472e5e19621c1a963665578ccd53be426f6702fe7c9e052e27634b62d841d3a4a7", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "http-injector", "colour": "#815C64", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155692, "uuid": "a81beb92-dd05-42b1-86b6-5a22314c6838", "value": "T10AD612957B85981BC57785328856F222636ACC184B02E3E7297032FC28F77E48F56FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155692, "uuid": "41eee7fb-7e38-41f9-a30c-f054c4da9116", "value": "196608:9S7T3Y+PiMXelJqacEG125bQftAI9Ynj43cqtvC8FaZUjT2WPxU49vjyfNJgzY3w:ccMX4BnczKkLLFaZUJF9LyVJi6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707155692, "uuid": "4e0574bb-afcb-4121-964a-909d415eb048", "value": 12937583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707155692, "uuid": "a50c0ff4-537c-4145-921b-cfd89c0e6228", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707155692, "uuid": "628550ec-f3eb-4f72-ab5c-269ac9245f28", "value": "h.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3bab9f-c467-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707165793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165793, "uuid": "eb065bd5-7349-48d0-8164-caff77f43927", "comment": "Malware payload", "value": "e544597b23e2c032ec01c37ea69dbe0c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165793, "uuid": "ae7cec64-354f-4ffe-908f-28aa5ee9f975", "comment": "Malware payload", "value": "ef13b5b1322fabdfe7d9b912f7c928bd628e062265db6307d9253279bc42cc81", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165793, "uuid": "8fecfc53-7929-4911-bb59-ec1512639d24", "comment": "Malware payload", "value": "59379ad6ff4b178e6ac13af8063b0a0bc8e7fdc9", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707165793, "uuid": "6bd2d093-7d6c-43e4-8339-3cb290ccfdba", "comment": "Malware payload", "value": "4e3dd5fe9e7643f9eef36e97179f26fff01ef597f32831c44c6d825979e32526cd1a8e300a997cd87b6d72af6b769d29", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165793, "uuid": "487a77c9-604b-47fc-8797-cb857c4b2188", "value": "T1A8F7BF16F50E9D13EEC6B57C9DD60393B621BC451A20C1CA3822672EFCB77C48B697A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165793, "uuid": "2b130574-9d4e-402f-bf7d-999def55f74a", "value": "1572864:0RDDRke+d9mLierQ9Dvb7+tm47HdjrZMvGSfa:0emLiE4D7+tm4DVVMvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707165793, "uuid": "34800370-677f-481d-b0ac-9b9c9a195b6f", "value": 71273368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707165793, "uuid": "433fa289-0d7f-40f7-a6ed-86751cb3f62f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707165793, "uuid": "40e71a99-8224-4372-8afa-fe17dd583417", "value": "MetaMask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9879d2-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707144533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144533, "uuid": "ef36d60b-0620-4873-8ff0-dd58defba7ed", "comment": "Malware payload (PureLogStealer)", "value": "1e66b8bba7ff743969caa15ac799b948", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144533, "uuid": "1b525221-70bf-4452-b23c-7cc98189aa20", "comment": "Malware payload (PureLogStealer)", "value": "ef180d58a5a89ee6ae5882e971f5fe3f900513e2ca222942bd5e8e88d4bd70a0", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144533, "uuid": "88ab4a8a-a431-4b72-9835-b43e560103b8", "comment": "Malware payload (PureLogStealer)", "value": "0051daddc38a0acbb4fed7fb963f1e1f13a40f64", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144533, "uuid": "e595162a-83b0-4f75-98ca-595b2eb0d89b", "comment": "Malware payload (PureLogStealer)", "value": "1b537dcc4643e7dc7c5c2f64475a66eea6acc3e14cd3e0603173e7b31d2115e683895bddda1093e61d46246f4c88256d", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144533, "uuid": "e3a14dc6-3d07-4946-b382-3165f156ee64", "value": "T1F5433B2B46438C10DA6A8B71FDE48635F9217D5F996CB0F7DD4B804406E370B7AAC6E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144533, "uuid": "c153316b-e55b-4c06-8b57-dd3469c1e0e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144533, "uuid": "300f8c80-4edb-4140-9184-c54f3c30a540", "value": "1536:ARsBAXTAmzJBAlHiW+v/e8NgV1jdxMuXIxb:AamDDJBAL++yKhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144533, "uuid": "941fdab2-d29f-485d-a6a3-efd2aee04b1e", "value": 59168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144533, "uuid": "57098655-dd4f-4cf6-8e7e-dc5492f17dd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144533, "uuid": "4a879eee-3757-412d-8015-46cb6a0aa6be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86731f39-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144036, "uuid": "9329eabe-f9ef-472d-bb20-df77e68855ad", "comment": "Malware payload (AgentTesla)", "value": "8ac362d656176ee0f1fb82378343f044", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144036, "uuid": "e1730851-2fca-4944-ad20-8a0abc9b65ec", "comment": "Malware payload (AgentTesla)", "value": "f0a114654cba048408e9f71cf96233df16bde54f00041909567761bc5eb4e38e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144036, "uuid": "48be68a0-467a-463a-88ce-8bb4c0075458", "comment": "Malware payload (AgentTesla)", "value": "9b0a8f78365d9ca541bfed4e3965a192c8edd854", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144036, "uuid": "fe475a30-4c6e-494d-9356-5262208e1304", "comment": "Malware payload (AgentTesla)", "value": "da7b6622c5476651abee157ac926c17ace4272bb768434de81f1d0cb5d117e0ce4a88b0d2ab734b2c5d586edff3e1c4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144036, "uuid": "21f2a483-4150-471a-a1ab-398e9a623c04", "value": "T12D05015661A4DF87C83A17F0C46198E863F27D6AE871E28B1CC57CE336B3B914261D4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144036, "uuid": "17d85f2f-0b9c-4f1d-96c0-de89a4ca514e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144036, "uuid": "c62bae7f-bc2e-4353-8a30-e6fa20764a4b", "value": "12288:GpCrAaXYykD9c3hO4qfKgCWdlrTaAhTTd1tW/+o2ZuWvYnW/xUd9hX9CrJ+a2:GpGIr9cx58BLlrTh+/+oUuTnWo9Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144036, "uuid": "c73f70c1-9f6f-4d51-b0cf-3347f600393b", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144036, "uuid": "7a56c2ca-f3b6-45bf-941c-67ac754c4f2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144036, "uuid": "8588326f-c7f2-403c-956e-f7949aff49fa", "value": "DEKONT-05-02-2024PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cef3947-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707122009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122009, "uuid": "2d74ab8c-dd54-41dc-862e-6d3368db39f0", "comment": "Malware payload (RemcosRAT)", "value": "ed7e3220e46369bec523ca3338a330e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122009, "uuid": "41ec2e4e-847a-4e32-a32a-752abc1957c0", "comment": "Malware payload (RemcosRAT)", "value": "f361275b4679dd821cec516ab8d3b1a7523f8920bbd65f22a3610d523951729b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122009, "uuid": "267a3526-da6c-497f-bcf3-8b91cfe423b4", "comment": "Malware payload (RemcosRAT)", "value": "bcf3c8f96c5b2df5f4f694bc9be8b13f4c5d6444", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707122009, "uuid": "96845943-c6ec-472b-8826-3fe8abf88da1", "comment": "Malware payload (RemcosRAT)", "value": "d919357f4ad1eea3b69440de891a2ffeb161b5dbdca0aa94a3bd7ffee27f12fcba696fcf73233e78333947de33375460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122009, "uuid": "9c352f78-38d8-4cd0-b7b6-caa727b644bd", "value": "T144E40291B9569FC8D86F0BF10811965053B64E1EA8A7F50D6CDB3DABB273B021D12F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122009, "uuid": "81227f37-b081-4f92-bca2-562989210958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122009, "uuid": "28a25932-34ca-4e75-8937-3947649da6a4", "value": "12288:YWh868yq0Gg4rijd3l1Gwq2k4cJptpSydNRt9WfV4kD9c3hwEAmD:YV68yq0N4cd3Gw7sJjpJdNvAn9cxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707122009, "uuid": "afdddb06-7b3d-48fb-977b-9ae68fed6b6a", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707122009, "uuid": "3770b2f5-060a-4f84-a3f9-6e2761d4d1d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707122009, "uuid": "01f4c99f-27f4-4084-b7f3-01fe672d3a6b", "value": "UTR400620101111.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de4c0df-c406-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707124319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124319, "uuid": "4ee8ccbd-7522-4756-b9af-d166a7a5a878", "comment": "Malware payload (AgentTesla)", "value": "6fff95a3a9973a464f731703dc4b2fc4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124319, "uuid": "b90b6684-8211-4dbf-ba61-20428b6f7e1c", "comment": "Malware payload (AgentTesla)", "value": "f3a0bfab745afb410555f8c3935f64399d6b07943477e2740c3b857db8dca349", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124319, "uuid": "6b88dd56-9b6a-4679-b181-32842e0d7be8", "comment": "Malware payload (AgentTesla)", "value": "be2d547fbeaff0e2f8299fb1ac04e1c983810e35", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707124319, "uuid": "0706561a-c3f1-4bee-85ba-3bce4f8751f8", "comment": "Malware payload (AgentTesla)", "value": "2ec1704083f0cf953bd9c0214e9f256949593219681ca43bb57d5049d9cda8150fa3252488520fcc54b905e3386083cd", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124319, "uuid": "af654859-21f0-48b8-8b39-1a3a34cc0d30", "value": "T146F4234409D2177CA086FD1F76B7289421DF8D82EAC55A90CE3E771FD430BD19C92AEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124319, "uuid": "da3e8a87-4617-4c8a-9e0e-31d58a4ef423", "value": "12288:otucQvIUVia2y0833s+HC3UABau+wLOPKRP3lVCgUbsd1ruk37F0rA8CFdlW1Ftp:mucQQUUa2833sIC3UcauLLmKJ3egVOrH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707124319, "uuid": "012111bc-f857-4e8e-9200-55511e890d8a", "value": 775408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707124319, "uuid": "76cb981d-430b-402f-a6a9-4fa7fc4f8c41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707124319, "uuid": "62057639-5c1c-4337-ae29-143e4cdcb681", "value": "BL draft.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa261b7d-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111454, "uuid": "b00a6702-a97a-48d8-9e7c-79d65c7bf7d7", "comment": "Malware payload (Gafgyt)", "value": "a637289af6cec66bb23cc64624d9846b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111454, "uuid": "cbb0f521-2f7c-4d18-a3b0-d9d028a98e62", "comment": "Malware payload (Gafgyt)", "value": "f49c0a02be2183b740949e77f24ac4f002296e65deeddf9a881b0937be90fe4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111454, "uuid": "959cf686-c627-423d-a9c8-764e799a4d03", "comment": "Malware payload (Gafgyt)", "value": "76003ca016ac0e12af524ad9bc1848d1beda2b19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111454, "uuid": "21aa03dd-5a2e-4f09-bfec-b9b3e8599daf", "comment": "Malware payload (Gafgyt)", "value": "d3892c6512ea3eb9b6919ad49eb75ee4fd36e482ff82dc110d8df207701ae6987e52c71d046126d7dc77e88f63a23299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111454, "uuid": "5df6ba92-2cd9-44db-aa3d-b02b423f5a23", "value": "T146C3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111454, "uuid": "8b23f50d-4945-4375-aa25-416d89a2736a", "value": "3072:6jVlyaL5JCrIpv04skbttiEiTmP46aQyfPlfKsNb:yoCJCN4skbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111454, "uuid": "ede5f170-f140-4ff8-b68d-06a788ae19fd", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111454, "uuid": "9aaf92de-a10c-4ab0-accb-206fee3de508", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111454, "uuid": "bab5aeef-8820-4997-9ca0-fdf30bffc975", "value": "a637289af6cec66bb23cc64624d9846b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8acd9a7-c424-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707137222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137222, "uuid": "2db71fb6-3eb8-4217-acaa-e7080dd45fc6", "comment": "Malware payload (RiseProStealer)", "value": "4f9ade23042023270fddb47b7ba330d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137222, "uuid": "d43b36a6-f13c-4815-8e21-92ad8fbb6c6d", "comment": "Malware payload (RiseProStealer)", "value": "f54676662052bcadae2bda764922c6ddbae6f6e98243f76a81b963dc8691163c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137222, "uuid": "ce2c7688-035b-43d8-b448-c7159fe5258c", "comment": "Malware payload (RiseProStealer)", "value": "cd468916233cb7a47adc63aa027aa11d6367bd43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707137222, "uuid": "7d2644ac-b950-4d1b-8478-e1dd45c53500", "comment": "Malware payload (RiseProStealer)", "value": "09f95b6306eaf1062fabc915899485322b1e05ad5fca47402f775ec16d05b5e53430cd11096aa75c493aeee43d39e585", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137222, "uuid": "ee8cdf34-facc-4e69-bbc0-cc4e0e9fa2c2", "value": "T1E7563341ADC3909DC049A97CAB52FE6E35F92E3486344D07695D3BFEE8B374426B7202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137222, "uuid": "bdff4f0e-48ef-48fc-873d-bdcda0e43aa7", "value": "940b3a5d63813005f48f6ae4f0c3b75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137222, "uuid": "89039194-0f9d-4b94-bf1b-34a3af261c6f", "value": "98304:e3EHty+Iz0u/1SrdlmZLo8rUhq02BPm1yORuZwTxNkgXZ8JqOLqTTRIk/rTyyh:pHV9u/0+AhDyCuAxqg+JqUAPmyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707137222, "uuid": "688b1edf-66f6-46ff-bca1-c2a48762efe5", "value": 6021120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707137222, "uuid": "d64194f8-ffa2-467a-ab55-48320795adec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707137222, "uuid": "55119a07-cd48-4fbc-ad32-29da1e0395fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd6c589-c435-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1707144529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144529, "uuid": "1e872c5f-7e04-41c5-a98e-0384af2fa49d", "comment": "Malware payload (PureLogStealer)", "value": "1ad288275f0605d5b7d4bef5b1ebf9cc", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144529, "uuid": "d75fed61-3cf6-4825-a132-16b928269770", "comment": "Malware payload (PureLogStealer)", "value": "f57a6f1b19cb342079fdac2fd03a11450c32ebfefc4b829c2022f0ade237e4c1", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144529, "uuid": "cfe91b6e-306b-453d-8fd6-ea55db25ba00", "comment": "Malware payload (PureLogStealer)", "value": "ac1a5953c498a1b618dd66737167a9c974292988", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144529, "uuid": "ea60793b-a46c-4e19-8438-a2f75f36cec8", "comment": "Malware payload (PureLogStealer)", "value": "f0d71813bdbb150852679f18467cf50e1de83fd8aab1bced2d24baf394a52909b3223d26cc2d84f336df2509ab6c096f", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144529, "uuid": "5009c832-1549-4259-b464-93031d811c59", "value": "T10345125967194637CB7AAA34D9B3A7010B50FAB38033E70793C5A438715B6BF2FA0746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144529, "uuid": "2f2e6277-c6f9-4ab0-8fd7-8d7b693a88c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144529, "uuid": "eb013d7b-39fd-411c-85aa-51eaee0c6d72", "value": "24576:rnZwXYWXrmEEZ3JU51n3x7z9uvVCJ0EEum+vOMf2+KK:rnZwXYWqpJ8VpRdE/+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144529, "uuid": "a49d86cb-c9db-4bb0-ac00-d2ce05cd0fb7", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144529, "uuid": "48d6375b-9550-4b31-9933-93d53ef1b371", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144529, "uuid": "7cb0d658-9846-44cf-8de0-b49e35b29a06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313abd7f-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121989, "uuid": "d836f1c6-83e0-474a-b871-ae6219ef2399", "comment": "Malware payload (Formbook)", "value": "901e77a444b0ed7bae45ade796e4f2f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121989, "uuid": "25589e21-83ca-424a-81a4-d9ae4a462787", "comment": "Malware payload (Formbook)", "value": "f5810950ba8b975f560079d08ba43e3e981c29e100d2ad9bce1265eb8953e667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121989, "uuid": "c823ac36-476f-4719-8415-c1ea2ef03ef6", "comment": "Malware payload (Formbook)", "value": "6e2a3dd1e72cc56a271686c993df7ef006f536bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121989, "uuid": "516eb52c-32a7-4c39-844d-8064616adcb4", "comment": "Malware payload (Formbook)", "value": "d7849a510850403931b38bc55197634b8ac686ab8ad0f5204d6e03c2f64a4f7e643f7667d2ea42c3c30a976df5d5ce99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121989, "uuid": "6aab6ffd-c043-4f5d-9f8e-a3fd6918b849", "value": "T1BD052242B86C2F51C4BF4FFA19E0A147DB7496629813FE5D8C8A70D6A027F544B13B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121989, "uuid": "8fbad160-fab7-47a4-9031-0250fba599d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121989, "uuid": "111f7d9c-b1d5-4ed0-aac1-b873f1354982", "value": "24576:YV68yq0N4Cg0b7V4l7fCaUPxlAgnt26lD2D/9cx:YVsqCpbJMPUPxeitR2D/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121989, "uuid": "4a81baa6-2c88-4134-a23b-38df6eb0a7eb", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121989, "uuid": "2b734264-5f4e-46d8-b2a1-852901993850", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121989, "uuid": "309cdbe6-e4e0-424a-9d7e-9b718bd60fd2", "value": "PO13261 & 13241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c663b044-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1707111502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111502, "uuid": "103b2126-4092-4c78-af6f-ed9b5246fd91", "comment": "Malware payload (Mirai)", "value": "6532b66affcc2257b65771144fdad0e5", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111502, "uuid": "9743170f-6244-4c8d-b120-d96ff808b6d6", "comment": "Malware payload (Mirai)", "value": "f5cc7bf01fa5c1da391d898712009c2b72d8d2c2d9f7b5c230dd698507b57a46", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111502, "uuid": "5abb6fe0-840a-4d8e-836d-6fbddc796f31", "comment": "Malware payload (Mirai)", "value": "3845ef4fcc6e1fbd4621b8259d6f0bea05077264", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111502, "uuid": "18b5286b-1a6e-4d77-be3b-162810c7232c", "comment": "Malware payload (Mirai)", "value": "818d1a2234f89a7d9b25f3e656808a0aa32d0e064e95f6a91ef514e4b388b19df40b8390d42ab41ae84d0705c6ca9772", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111502, "uuid": "09e65d7d-3670-4ea5-8244-84f7b7e0e5b8", "value": "T1B7B33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111502, "uuid": "3fb01ec8-e982-4ffd-b51c-d085d41dd1e8", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAu+TRCm7FnVqfJXFWbNb:T9a2aLqkrMRsm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111502, "uuid": "0b83b697-1ee3-4f13-bf66-b005dd46352d", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111502, "uuid": "46686427-e584-42e1-a015-3586fc627a0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111502, "uuid": "351a718e-42da-4d3a-af23-ff57e173fdf8", "value": "6532b66affcc2257b65771144fdad0e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c79b6a9-c3ec-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1707113123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113123, "uuid": "08d672e5-a7ae-4714-a87b-f269daad8135", "comment": "Malware payload (Stealc)", "value": "9208336092229d3df2e8917e18debacb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113123, "uuid": "833d3737-be3b-4f20-8c2f-a7d37ee26b6c", "comment": "Malware payload (Stealc)", "value": "f79b6fa22c303402b206d12f3a992eef2a2280e7cf9989e54da6ba032bd8433c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113123, "uuid": "7ccef586-c12c-4a87-9849-c50c231c4890", "comment": "Malware payload (Stealc)", "value": "ad8b6b5fa37d06cc890edfd3c2b5208f2ee601ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113123, "uuid": "bed26f1d-f199-458f-baa9-c1d5525e2fe3", "comment": "Malware payload (Stealc)", "value": "39a2b75121820319370a7926fbd1a21ef792392ffaf87f9f61eea6066f4bda7ebddb61f527a63c68224d16d3aaaf99e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113123, "uuid": "c6025ba3-3361-4828-a25a-dad49df1844b", "value": "T1F554BE0027A0E031D15725358965C7B24A6B78367A23AFBFFFD61B7B6E34290DA2530D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113123, "uuid": "fa5e624c-b65d-4b90-a87b-4a4486b19899", "value": "4f1b3bf8bd66597d926a89d7a07a5f88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113123, "uuid": "c4ffa0d7-738d-4b9d-9c5a-c584a6dda53a", "value": "6144:9fAzlTq8VHCr1SOBTsBxpaxdpMfs2Uoz1s:9fAzleYHCrgOqNQz4s2UQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707113123, "uuid": "2c365490-323c-41c3-8a93-ab88e62a7d1e", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707113123, "uuid": "75232c59-f8d4-46e7-8431-fe41cb650572", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113123, "uuid": "4daaccef-6c44-4c7d-99e8-8dcef476f59d", "value": "9208336092229d3df2e8917e18debacb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ba343a-c418-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1707131984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131984, "uuid": "602e2a2f-4473-4654-a67f-f5b469640943", "comment": "Malware payload (RiseProStealer)", "value": "30bae1deb4ca4367a2e7eb1c1f5fe00f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131984, "uuid": "016479c3-3320-4009-a45b-6d72f78fee28", "comment": "Malware payload (RiseProStealer)", "value": "f8aeeca7b0e3e49b2dc9ec7685d112ae3df4e46d4fbe7f3e7fba8fb4b9c68e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131984, "uuid": "ae3d5d5c-56a8-4c5a-9d6e-73756349fcc0", "comment": "Malware payload (RiseProStealer)", "value": "e237e7f90b174a9773ebf4bae0ec23fb06cc6b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707131984, "uuid": "8103b775-6142-4760-a4b2-3422816ef5c6", "comment": "Malware payload (RiseProStealer)", "value": "3f9dbf7cedab64f9d09bba8f515b69a5e35163e2ae92d33c92c84474c51bf90523e8aff2973548c05697f86fbb5257d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131984, "uuid": "82ee2203-e665-4c02-b719-708cb3fecb4f", "value": "T1F356335D3F89AACCC1495F741A93EF2C30BC2AE254956C0A6DE163DEBCB2FD42235611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131984, "uuid": "780ab872-293b-4484-8ae2-a41c64068fad", "value": "940b3a5d63813005f48f6ae4f0c3b75e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131984, "uuid": "0b11aead-637c-4a46-8fc6-55b8f917b7e1", "value": "98304:WqaU4EIS8gbgKHFgx/ZhOU5Xn5Bh9a0A6aCAW4ykyTvSG7OzmwmQrUhq02R8+:W/EISpXlM/bxXnO6aCApsqzmAAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707131984, "uuid": "be853e25-753e-4d13-8c75-057ea04addbf", "value": 5994496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707131984, "uuid": "14039557-d42b-4e9a-a82a-eee0167aa2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707131984, "uuid": "29ad9f02-e065-4330-ae68-feef30dbf072", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaadb44-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707120475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120475, "uuid": "4ad9373e-5137-4f6c-a6c3-fd61150e8489", "comment": "Malware payload", "value": "cfb74f7c11e9e117c263e696f8a6489b", "object_relation": "md5", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120475, "uuid": "50b83c70-e25a-415e-907c-bce9891c5926", "comment": "Malware payload", "value": "f90702626be3dd92aeca8c471a519dc81a1b4c5a86dfddae294e4a04190ba48e", "object_relation": "sha256", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120475, "uuid": "226e4339-ab0f-4e3d-978d-981b224cf319", "comment": "Malware payload", "value": "1fd04610f9ac339cc6559157f8ca0e3c68290e0a", "object_relation": "sha1", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120475, "uuid": "91c0af9f-9109-404b-82fe-dbfd750d5a33", "comment": "Malware payload", "value": "61d8d10a3a8ed383187af2d49be20e0a85e14bf65d532a81120c15508209d72011b1c33de3988afac195abc2cd0a9a31", "object_relation": "sha3-384", "Tag": [ { "name": "812800", "colour": "#7950EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120475, "uuid": "69dac4e1-79d1-458d-a76d-fcd9057a4eb0", "value": "T108118404F47E31E6DE4E79F3D0081DCAE2E10456160AB76E0951A33A035EB43CB74904", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120475, "uuid": "88366c5e-3ac2-4bd8-965a-8a653eab4a8a", "value": "24:9ne1p+hRfFOzjl3+uGipPM+RjZ7PhNKd3rl:9S61Fmx3sYpPLc3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120475, "uuid": "a05d6082-7737-4f81-b29c-4f9aca54fc88", "value": 978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120475, "uuid": "e4c9691d-4283-4b03-8d92-3d01a761044e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120475, "uuid": "f63c33d5-b974-4ade-bb42-3a1e821c3b55", "value": "598255347415042.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a031c0-c409-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707125427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125427, "uuid": "184870b7-0e1f-4bf0-acbb-e74cd89ef33f", "comment": "Malware payload (AgentTesla)", "value": "3c1eeb26c5663f49521ae3dd66b33891", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125427, "uuid": "cc2a96dc-701b-43a2-bac3-679f5fbc2d54", "comment": "Malware payload (AgentTesla)", "value": "f90861b6e43c170e5f8b7ce5549dbfec82ce017e52e9269587b80731daba06d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125427, "uuid": "17d77a23-cacf-42ca-83f6-8e723f2a8f79", "comment": "Malware payload (AgentTesla)", "value": "04d9dd6b2120dfb5dc5b625908a729d6ff2ce137", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707125427, "uuid": "18472fab-e072-45dc-964d-c24f472117bb", "comment": "Malware payload (AgentTesla)", "value": "4d07937f7e62c97c345fd50359d4226084a2ae8f7b7e575258afb0298d535cc8b7577d916ceeb4f262fd01402b47f6af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125427, "uuid": "e55bea45-3e7e-4798-8347-8a0f8c5dcbc8", "value": "T1B3051220B9A52B91C4BF4FF259A191029774C023AA67FA1ECDD734EDD812F948B12F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125427, "uuid": "2a7941f6-9539-48d8-ae1c-3ab4eb6bfb95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125427, "uuid": "7ef0be07-34b3-454a-b49f-62219ae8ea17", "value": "24576:5V68yq0N4KOCbLKfDOpOaO0yqD61bTbqnj9cxg:5VsqCd+CpiqW1bTbqjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707125427, "uuid": "4340946c-6e0b-409c-8cdf-ce3adcc6fc39", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707125427, "uuid": "53062e7f-bb3d-482e-92fb-839859bc1634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707125427, "uuid": "d5184f0a-34d4-4f83-96bf-837017150a5f", "value": "SecuriteInfo.com.Win32.PWSX-gen.30550.1956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c5d8f6-c3f3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707116141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116141, "uuid": "8b5ff01a-c351-43b1-96d8-7f9d6732985b", "comment": "Malware payload (AveMariaRAT)", "value": "9b08fd5a0891aa76388c9dce8f2ef447", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116141, "uuid": "61d824e0-d80e-45c3-a39f-17a7813f357e", "comment": "Malware payload (AveMariaRAT)", "value": "f96f8a1753bf92798de8c5bb0c718b82f40d62e95fb998c9d90fabec32445a4b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116141, "uuid": "528bb702-980d-4b36-9f90-face013cecf0", "comment": "Malware payload (AveMariaRAT)", "value": "26a22d9447e64c3a3b3f1f7fbd8bf054c6f52b3c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707116141, "uuid": "88a32a0e-824f-4d5e-b762-357c0ce164b5", "comment": "Malware payload (AveMariaRAT)", "value": "4363fc23edca36dd8e4a993e7c1793176f5e5e50a24eb5c016aa6ccf708b5d7393a848a7fb295cf04ce7bcae4154f75a", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707116141, "uuid": "78a434a4-58c4-4c36-addd-0cfdb63d89ab", "value": "T1D4A5E0357190C879F256AD37CC0767F906BC7D221935A4C66FE32B0A4EAE17368392D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707116141, "uuid": "89e5d539-3978-4be7-8351-ca08f496cc38", "value": "49152:JSWwYud8nJ/ox0Pi9HVo/B/QAB/oJV7ks:JH0d8Bc9HVo/B/QAB/oJV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707116141, "uuid": "5461a8e8-5b30-421a-8c33-0c8858920a08", "value": 2120851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707116141, "uuid": "f6c8c303-f27a-4035-84c2-9e3e8eadee0a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707116141, "uuid": "9d7c6344-4ebf-44f0-88b6-a5b795f0cdea", "value": "PO4540542295GTS-EE-9507-QTN-9507-232.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d344bb5d-c3e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1707111523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111523, "uuid": "28367489-d605-489f-9fec-7f0b954a4f91", "comment": "Malware payload (Gafgyt)", "value": "ee1b6793fa820d2152c59d11d65cb6d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111523, "uuid": "541e655b-f5a0-4371-89b4-68a844ef8c5e", "comment": "Malware payload (Gafgyt)", "value": "f9f4ef17d35c1de44699f71c8259db13c3647bb719256a5c8790fa31de32e5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111523, "uuid": "ee6538c0-4fd5-45c2-93fb-28812f9f3d8d", "comment": "Malware payload (Gafgyt)", "value": "dd420f2eb7254423091998558dfb332b53d14961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707111523, "uuid": "f66cd386-f29c-4e31-8445-e46404fc0f71", "comment": "Malware payload (Gafgyt)", "value": "95f7ece6ee41f8692f3c3c2050a1582569917ff9fc582206500fd439362fe64f90ef8a3f90950aab20d2f7764281a056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111523, "uuid": "4c1db406-2af8-46be-934a-bbb9c25c1786", "value": "T163E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111523, "uuid": "51eb362b-97c9-4e98-acc3-8e2a49b58271", "value": "3072:JW6dm9tS1aRGQdK76t/zCrI5mrThPaLEnvPrNb:c6IG+LC8mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707111523, "uuid": "89766479-5145-495c-bdf1-b5097b65e4c9", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707111523, "uuid": "bd3faa47-3687-43a6-b62a-67ce10e0a265", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707111523, "uuid": "8e5978ca-718b-40d2-9c4e-fbdef120a9dc", "value": "ee1b6793fa820d2152c59d11d65cb6d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6284fd-c434-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1707144157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144157, "uuid": "6aa9623a-880e-4ebb-ab7b-235776b221e6", "comment": "Malware payload (AgentTesla)", "value": "5b1641def73516c41a8ac47335651df9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144157, "uuid": "11bddf45-2f1b-495b-957d-b8709559d36b", "comment": "Malware payload (AgentTesla)", "value": "fa13e8aa633498eca2185550810df58572e304e1ed0e086304d40af74929d654", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144157, "uuid": "0db7796a-c467-4ca1-ac07-f9a3bd74b549", "comment": "Malware payload (AgentTesla)", "value": "12f5d600ed00f15585faba326f7ef5d0ca2f5fac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707144157, "uuid": "61c15e4a-39a9-4da8-a7c7-8d3711d557b4", "comment": "Malware payload (AgentTesla)", "value": "23c7cac08bd48fa91718e73bd88d8fcdd50dc2ba4f030d494bc40f3c6a152210fc3c0672dc90f57ad0c9f6c638a217a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144157, "uuid": "36527460-e589-4140-b395-69d3df054314", "value": "T1CC05F12923D5BFE0E93E5B7E5166224053F0E597D702C74E3CE103EE4AB2B8096526B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144157, "uuid": "757a219d-3b17-4533-84ae-9d4874495668", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144157, "uuid": "7b5033f7-fee8-4065-b886-75a549560bc3", "value": "12288:NPhJ9oLYvS0uW+glxq8YadPo6Iy1mlDwFCF2TduRh5o2l/5DW/4InHMH2SI7jyF:l97Lzq8rXMl5F2TIJtW/XHA2SI7+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707144157, "uuid": "6eb27c98-f6e0-4dad-beeb-94b6437c2f94", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707144157, "uuid": "377eecdf-ef49-4be2-ba86-3e05032340c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707144157, "uuid": "7676e261-1d12-4c33-89d7-13fa58c3c268", "value": "odeme kopyasi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84dac80e-c3ff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121270, "uuid": "31de5f4c-b63b-4eeb-b5bd-7fd3f9059b78", "comment": "Malware payload (Formbook)", "value": "cdac7681526a262d03a6967fc935040b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121270, "uuid": "fc178b32-f8fd-4a5f-ad47-89545e0d425b", "comment": "Malware payload (Formbook)", "value": "fb50c4bd3f18b7f07c261abdda8ffa14b73dbe217828d0ecf5f970f8f4a5077d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121270, "uuid": "6f7b0f73-bc7b-4866-b2eb-cea053903e68", "comment": "Malware payload (Formbook)", "value": "d1f5eff32775ea9cddbdabee538d4886bf856119", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121270, "uuid": "1ccb3451-b189-466c-bde5-4da227f936f6", "comment": "Malware payload (Formbook)", "value": "073b5c66b295b4d3f5086f322f3eb52cfc34e95c6ec7a89f5a945ad53d574c4d5c4243ea47086d867f4a259d9aa45abc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121270, "uuid": "23e8bfa8-b55f-4511-b313-622656f83311", "value": "T17E25233057B05CB24BBCC2AC42BF5F0A3BA993F4415DD7989AE1A1C53BCD252EB11878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121270, "uuid": "03b06ffc-38ba-496a-8c4a-1e7d8faea73c", "value": "24576:Tw3Irt4iJ/cc/LOZE6EJqDCleG3TMgfxZn:oCjk0iZECqRYOZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121270, "uuid": "037eb1ab-a539-43fa-88e3-e063780e3ec0", "value": 1037179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121270, "uuid": "a4876336-050a-46b3-a9f6-c0f7b1492579", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121270, "uuid": "6f200153-e5e1-4556-b2d8-898652b800c6", "value": "Avviso di Pagamento_ Banca BPM_pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4879f2-c400-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1707121764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121764, "uuid": "b2eb1562-b893-4116-b828-571528d3b5eb", "comment": "Malware payload", "value": "1edcdb7fb2564112e4d3c274acc43b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121764, "uuid": "5c7f7389-9510-4338-810d-409c4871f396", "comment": "Malware payload", "value": "fc114654b427f9e4f9d10245fa43647a011901a431a2df4856827fc1ed96999d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121764, "uuid": "28bfa51f-6588-4499-99de-0f1ab0aea564", "comment": "Malware payload", "value": "a82572af9de5f6c2a5ba4c81e42ceb1e9f991f14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121764, "uuid": "238d952b-e867-4f17-a772-24930ea18d9e", "comment": "Malware payload", "value": "457a16527baaa3faf4193bc30b12e37123c9d98be709d39ec6914751aaf6ed580509cac35d22997afd12b8620bb5a190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121764, "uuid": "34abdb13-26e7-48b2-8f61-8a4b529102cf", "value": "T1CBF4AF0BB3E842A9E1379639C573E213F6B17C051B2186CB73D815696FB3AD04DBA712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121764, "uuid": "6b8eba06-09e4-46d7-b3e6-31b9aebf6704", "value": "3cc9044fe02a13c5861e23b63fbe72cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121764, "uuid": "3b9a3d65-86cb-40c4-9d17-167809441971", "value": "12288:ZQbS/A7vfy/p+5xxdVxiRa98EveUxCj2AqeMQmzFTSpkP2EWmned0:ZQbS/yVDx5YaKEveuGKFzFTSpkPFWmnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121764, "uuid": "39578557-7458-498a-bafe-b4c599f2e8c4", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121764, "uuid": "48e86944-ca42-40ef-8426-f9477db9540d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121764, "uuid": "2c5c00e3-c4c0-451c-a5cc-cf1c0b12f61c", "value": "SecuriteInfo.com.Trojan.GenericKD.70591572.11242.29060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716b18f3-c431-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Floxif)", "timestamp": 1707142713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142713, "uuid": "fa1c271b-ce16-45f5-a959-9bc974e63c1e", "comment": "Malware payload (Floxif)", "value": "0af3b12cdab08052350a509c8a1890f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142713, "uuid": "378cd7a6-6223-4c8a-a8c7-d8cb22db8207", "comment": "Malware payload (Floxif)", "value": "fd05a5d4e619781f5e1affdfb88dfd117b616df12c8c42e8f05fbcc24ebcfaae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142713, "uuid": "43c123a8-b890-4afd-908f-232140b48f06", "comment": "Malware payload (Floxif)", "value": "69970c9f0abb5930e35b162fbeea159e62a60947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707142713, "uuid": "8fc2fb82-5305-4694-b168-00027bdee554", "comment": "Malware payload (Floxif)", "value": "d6376fe450008c9e54657114efe81d7c102c4ff6b8a360ec8e249b6a47cdb1f36074e887a043124059bcf23349beea2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Floxif", "colour": "#3698B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142713, "uuid": "48c7a3c8-2b66-4267-aec7-7205dea310c9", "value": "T18BD39D602795DBEEE4840030305FB7A864ECCE7E17DE95D383967E04AD7DD9B4AC860A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142713, "uuid": "a07ffa6f-26df-49f7-ab30-53cb9710097e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142713, "uuid": "a67328eb-2ad2-4a0b-a44b-520a50e5e9f5", "value": "3072:rYU9aUDhmJHRJp2lQBV+UdE+rECWp7hKN6kvc2:ryuW9BV+UdvrEFp7hKNVvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707142713, "uuid": "4ed27590-defd-408a-872f-d67ce57cb2b3", "value": 142077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707142713, "uuid": "25074ac9-b079-4126-9406-0740231a4b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707142713, "uuid": "c52f275a-cc5b-4b4f-82b3-53fcdd7901e6", "value": "fd05a5d4e619781f5e1affdfb88dfd117b616df12c8c42e8f05fbcc24ebcfaae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6301e71f-c3ee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1707113912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113912, "uuid": "42e1ba91-5787-4ba6-ac2d-2a85073bffcd", "comment": "Malware payload (GuLoader)", "value": "31884ce0631c5d82bce6f7ee83d05ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113912, "uuid": "b91ce3d5-c572-4d9b-a0ab-221ca2e7d606", "comment": "Malware payload (GuLoader)", "value": "fd7bc74c0288c7527482e8bf387a526726bcd7b0c51c9304da8b57603ca0661c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113912, "uuid": "eec19adc-ef93-4539-b08f-343d0ac43162", "comment": "Malware payload (GuLoader)", "value": "302997d5c70ddecf89b4e400595ccc7a3df8781b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707113912, "uuid": "101b95c1-88c7-4923-9595-73571395600e", "comment": "Malware payload (GuLoader)", "value": "c6a58e2a1dc61ce3ba5e1b899f3faca192fe2fc519adb2871c7fdbe5807d2e0721c3aa7100148d5eafa111d124e487d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113912, "uuid": "70a20fde-4df7-4a67-a499-c53627be3726", "value": "T1E9C4F11257181975D87D4F73B01EF2E64462BF376960A30F7382B93729B22024E1FAB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113912, "uuid": "6fac166a-8adc-4642-a644-64b1f1bb7581", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113912, "uuid": "3b2fa49b-6c66-4c7e-8d48-371bdf95645a", "value": "12288:fkfKn0c4uKYOpCXtvwi6EJuUF4BvHC52y4au09M:Ci0c4f7pCXtvmEJuU+BvHC52y4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707113912, "uuid": "74bf2ece-6bd8-46ed-ade6-c9e3864a7a98", "value": 553504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707113912, "uuid": "29920aac-bd40-4c4a-9ee9-f7270dbb8484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707113912, "uuid": "3b8e31c3-f6c0-4930-965a-2d0b543d9884", "value": "SecuriteInfo.com.Win32.Malware-gen.10061.14511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1aa2608-c3fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707120513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120513, "uuid": "a7424641-0279-4747-848f-f41c5c58f2e6", "comment": "Malware payload (RemcosRAT)", "value": "4d43c56c11e63b55adeac4ea6bc240a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120513, "uuid": "a7613d2b-f8d1-40e1-9cf0-05455b4fd6aa", "comment": "Malware payload (RemcosRAT)", "value": "fd828e123aaadacc8739f7fed5b4f997fd7498345d0902d5b42a2a8ee01f0aba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120513, "uuid": "3082f7d6-cfd0-47e6-9364-97234511594c", "comment": "Malware payload (RemcosRAT)", "value": "edfc11c58372092b8f303374ae65302f4d8acbc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707120513, "uuid": "67cb74b7-0979-430f-9cbc-16906cbf5641", "comment": "Malware payload (RemcosRAT)", "value": "107664b946f3107b52ad2815035340094ddbeffdd178d8c28a2dea86f9ca0dc6576623c0449b1c27175035b836f4ebb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120513, "uuid": "3926cd3a-44ee-4e17-aa38-9827bb4598dd", "value": "T10B05239F1488D806F8190E3052AE73B047CB3FDA6AE4DE55F90BB6ABEFF70402556215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120513, "uuid": "a62226d6-bea0-48d6-8674-75640a60e2b6", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120513, "uuid": "0f3a48f3-525a-43fa-a532-e1566a715840", "value": "24576:VthEVaPqLKx3CC1QY0QUw5+TIOw+5g2Kg9U:9EVUcKx38Td39U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707120513, "uuid": "0eaaa000-e84a-415e-a39c-3938617647d5", "value": 867247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707120513, "uuid": "738d3476-866c-4a2c-9648-25f04d4c5819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707120513, "uuid": "70e5b9ee-beee-48e7-98b8-b2e2539b0f21", "value": "6 SUGAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22c66cb-c3e2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1707108945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108945, "uuid": "2aa71f2c-32cd-4185-8b89-e9b169ec20fc", "comment": "Malware payload (AveMariaRAT)", "value": "e363ec06717faf5c5210d19afe9479fb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108945, "uuid": "deca475f-b34b-4421-a1a5-6baf1715273b", "comment": "Malware payload (AveMariaRAT)", "value": "fed8eb678ece533d387993bd90f6dbca076a6e584fa63fd8b9ff0d1e8174c2a8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108945, "uuid": "44209702-3dd3-42a8-97cc-0ee10b59508e", "comment": "Malware payload (AveMariaRAT)", "value": "2bf8da31ffd91c30625ee123e919bfc0ad9d0df4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707108945, "uuid": "d4911593-039c-41b5-9666-213fabda4b79", "comment": "Malware payload (AveMariaRAT)", "value": "0b698db9d919f9ec7bfb81655449afc37b1faa5072adf87a19589ed5a3f67af58f19248347086b948b49f43d0b9b900e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108945, "uuid": "834fb9e8-ba5b-4844-afe3-2cc57f6b8a0a", "value": "T135A5DF7572908879F236AD36CF0763F9467C3D22293574C56FE22B0A4EAD17368392D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108945, "uuid": "1a1c9e9c-5a86-4f64-a049-026b61bcbcf5", "value": "49152:JSWwYud8nJ/ox0Pi9HVo/B/QAB/KJV7ks:JH0d8Bc9HVo/B/QAB/KJV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707108945, "uuid": "5db25df0-e2cb-4341-8941-c7b93869618c", "value": 2120851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707108945, "uuid": "a72138d6-e155-416c-947c-ba0ae48b54de", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707108945, "uuid": "7c77ce7a-544f-423a-9c5b-279014dc3e29", "value": "purchaseorder.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293911dd-c401-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1707121976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121976, "uuid": "c09680de-aa72-4f4c-8b5b-6b3fe282fae9", "comment": "Malware payload (Formbook)", "value": "bb994d1fa7758d1b7ffc53dcc5938f11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121976, "uuid": "beb1dd4a-8689-4878-84e1-e11be916db21", "comment": "Malware payload (Formbook)", "value": "ff43ecef9644b10fc4aa7aa28768ec07de1290ac7737125deba8c330a0cd4e22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121976, "uuid": "c6d24f20-f017-4061-85b3-cc513b3db0ae", "comment": "Malware payload (Formbook)", "value": "57db15681a830d10c051f06c9294942239a5fc52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121976, "uuid": "ca0f5448-cc83-448c-8110-b05b5187d692", "comment": "Malware payload (Formbook)", "value": "5007b0822eb6d6b6f312df9705e69b50e882c3da1cc393ed5421f173056a7d5847de39557a2ca241b71c06a4466ecc93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121976, "uuid": "f95d6290-6aaa-4892-887b-9527e2c72389", "value": "T18504AE32E641C031F2B201B5F6BD0B7B4D3E09353255A0AAE3E51AE16EA49A5F53931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121976, "uuid": "57bf9726-20d8-4e92-8a46-c0b76dc7e91f", "value": "3072:tmImE9JYp/evUk3hiEkCqJrVgj8FsIc1M0Rb799zoByKeLh8aC:t7AKhbtqJrVg88vVPoByKeyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121976, "uuid": "194f7f76-af20-424c-9392-01d34c5e616a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121976, "uuid": "2e3fadf7-3d12-4f3d-8e54-6c724c7d3f22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121976, "uuid": "5838ce8c-673c-4086-a0b4-bf11078ee881", "value": "ff43ecef9644b10fc4aa7aa28768ec07de1290ac7737125deba8c330a0cd4e22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ee8d4f-c3fe-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1707121007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121007, "uuid": "3bdf0c0e-00d0-4d8e-8b23-355f7ba3acc9", "comment": "Malware payload (RemcosRAT)", "value": "4be05e75512b2404c5eebb073141e385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121007, "uuid": "d0bfb40c-59bc-4843-9552-8d53cdb30dee", "comment": "Malware payload (RemcosRAT)", "value": "ff92108a661755642a06952c29b716c9ca4990fc03425508761d22f2269691ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121007, "uuid": "bc1d80a2-7172-48a5-bbb9-fa94bebe8131", "comment": "Malware payload (RemcosRAT)", "value": "9ab39fa3ad7f7e562f7c35a91854e9801d8b1945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1707121007, "uuid": "03e97750-53dd-43e6-8afa-56a5ded555c9", "comment": "Malware payload (RemcosRAT)", "value": "261b02970b8dec1c4d3c1466268fde61ef6d05a7518c41f5be1225f92118fac89ec6d3b4d5a5548c2b491e8590d97064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121007, "uuid": "d6dc37bc-c697-43d2-a49f-ac2a0fdbd0bd", "value": "T13BF25C29B7DC593FCE9F13BE2CB155000734A25B2483D75D2DEA849E5A333E91712BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121007, "uuid": "752b24b2-4401-4713-a8fc-8d5733f16b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121007, "uuid": "fc7b59a5-d30c-40b1-bc3d-060ee0574f85", "value": "768:HnMLE+/K9RjBaxnzyXxFFUxwG9SvIbA710bWe3TNw9VQrqF2WjzYuSH:Hq8XxFCwASAbA710bxT3pag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1707121007, "uuid": "fde274c7-772b-456b-b297-fce1fa376e17", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1707121007, "uuid": "6259da7a-f249-4f8f-9dc0-6438988b1a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1707121007, "uuid": "a88d8450-908f-4581-8076-5b3ad20d9947", "value": "IMG 2768949074321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }