{ "Event": { "published": true, "date": "2026-03-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-20", "timestamp": 1774051381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "667fa8f5-85c9-489d-890c-685b1d144859", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72453a45-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989585, "uuid": "a405e17e-6027-48cd-92d9-8c2d404ca1c1", "comment": "Malware payload (SmartLoader)", "value": "7ffe2598f8a30fccfd6d44857e1add2f", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989585, "uuid": "2d10a902-76ff-4bb9-af21-c1b14bddb453", "comment": "Malware payload (SmartLoader)", "value": "0066151c3189b57ea22e80522fa514a2d6d3e4873d0ef4fd0d380c8da1998bdc", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989585, "uuid": "1d9ef609-0f72-4d5d-bbd3-b3399391fc93", "comment": "Malware payload (SmartLoader)", "value": "2cbc241e4f2f7b32c9a1f32d71d004f4fe7b197f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989585, "uuid": "ee1773d2-8825-4369-bc84-e61d80f88f29", "comment": "Malware payload (SmartLoader)", "value": "207d9f7188e8aeb45c9a008c04471b99643d3caf0e24e8a1fe47e41af81fdf9bee0aa4264ecc59e956af6eec9be25b8f", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989585, "uuid": "6476be54-c6b4-443b-920e-f0f7cd6a963b", "value": "T180C4239603289624787407B197BF9F8DC6028E5329921BFD9FC8BF0CA1356589D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989585, "uuid": "fc2dc017-7bbf-428a-8661-90640e569b48", "value": "12288:wOCBcIqB4liubzqtYBpfsz4TKPozt4CTo4Pl/2Ar5n:wZ+/ubzqyB9sz4TKPE1l/Zr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989585, "uuid": "deb33a13-7fb7-4658-a021-bfeeb9c8d67f", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989585, "uuid": "c282905f-ca0f-4066-bff5-ddf9a68ccd70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989585, "uuid": "992dd0f3-aa3d-45e7-b95e-3c41c7093ced", "value": "dev-Zero-Grav-v2.9-alpha.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab9e459-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050722, "uuid": "0e4a4751-c419-498e-a120-9e0e492ae580", "comment": "Malware payload", "value": "4c29ecc215f19997b64b89f7b584847f", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050722, "uuid": "217d23d9-a8a4-49ce-a27f-0343414fa698", "comment": "Malware payload", "value": "01f08f4b84932336ac315aadf3b4a87a6bbd9c94034f9525904b36b17b519707", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050722, "uuid": "07281568-228b-46f7-ae51-73ffcfa53d5f", "comment": "Malware payload", "value": "d1d9ee34f373e64b09f5cf9bbd1adb9f5e5594cb", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050722, "uuid": "9a3c4492-94e6-45fb-87b3-674b3fae75e7", "comment": "Malware payload", "value": "70d224f915b7e5a74c93a7b6fd8031c8b8c2613d01e21d32580ad8475a56454070aaf1af9119bcc4cac705b8867441e3", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050722, "uuid": "43d8f043-bf8e-460e-bad9-05fb7e967b01", "value": "T1B6D66C45BC2D7462DAC979746B6213947338BC055F81C3276A14BB7CAEF2398CF236A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050722, "uuid": "a0b9df0e-63af-429b-a7fc-c59828cf9ad7", "value": "98304:Ew45guIgrxp9sywatwXn8yh27/1fho3ZSwtnL0kxukUhPIJWdR6WLbEPpYhzvm:Ef5guI0xpyywXxw7/eZhPiIPpYlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050722, "uuid": "7aab362d-edad-43d1-a4ec-fabf9adaadc7", "value": 12724370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050722, "uuid": "6fbc6008-b5a2-4d45-a91b-09fc22abe832", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050722, "uuid": "ef71df6b-433b-4427-9bca-bb4eed3670e0", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd42c26-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989608, "uuid": "5a824747-eb13-4e4b-becf-c1df403dc38d", "comment": "Malware payload (SmartLoader)", "value": "28ab60772dc1117a85c4e056ae077ea6", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989608, "uuid": "004f9456-1f00-4122-8873-f8aad00e810e", "comment": "Malware payload (SmartLoader)", "value": "02e3513088692ce50b1bb91ffdab74bd6dcdaa8a8ee8160d92b2c09867986033", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989608, "uuid": "66ca4996-978b-4889-9ec1-82c7fae689ff", "comment": "Malware payload (SmartLoader)", "value": "299845f0760931a26dfe72100a184c03074361a8", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989608, "uuid": "b7aab384-98a7-4950-aa6f-7a3e077d8860", "comment": "Malware payload (SmartLoader)", "value": "c248be47f18b03e0c71976dc55b6c51b9ad0adf397395147ef939d6527bb26ae8251568e7d37efee817686ec6d620905", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989608, "uuid": "02b09b78-e761-4a4c-b2c9-ae00dcd6d51d", "value": "T181C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989608, "uuid": "590e367a-84b8-4aad-80fa-f74188109603", "value": "12288:JMU+0xq75aS9iYIp6cP/G2Bku83tNvC28c5/VTUPkYyk:N+J71vI/GBYc5/pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989608, "uuid": "d8b256bb-cbab-4c37-80e3-0e45152c2634", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989608, "uuid": "2c74ff80-f7f4-4988-b009-cf579837e61b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989608, "uuid": "79d05923-ff9d-417b-852f-f1539a540d90", "value": "Trade-Connector-v2.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d604c729-242f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773992329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992329, "uuid": "44c1b57c-ff1b-44b1-b24e-6df0209fc57d", "comment": "Malware payload (Vidar)", "value": "b149948bf55a3313d8d355de6d663b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992329, "uuid": "83d07079-544c-4234-ae8f-24e88c0d3e45", "comment": "Malware payload (Vidar)", "value": "03bbc4fa1fd784276da135ab62fef85aaddea66e6eb176d7e59c3398f818b153", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992329, "uuid": "f31849db-ae04-4d68-960d-2154163f928a", "comment": "Malware payload (Vidar)", "value": "8cc4649a0f87a927d999ec352a65d88a0335a3cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992329, "uuid": "7c4d5d2a-ab6f-4692-95e4-2ec03d24133c", "comment": "Malware payload (Vidar)", "value": "dc1a4800d8685ccc4e57c991cb53c901490238cf091a4a04812e2632f2790fd12a080255b1a4b139af8d4471516caf9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992329, "uuid": "121a009b-25da-471a-a424-0facfaadb2c2", "value": "T10ED57C03BD9148E9C0AE927689A799967B70BC080F3223E71F90BA743F72BD05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992329, "uuid": "cd78261f-836b-467a-bb2a-d451bb9d87e3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992329, "uuid": "72c502e6-a264-40c5-bcd9-e92f003a435c", "value": "49152:g78s6OMEXRUTIJr4a5oT8+G/0UK0weK6Fb2C3D4wOM2FSNA:g7CrSR/TETM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992329, "uuid": "c3e4bc7c-bfde-408d-be17-4186fd60247d", "value": 2898432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992329, "uuid": "2e51d87a-e684-4f6f-8f58-9ef2ee846ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992329, "uuid": "b5b1171d-340f-408b-8b18-f52d03449920", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf1a06e-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050669, "uuid": "f1845896-5170-44f7-ad3f-49fef179bc67", "comment": "Malware payload", "value": "508725c3f201ff9ca4b31c051617ac76", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050669, "uuid": "8ac495cb-c8ad-49ad-b06b-fd331b24ff12", "comment": "Malware payload", "value": "04a162a5b7da204dcb3c099294fa3cf502af6f925073d0edddc30e98993f505f", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050669, "uuid": "1163bae4-9d4a-4dcf-a899-6056eda39802", "comment": "Malware payload", "value": "4cd7d1ef22335fe319b76216136314e5b8aeecd8", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050669, "uuid": "43c4987e-5840-45eb-8f95-e5a7b104ff1e", "comment": "Malware payload", "value": "c7bdeac193f99933da593de108a504700b6c829204bf59dad691f6d18994d95fe0344fd0b42ebf51fba6859fc7138bbc", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050669, "uuid": "a51099a1-f701-4239-937d-9be9b0a30a19", "value": "T1C0D66C59BC1D7462DAC979742B6253943338AC059F81C7276618BF7CEEF1398CB232A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050669, "uuid": "a4513a7f-d079-413c-921f-62a41a674aef", "value": "98304:hOPNm8IscgZkSt+zZUCTbPiUVkOxNa5hKRn6K/tOlOU0kxukUhlIKasr1hUEVQc1:hyNm8IjgZJYUCfVVkOBkleaEhtVz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050669, "uuid": "86d0046b-a168-400f-8298-d592a15de1ab", "value": 12725186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050669, "uuid": "6c71993b-154a-4290-a43c-c782fb221567", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050669, "uuid": "ad826e33-782a-45b2-ad8f-ffc738c32ac2", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d85e7fe-24a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774044392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044392, "uuid": "0aa96a6b-2700-4316-bfb8-0b1bdc467ab2", "comment": "Malware payload", "value": "96a3fbc8012ce4456932f6216ce12519", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044392, "uuid": "3238982c-4102-436a-af9c-6e81c9d758cd", "comment": "Malware payload", "value": "060b3bccafb57eb5745f78d77b6a71670b2bc2dbd79bf92674b84695bceacbf6", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044392, "uuid": "dc674cfe-6c25-4b22-8f0b-546d514a08bb", "comment": "Malware payload", "value": "56ebf6a75de5123561ffcfe8e98d58a1a40f8d09", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044392, "uuid": "39ca0dba-7d89-4da0-a9d4-45578fe51340", "comment": "Malware payload", "value": "b1dd8e76a6ed6914b86f41e2e9784181686b92bf90fc33185ea566258d65d96f891a5f4888d93aa8a40ac86b5046e110", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044392, "uuid": "8196429c-4c44-4068-adde-1350b968046c", "value": "T1515733FDEDB99B8BD776C43089A5464EB0B26D25881384B136FCB3505EB77E021B60C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044392, "uuid": "67b2c3d0-606a-4c77-b6b7-0ae42206542e", "value": "786432:437uOYyNaWw31IC0nsaF/9eHvOEiw6nDrYNq:43SOYJlIC0sNHvOVDr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774044392, "uuid": "63e4b05c-059a-4ee1-bad3-8a4e4e1f9931", "value": 29634560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774044392, "uuid": "3df37df4-4549-4c0f-a3e7-a635948a2337", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044392, "uuid": "48126733-8557-4164-a7d8-e98d182fd9f2", "value": "My Sleeping Dear.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20455e4a-2431-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773992883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992883, "uuid": "6b52623d-4473-4907-b538-a9e682ba6fa7", "comment": "Malware payload (Vidar)", "value": "137c3d7860939af239d99f3c1c8e8c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992883, "uuid": "01c2fac8-5cab-4896-82a5-d34df27b5a50", "comment": "Malware payload (Vidar)", "value": "0638e1b63ab03e799872443f07e8d47d2d33671e6341fc302606d54d7f3999b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992883, "uuid": "2ea9e14e-fd1b-4c36-9e22-434c486fc03f", "comment": "Malware payload (Vidar)", "value": "50816d582688c89e05086b3f02bdf7584c81677c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992883, "uuid": "70ca41ab-8f20-41bd-a34f-9b53bbcd7ef6", "comment": "Malware payload (Vidar)", "value": "d2af6fc56365b13991cc1549197e37dfbc4b989b37075c54dd54226fb7f2cc29f59f669aa5ce36050dcf0cbb94fde0b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992883, "uuid": "3a7a1217-c69e-4f0f-84e8-dd5d17b07274", "value": "T19A958C47BCC06075D5AAD2328AB112A17B70F85A0B3037C72F95B6B92EBB3D45E35394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992883, "uuid": "a399a3a3-2e75-4691-99e5-37fbfecdf4ee", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992883, "uuid": "a4f27bb7-1e21-4a2f-9d60-aeb1fe337f1e", "value": "49152:8kPTdkTxeiESofAuUcntAefHpiOx4IMYgtTEK1:JaqA92BfpiOx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992883, "uuid": "74ed596d-0e46-4fcc-9564-5293b4496598", "value": 2010624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992883, "uuid": "f68d9204-e551-4c16-b065-5c6a72e703c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992883, "uuid": "17994f1b-ecb1-4c64-9a95-3d2075aaac89", "value": "x0638e1b63ab03e799872443f07e8d47d2d33671e6341fc302606d54d7f3999b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86dc3f8c-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989620, "uuid": "1b12388f-46d5-44f2-a521-03162f384262", "comment": "Malware payload (SmartLoader)", "value": "34002e69b7a8eee8224bb80b2e955478", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989620, "uuid": "27cfcce3-8ee0-4d97-960a-d6dcef081132", "comment": "Malware payload (SmartLoader)", "value": "0643278d5fcfb2bf8e7b4d02555e0b3ef5d4e4810fb07e678159175ca6988622", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989620, "uuid": "bbb76739-f10a-4018-91bc-bc37b7f6c20c", "comment": "Malware payload (SmartLoader)", "value": "f9881c34489529732bef65bc1e9a5fba369d8c6f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989620, "uuid": "3fad7e03-96eb-43c5-9e58-9af0e0a5a048", "comment": "Malware payload (SmartLoader)", "value": "6cc6adbc37ce3dd80803e26c3c2a745e1ed6c0994c5e46241f82a8b2e2c77bae624f180cb0150f75a8ae934dfde34d62", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989620, "uuid": "d6612a07-55d7-429a-99d3-1d47c299ef28", "value": "T1D6C4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989620, "uuid": "01a835c0-1395-4e02-be37-d05beaec69ac", "value": "12288:1MU+0xq75aS9iYIp6cP/G2Bku8stNvC28c5/VTUPkYyF:B+J71vI/GOYc5/pl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989620, "uuid": "9ce07d49-e6e6-4d7b-8669-9420cf1caada", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989620, "uuid": "bd056324-26da-4fb3-9a86-36dbb9fc37af", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989620, "uuid": "16a721a3-5921-4685-b6f3-a6ea6d5de1d3", "value": "ruby-nrp-v1.0-beta.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7901d58c-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989596, "uuid": "b0dd90bd-66b7-474f-b029-5b07cb420f8b", "comment": "Malware payload (SmartLoader)", "value": "b6841741d1c39dc312aa9e4177c80e3c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989596, "uuid": "927bb410-14f6-41cb-81d6-cb5e1c5404a4", "comment": "Malware payload (SmartLoader)", "value": "067ec3b602489fd3d7b57cbbe3f9e24d986b476f072ba12777d0b447cb6226c7", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989596, "uuid": "0ead8e6f-c63e-4a09-8aaa-8d39cd32a8e4", "comment": "Malware payload (SmartLoader)", "value": "ed605622750a8e5b56f31ef4198552dfd90e3529", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989596, "uuid": "28390168-38e8-42f9-bf37-7197302bcf23", "comment": "Malware payload (SmartLoader)", "value": "74d1af6afde1eea6d19d7bdd83c10d78137975b23eefe85728cef768842628e7c6f83578de181f5268316a0b79aa4285", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989596, "uuid": "5e8e74a6-e99a-4579-b256-1ce47e12e164", "value": "T134B4231EF4D078CFD68ACDA394292C785F6C96C9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989596, "uuid": "572f7dbe-7677-4aae-a166-bda475c6c8f4", "value": "12288:xTibgSMFBOBSlqrhKu7FxPbzJTVBU+8JM9hAC8Z3AVOBRkbKQDiUbpKQ:4cSMFYfKkxpTKJM9mCw3AVOMWAPbpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989596, "uuid": "3a93723f-ba32-478d-a0c1-35deaed546f6", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989596, "uuid": "95f70d2d-dd8a-42a3-a089-916d867226eb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989596, "uuid": "e4ff714c-3f9d-4c67-a722-bb88062f6d9a", "value": "n_workflows_3.9-alpha.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad354a1-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978137, "uuid": "2873772c-6018-4b39-8ab0-7d71c1d411ad", "comment": "Malware payload (SharpHound)", "value": "99bfdc2576148bfe62b9534be5bf4d70", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978137, "uuid": "957a68fd-4975-4f4c-8aaa-4efefaf126f0", "comment": "Malware payload (SharpHound)", "value": "06a084722d72aa9e7e49a72e2c2584b9c8f4566c55e8db6521da8cf367a2b8c7", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978137, "uuid": "b1bed5ad-976a-40f4-a6a1-8ef25ae89766", "comment": "Malware payload (SharpHound)", "value": "9e3546270d9dcb3ddef441e73e795a427ced4a22", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978137, "uuid": "7fca91a6-2682-4b0c-ab5e-58db69b7a359", "comment": "Malware payload (SharpHound)", "value": "f373207714a69c9944cdaf3213a6979a221865c3dd9ea78d33fdf4e083a2fe5cdc556a7c5b5f6fb00ead220760839003", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978137, "uuid": "e9ff26de-7d4d-4565-93c1-d827870f4f41", "value": "T1BF55121553F88B95E69F1F7DA02112658BBAB747F9AEEBCD588C74ED2482304E811333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978137, "uuid": "4a8b7b0d-8dca-456d-9762-c641bb6bd904", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978137, "uuid": "b66b9b3a-29b9-418d-a34a-d3534aa4bdfd", "value": "24576:NLIGEDwgrRvNuXoVIa09WmPstYX38n6x+5pwQjfkong/iN9WCX:izRvNE9WmPDXA6mpwuFK4WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978137, "uuid": "c6df71f0-ebcd-4406-a003-58dacf18729f", "value": 1308672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978137, "uuid": "664e8181-18b6-4120-a6da-ee452aee40e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978137, "uuid": "348b8ddb-061e-4ec8-8f1b-2503bddc245b", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b088b4e-2457-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774009410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009410, "uuid": "580786eb-9f16-4c62-8265-055608106b66", "comment": "Malware payload", "value": "f62f0227227e680817205e660e480b0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009410, "uuid": "edd21ca1-f3c9-4fe2-8c66-7d3ac8c848f6", "comment": "Malware payload", "value": "07f5d2b8f96ccb0737a40fd5d20bb2685b553bae200c1876dc4802da16dba2f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009410, "uuid": "5221e0b8-0b86-427a-aa04-99d0c3c594a0", "comment": "Malware payload", "value": "30c737d544a2eda7af91dfaa444dcd61f9456941", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009410, "uuid": "0e3fada2-48ef-48b7-b59e-ff8d370c495e", "comment": "Malware payload", "value": "366985d04721c53b1d20389c0be5105c0369eace29b27231fab13c2dc179c683c00b36c4a0678b521b803f743b039787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009410, "uuid": "25204f1a-3f7d-4e24-80ca-a3858d5772c4", "value": "T16CA58E07ACD105B6D06AA33689F6A1A2BB35FC18473237D32F91A7786FB17C05A39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009410, "uuid": "5895a70b-dbde-4db5-bf3e-75bd6369f3ee", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009410, "uuid": "60946a6b-f4ea-4474-a026-5be85c5243da", "value": "49152:tbfvtwopTcnciwt0c7CKsTdh0weLiFlIv:tJizc7CKsTdudey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774009410, "uuid": "331a740e-e22a-4e3b-b943-23a2adb3e095", "value": 2195592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774009410, "uuid": "4dec54a1-bc14-4ffd-9de6-0f698a1a6a63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009410, "uuid": "456c1b35-84d6-4f10-bb46-d572d0267217", "value": "pepq210w.ppj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3208e62-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040884, "uuid": "ce452461-17f9-4740-9554-0785a31e16b8", "comment": "Malware payload", "value": "50747b6c666a50f035eb3964c8c37f48", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040884, "uuid": "bce3a87c-a12e-4734-ad77-287c13ca765b", "comment": "Malware payload", "value": "086aa76dfae30cf18fd9b614c491dca18ae22a9bbd25180d2c5fab5c295f967c", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040884, "uuid": "0b724401-2984-400e-b793-b972eaea50bb", "comment": "Malware payload", "value": "4c517be9df53f3e1d7fddffff91ecca77c6cca9b", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040884, "uuid": "45704bbc-7f84-46d2-9b09-c3a67d40823c", "comment": "Malware payload", "value": "f729d2fee31094f6ca17dc0388638361f9c6892e42caac70fbdceaa929cd83e7a1ac8ab86fba4608c6ac60e1080e84ec", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040884, "uuid": "8c741f52-faca-40de-818d-4ef7062609e3", "value": "T174B6D04062DD046DD6AF0E79906202324B35761A579A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040884, "uuid": "ba44f179-79a0-4c4b-9261-a463e2b9886d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040884, "uuid": "85201c92-44b3-444f-98d2-d1bde08d6213", "value": "98304:moKcJJBhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qz:hPzBVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040884, "uuid": "2ed7c81d-e45f-4b5c-8572-64048443ffd0", "value": 10955264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040884, "uuid": "3b50095d-2021-486c-9a1a-96ce3106f7ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040884, "uuid": "27ac6513-ad19-4f2a-84c9-47c394ae8ba0", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b438ec1b-243b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773997427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997427, "uuid": "c3b973fe-a952-4231-bb37-50e503ddd1c8", "comment": "Malware payload", "value": "8b37f918c0ad151035d4682a9c9282d1", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997427, "uuid": "5d43fb9d-b1e6-461b-9b8f-f055a2f05cb2", "comment": "Malware payload", "value": "088c1a24007bb7ec85e2894ab85c93072d527a38d1604f995a06a9e2c037e3e3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997427, "uuid": "597b6d7d-e4a5-4f4c-b69a-8474b7ae9cb1", "comment": "Malware payload", "value": "72d75ce1abcaba23ddc6a04161503420801a7b61", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997427, "uuid": "2843bf5e-7756-42ed-9c30-8cf8903cd925", "comment": "Malware payload", "value": "8952a204831dee61a93f26efd47a70d93f9dbb4287f15c574ba1d5befe947643c2a184da97dfc85d4f2c02a7b4cc4125", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997427, "uuid": "407ffd7f-2f37-49d9-8083-b85010cc3f5b", "value": "T1E1B3108E598E84748B5F30248D1F9C0B9AADB617061DC490BEDEBF883F119F471BA9D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997427, "uuid": "dcc6b858-0679-4453-abc7-d2aebafb7b8e", "value": "1536:YJ3rpabTiNza9nJAX3DSmKJA7+YpSugoqMbev+h:TQ53DSmr7+YpStoqMbev+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773997427, "uuid": "d341d907-ef1b-4832-b6b5-1b01bf8108bb", "value": 113457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773997427, "uuid": "f6ad1fc4-acb8-44d6-8946-0635e339f145", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997427, "uuid": "6148337b-7b02-42c3-974e-ac793482a875", "value": "Images_Canada__51.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fecd89e5-23f3-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773966628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773966628, "uuid": "582629d5-0799-4f14-b2bf-d5bc67415f9c", "comment": "Malware payload (PhantomStealer)", "value": "573b9d51e785fdaab3d10fb590e70aa0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773966628, "uuid": "81c8c62d-fcf3-4e9f-898a-14d1969b939f", "comment": "Malware payload (PhantomStealer)", "value": "08a1f9ca335c195d028e5f47b94f7e3b56945332b5f503ef60cdbba99c27998f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773966628, "uuid": "71d3374c-8de0-42bf-823b-4b60ef5dea0e", "comment": "Malware payload (PhantomStealer)", "value": "166cbe652138b5c0df9bf06e47c4a6640ca10a6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773966628, "uuid": "c0f3a80b-e6d3-4046-863e-c6af41674192", "comment": "Malware payload (PhantomStealer)", "value": "0d4d9ebfc4374db5831775b930173eba2de1b692c0920fe52a60c480dbaf578777430df533037fd9f12795d9cd740e15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773966628, "uuid": "c26ab8ae-474b-4254-9ac0-4a4d3dba2338", "value": "T15B851251EB9AC813E4AA5B32C5E1E97403B0AD5AE512C24B2FE03FDB38537534E86747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773966628, "uuid": "378f6978-0104-4fc5-af1b-95526603ecf0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773966628, "uuid": "01b33e81-9eb1-42ee-abec-36bd2e0e110b", "value": "24576:Kjch15rhUMJ2RV1OjSXG2oFG+1mboHyiBBtoP/WptnynMConA9IOB9VKhYT:HJUMJ+V1OuaM+1ieVrmXW/Ktqvm9VKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773966628, "uuid": "5e2b4561-b092-4eae-9811-ce4b63225060", "value": 1705992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773966628, "uuid": "5cb803ed-0a5a-43e9-a9ed-94e6c74bead0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773966628, "uuid": "15239283-5d88-45c0-b733-a6824552c85b", "value": "z1Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d43b228-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047075, "uuid": "ffab65c9-86cf-4527-8414-6cdf00e6b6af", "comment": "Malware payload", "value": "fda03d1e86dd21f438c16f5a1af71198", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047075, "uuid": "27fc8d15-4bd9-4d7e-90e2-152dc044d57f", "comment": "Malware payload", "value": "0bee9ac6ade9cf96f1a00e6105d8529775b7847c7b83c5c02b881c0250bf74b8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047075, "uuid": "a041d299-a0d6-4187-8df6-4a675daa41b1", "comment": "Malware payload", "value": "fe59df4f6d00041847eb1d334c27ae3118421856", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047075, "uuid": "c3e49660-61d7-4f15-9abb-48809160ba04", "comment": "Malware payload", "value": "bd778b461d660826126c415c91da1caa50aae27b2b27d77b3e884672f183f7cbf87e738efd2204ca79ee1639023557da", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047075, "uuid": "3636c3b5-01a6-4648-9ef8-c2f7e7172991", "value": "T1E775122853F88BA6F7BF0BB9E020515897BA752BEE5DEB4E994CF0DD1482311D521233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047075, "uuid": "46f0fc04-a763-49bd-bf60-614eb5abad23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047075, "uuid": "744ed275-2ed5-4c7c-9651-12fa5ef59956", "value": "49152:ZzRvNExdBSWmPDXvo6C1zVX1K2yDghMP4T4KNx:Zz1qCWuDXvo6S51K2EP4Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047075, "uuid": "6efc3998-5a60-47d0-b0b0-a6333b3b57ce", "value": 1574912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047075, "uuid": "56108502-6395-403f-99e5-e80842d3ac10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047075, "uuid": "119b948c-a328-47db-a5f3-59894eb9d69c", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd04b710-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050323, "uuid": "b34d4231-16bf-47fe-85b7-37e677dd172f", "comment": "Malware payload", "value": "14536b1fb2e120eea5c71e83c1ba41fb", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050323, "uuid": "3102fee6-f4f4-441a-b466-c83f7d287e52", "comment": "Malware payload", "value": "0c3601879d37fc036b2a057f2a8524f6f34cf81899bd549bf741274e8f2f758b", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050323, "uuid": "c0fb0fde-29e8-4d60-9191-ca7538d64048", "comment": "Malware payload", "value": "8632d93918902a1b20d942fe4ef2452d57ab2913", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050323, "uuid": "98b328ee-fbc0-48ce-8114-6f9c1cdbb353", "comment": "Malware payload", "value": "53c284312b8addc423e0e40f11fb28ad75fdb5091d1db249ebca94ce201e12ad2c0a6c4cd18ce75c44b697bfcf9e34b4", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050323, "uuid": "fb6e47c9-121e-4018-9b2c-5edb5eccf3ab", "value": "T1D1D64B03EC9545F9C0ADD130CA269262BB717C499B3123E72B64FB282F77BD06A79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050323, "uuid": "f6fe4729-5a7c-4189-9903-45ac01fa07c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050323, "uuid": "c4a1265d-ea78-4d6e-a4c0-7b322ae9bb3e", "value": "98304:yfKlyLl8ltCg2V3RLYqWPh5wt49MsV6PNUpSx1hRMX4E:y1lateV3RUTPTwtcMsZ6ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050323, "uuid": "680b00fb-a680-47c7-b450-2018bb881444", "value": 13678080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050323, "uuid": "9b923528-f247-494c-aae9-03033d544fa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050323, "uuid": "fab3f10b-61b1-4a37-8655-73525596beab", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f050e10-246a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774017497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017497, "uuid": "fea85597-30b1-4fb6-9606-6eadefe98a3d", "comment": "Malware payload", "value": "9cb98360a492a284ef89fa652f3ce89c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017497, "uuid": "7af69c7f-c26a-435e-b074-a1c9b6258122", "comment": "Malware payload", "value": "0c3cdd49f8a84bcb3e710806544cb7de9414a3490b74f0ed78672110712e6d3a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017497, "uuid": "109caf89-38c7-457a-89ee-07b16e8f70e8", "comment": "Malware payload", "value": "1ba0ac01ee7a94bc143afbfd8617ed97bc8dbd39", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017497, "uuid": "c8c8c9a3-a63d-449a-838c-191e61d714dc", "comment": "Malware payload", "value": "aeb9116155e822dc8946e10a3ebc8f732effc45964fca3eb472db7a0225c2cc3bb30f376e75a509bbcd358fdaa83a9c1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774017497, "uuid": "53df2c78-12bf-4282-8d8e-5b4c5e74cc35", "value": "T17F924BB916496C79BBC0DE799F3C7F0CADE8C1C02218A39CBA4F39715A2069DDA0535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774017497, "uuid": "ab739c0d-8fe4-4fcd-9cea-84bc48285783", "value": "384:Q80M3vgRjGlsaq7ZzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:QmmjfdzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774017497, "uuid": "047a59bf-731f-4b85-b1c1-a353ad744ba4", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774017497, "uuid": "b07ea3d3-d92a-4003-9a69-7a4d0587e0a7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774017497, "uuid": "7ac2f016-62d1-4536-a559-b212556bd9d0", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c254bb-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050584, "uuid": "208c6e36-2aba-4d68-abcb-32462a992d96", "comment": "Malware payload", "value": "98b1c0e378d074098684986489c87f71", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050584, "uuid": "187b5c43-6b84-4639-a192-811a9a98593e", "comment": "Malware payload", "value": "0ca138ba09f22e40f191de9dec95229252f53688994167ae39117a8dcfb07704", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050584, "uuid": "3cf85a33-b050-4722-9e11-e1f14c09c13a", "comment": "Malware payload", "value": "206824655b652aa1983bd4415a009720116de159", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050584, "uuid": "b9fd6746-0962-4abf-938f-393f4bb0da5d", "comment": "Malware payload", "value": "5e117624755bd7c5683d7647fe4f60cbdaa0c895e618f67d887aac69520b0dbdf3189d6fc06caa5bd2b024a3415cf7b9", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050584, "uuid": "881edeea-4c5e-4ac2-8ccc-d8fd3858b46c", "value": "T1A0D63A03ECA585F9C1ADD13486629263BB317C499B3063E76F60F7282F76BD06A79344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050584, "uuid": "48951b41-c45a-46a5-a08c-30f37ce20590", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050584, "uuid": "45a1476c-ed6b-428f-9279-022cb56cf273", "value": "98304:oH9F63WC78kNhidf+fLyXqem1wtMuSHajB6lN2ivw1aIY/dYYskmE8:oPG7LhiV+fLCTmYfSHaDidTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050584, "uuid": "db3add12-a093-4e7e-ad34-b1dcdbf70092", "value": 13627904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050584, "uuid": "2c223f73-ac4c-4c77-8458-158f84645838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050584, "uuid": "f111100d-6b2d-41af-b14f-0d8de7890a64", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc9618f3-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989334, "uuid": "a803c1d7-7159-4841-a030-e0d33a25f18d", "comment": "Malware payload (SmartLoader)", "value": "72ca927f42539ad3eab9a8eacb9a9c85", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989334, "uuid": "2542f963-5682-462f-99f5-0db187796208", "comment": "Malware payload (SmartLoader)", "value": "0cb95865025d78cfd81b430b58b72871ea74e8e5831d7b32727da0969565d303", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989334, "uuid": "71b4f45c-ebb7-4c9e-b3ed-1c3a798c36ea", "comment": "Malware payload (SmartLoader)", "value": "56dc938fbe1aa29e3b1c1b93d81b9a594a5857d4", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989334, "uuid": "5876cea2-fd27-4714-9d36-53271947cc04", "comment": "Malware payload (SmartLoader)", "value": "9e203c1f44ee8df511e7f01d93c6a59f365ccf25d41fb5c5edd3aca6083d16ec58d07499940fd7af1c1d1f2995049b3d", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989334, "uuid": "f09dcc02-d07e-4301-8861-0ab62717ee85", "value": "T1EDC4239603689624787407B197BF9F8DC6128E1329921BFD9FC8BF0CA1356489D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989334, "uuid": "39a67474-f180-452e-96f0-9a09b65b7c2d", "value": "12288:YOCBcIqBMliubzqtYBpfsz4TKPozt4CTo4Pl/2Ar5X:YZ+zubzqyB9sz4TKPE1l/Zrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989334, "uuid": "3c73e4cf-1939-48ee-9f1f-2068077645fc", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989334, "uuid": "5f2f5ba4-5fed-420c-bc71-8aa79f35f99f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989334, "uuid": "e895bd48-fe53-4f4f-985c-9c052ce0cd5d", "value": "Astra_Ad_1.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3965a13-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989346, "uuid": "c2b2e294-b318-48e4-8153-49b41e9d37b4", "comment": "Malware payload (SmartLoader)", "value": "3004069c4b3416271eae0fbd32b1847e", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989346, "uuid": "00377933-4ad5-41a4-93e6-79da83bef0e6", "comment": "Malware payload (SmartLoader)", "value": "0ce111d259b13d2b0540b29979739274887905cf3a816034a65e9fba8fa04273", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989346, "uuid": "e00f1fa4-9a95-4912-a232-8c496f0db737", "comment": "Malware payload (SmartLoader)", "value": "c6fe2f399b768059b588ee0958dfa65344bd03dd", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989346, "uuid": "0c6d8c64-5de6-44db-856d-7be6ef6f718e", "comment": "Malware payload (SmartLoader)", "value": "5d1acf2c810fc8d90839f347c243c18deb29a4d223435acd6e764df6d9de6de77f1971efb0b9a232c8b0ba88784e4c13", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989346, "uuid": "ea300a17-b84e-4bcf-a4cb-e6093e92ba81", "value": "T1E9C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989346, "uuid": "ced1a791-dcd2-415f-8884-95c7685b4462", "value": "12288:7+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byrH9I1P0QKw6FEr:7+QqldA/TSO713u7xnrH9IaQKHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989346, "uuid": "14505944-68f1-4fef-bd7d-0f14fb2e4309", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989346, "uuid": "f0a443b8-230e-4c86-805d-d9418ba3a1e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989346, "uuid": "e87bb44e-7180-44b8-aefb-d2ec03333200", "value": "free_algorithm_learning_2.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c97514-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977973, "uuid": "acc0ad96-07bd-46f6-b745-9bb646b68884", "comment": "Malware payload (SharpHound)", "value": "f080ac549fc2d04bdde716ab9c0d97e9", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977973, "uuid": "188bd333-91be-4f95-ba3b-483ca75549de", "comment": "Malware payload (SharpHound)", "value": "0d24b968a13e74fae8861c9be1621673fb6b8d4a971ea5b31a54c7e4c08617f1", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977973, "uuid": "97e43bb4-cdad-4f22-8cee-2dd9cf4c2888", "comment": "Malware payload (SharpHound)", "value": "e44800de638d356b257de037ee7b6871833be57a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977973, "uuid": "46af2d94-362b-4001-9d39-b834510608e2", "comment": "Malware payload (SharpHound)", "value": "86b5ce165d3dcefb4216dcefc40cb356d33a6ac737202b1beee8453cb2fa4bb00bc5e7d1474c24e5b56985673763ae4c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977973, "uuid": "58883639-8f8d-4382-b765-0ada1ca698bb", "value": "T167752320AF3A99FE8A3F4329146F5F2C4E955EC38848859F76EE1095133E7528936C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977973, "uuid": "8aec124b-2fcc-4d41-83b4-f47c1b7a4b14", "value": "24576:Kg0MQ2BUuqcUk3zczgcffB/kn7uf6ZkSfoLYeYMb1bOinCE50kPEJfzJw8p4M8fT:J0+oQ9HkSa8f1bnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977973, "uuid": "1e8b0e09-3bdb-4616-b0a1-401e95d97506", "value": 1629541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977973, "uuid": "70b28fb3-859a-447b-b95a-f46df93905ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977973, "uuid": "80d63c28-62c9-43f7-ad38-c846c14c5f53", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f199ee8b-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773978202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978202, "uuid": "cc3a83a3-f7a3-4b4c-8d46-f8894a5d6bd3", "comment": "Malware payload (a310Logger)", "value": "90a3b23675b370780a01d7f5655feac8", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978202, "uuid": "e7d8660f-8cd9-4be0-a91e-bc7fa79316d5", "comment": "Malware payload (a310Logger)", "value": "0e9638fddf6a3c5b10950e49f5528903e9fe0d087b4baf86591cee809e22c38c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978202, "uuid": "c5134fc3-e693-4466-b4fc-6acfeaacc81a", "comment": "Malware payload (a310Logger)", "value": "eb3f4ffd380387d03ed5935e64a40d33c6356fb8", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978202, "uuid": "e76ae7e0-d265-4a06-9ac8-3cc712c87a00", "comment": "Malware payload (a310Logger)", "value": "bb3463dad0cc577efb54707c87c82c2c65740dccfe707f01eda5ab47ed34bdb56480e1815305c88eb59dd737e8a3ccfd", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978202, "uuid": "e346013f-03b3-470d-ab3f-8c68e7a7c027", "value": "T19E65C00273D1C062FFAB95334B5AF6115BBC7A260123A62F13981DB9BD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978202, "uuid": "f9821d3b-635e-446b-bee0-ffb1b9fab5aa", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978202, "uuid": "458994e1-84f3-4159-ad64-e91f9002cc58", "value": "24576:y5EmXFtKaL4/oFe5T9yyXYfP1ijXdaUBiSAwKccdM0SLJeo66d:yPVt/LZeJbInQRaUBfMccdM0SVeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978202, "uuid": "d22f0dc2-03f7-4a21-aa24-d84807218eb5", "value": 1414656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978202, "uuid": "2ce2559f-9886-4b90-bb52-b1c69bbe0633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978202, "uuid": "a46c11b7-5359-4b36-9820-785c5568bb48", "value": "Halkbank Ekstre.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d63d6f-2478-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1774023729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023729, "uuid": "dc001aa5-29cb-4909-99f9-e1ff7ccc4908", "comment": "Malware payload (OffLoader)", "value": "d5c9e78b6e1d08e659308998554fbb84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023729, "uuid": "ab5b6101-2873-4159-8e54-2b3c057dce35", "comment": "Malware payload (OffLoader)", "value": "0f07ad05a0f1c0f0c232ed50bc56de228f1500c98be8bacda16035c318709ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023729, "uuid": "d11dd7e2-575d-4ce5-b2be-2d789e6de540", "comment": "Malware payload (OffLoader)", "value": "4cfe57eb7d26b31367f910bc28f9d1e85e86aeaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023729, "uuid": "3a81184a-168a-46f2-95ba-738cf7b176dc", "comment": "Malware payload (OffLoader)", "value": "039d6f79f9c17616b910bf64a3958a501ea50725c4823bbdad2a4852eef9fe536af50a6a023d78dd966b7d45365f24e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023729, "uuid": "65bce51d-8644-4e3f-8cc5-d0610bbe2cff", "value": "T134360233F24A533DE06A1A3759F292205D3B6A61641E8C4696FC7C8CCF7E1A01E3E657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023729, "uuid": "8240613e-2879-49b0-ac0b-77f75572de79", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023729, "uuid": "1c4605d1-1acf-4eeb-82ab-076c99da2ace", "value": "98304:/N66K6YXyyqrXjbEgdvol0xMLzBzv3EfkBuQs+D2tGqsr0VZjngxhpp:HhjywXjbPdvoO0u+xD4dhVJgxbp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774023729, "uuid": "a9db7f71-9152-4137-996b-4d1dbb708e75", "value": 5131166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774023729, "uuid": "62cd7463-34b0-425c-8cba-cf007f69b53d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023729, "uuid": "b7ff6fb4-89f0-4012-9240-a30d76e9efcd", "value": "danma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4687d54f-2439-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773996384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996384, "uuid": "d34e6cb9-4c7b-4a4c-9b1a-73d16e0677b8", "comment": "Malware payload (SalatStealer)", "value": "883cbd6205d7e0f39d971ac56cadf01e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996384, "uuid": "44f4a37e-ee56-4c46-b47e-4b185b444b09", "comment": "Malware payload (SalatStealer)", "value": "0f75cb1f0b50784a5a677debc6a9eadbf9dca3f5cac47d0a8ad356badca5e96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996384, "uuid": "5d5fc900-3e0b-40da-a58e-981df64856a8", "comment": "Malware payload (SalatStealer)", "value": "52d46c6f59124aa643d24638055819630ff5f605", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996384, "uuid": "71cdad35-4c93-476c-87b2-8a6db411ea7d", "comment": "Malware payload (SalatStealer)", "value": "f17a127fecea98a96b9d6d4429d57a004afd7a1e623e3e3c2fb80d2b90e6540e337165560d2460bacca0dc339fe43385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996384, "uuid": "00e608bd-9236-4ba7-84b4-d12e5e000a43", "value": "T1FEC65A11FADB95F5E9035831006BB27F23315D048B28CBDBEB547B2AF87B6A11C6A345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996384, "uuid": "2bf0feaf-ac86-4f35-8850-928a513b91a3", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996384, "uuid": "b470f110-a578-4eb5-b9f2-4f1d3036f66b", "value": "98304:hT12jpuI0rDq+aur2a7P64k8/wED1EKD:mj4q8FCB8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773996384, "uuid": "f758f7bd-af22-4a99-a49e-8bcbb87ca14d", "value": 12577280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773996384, "uuid": "7e20a2ef-f096-4f31-b630-02947fb5fec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996384, "uuid": "9e78645a-cef9-4848-85e7-582e50e1a8ec", "value": "arpattack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e71365-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050449, "uuid": "4fb97e45-e732-405a-8b02-0b081cbdb2de", "comment": "Malware payload", "value": "b4bceb08182518bd214b5ea755ad2a70", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050449, "uuid": "78af21fb-526f-4143-be89-553a23c4ac5c", "comment": "Malware payload", "value": "0fd59ee493d5431cbc3025d98decdac1218623a2be75b6aff2fc25409eb8688b", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050449, "uuid": "2dda87f2-68c9-4314-b78b-3db79b893472", "comment": "Malware payload", "value": "93239ecaa92f29300b56a5a2525143a5beb0d484", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050449, "uuid": "fda7021c-8f29-4ee8-838c-65b820a243cf", "comment": "Malware payload", "value": "16166b484edfec8b551aaa6de6f739e1b3ec65f79e426c3e942ddb693395364ba1b14ecadb03ddf996cbfd99204d5763", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050449, "uuid": "ffdb5394-c694-4ef5-aae5-33a04d0bb20f", "value": "T1EBD64B43EC9561E9C0ADE13486669713BB717C495B3137D72BA0F7282F76BD0AAB9300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050449, "uuid": "8b504819-a65e-44a2-be1d-7f5d33deecc4", "value": "98304:Hz9ZahqIpJRnZ5+A9EUsXPZ7z9h80C1L/d6wJlVp+z6EgED:H+pJRZ5+AhsfZ/9a0CLExng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050449, "uuid": "aa2e0ca7-4b11-4a99-887b-f16853add0bb", "value": 13458112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050449, "uuid": "4ca367db-8e17-491e-b097-851c66c4d2c3", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050449, "uuid": "42fedcd7-9a5b-4715-87f5-66b790ef419e", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253f942b-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978289, "uuid": "fbe9338f-72ad-42a8-b0cf-becda051a67d", "comment": "Malware payload (SharpHound)", "value": "206d6cfe254bd677e0591774552d9d6e", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978289, "uuid": "d9bce87a-22d7-4d46-a8e8-2b0951b03266", "comment": "Malware payload (SharpHound)", "value": "0fe2b6c7d0e9b57d2b6f7c3d3ffd05025eb3e4adf3f9c4937be8bd40154e5bd2", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978289, "uuid": "22c6a54e-a2cc-45f5-bc64-37e2ec8351ae", "comment": "Malware payload (SharpHound)", "value": "c1d3c73872411d9d724dbc6c16b578123e373c5a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978289, "uuid": "443caca3-befa-4cdf-8e4b-01c93816b032", "comment": "Malware payload (SharpHound)", "value": "e7f8b45b34311e73c4734a8a6b978467e4d38e40a7550eaa65a5169fc16bb212b0b1d44eb7ddca793b42c202ebbe2275", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978289, "uuid": "8ca97b78-17bf-425c-abb4-3d539bcc1afb", "value": "T17355122553F88B94E5AF1F79902102654BFA771BF9ADEBCE684C74ED2482308D852337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978289, "uuid": "f2084cc8-dcd3-4f73-9469-fc2d5a89d819", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978289, "uuid": "89eaa12c-c8e7-496a-b827-11d6d26a8b0c", "value": "24576:ydLIGEDwgrRvNuXoVIa09WmPstYX3C9t6lnkong/iN9WC:ySzRvNE9WmPDXYkFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978289, "uuid": "651a60fb-bfa6-42d3-91cd-601553a8d527", "value": 1286656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978289, "uuid": "47172aeb-f282-44b1-b635-efdbfc40a1a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978289, "uuid": "8a392974-69e7-4038-bb2b-b715fd646a11", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53614ccb-2452-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774007142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774007142, "uuid": "d9678886-44fd-4e2d-bb2c-e60e13af561c", "comment": "Malware payload (njrat)", "value": "bfca645b4fb011ee1a0b3b59c1c7fee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774007142, "uuid": "0907b34a-28d3-4d9c-bf76-4dd27b253c1d", "comment": "Malware payload (njrat)", "value": "117f0bce5405cbcc8c8251d1a9c8ea6423706f3c0e308d20963c1072ed7ba3c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774007142, "uuid": "c4df3c29-0672-4e48-9d6d-8a2d026e1925", "comment": "Malware payload (njrat)", "value": "2de2d6d8fbef221f1a5f4ae870af42dfdcdbcae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774007142, "uuid": "793fd646-1664-4f32-bf7e-dc159e74d1de", "comment": "Malware payload (njrat)", "value": "96a79a03b6d2074d92efc9ec3ea71eea8fdd7e5c18513e1bf08a01c79f748833134de2332d4142bfe3b486be6d90e938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774007142, "uuid": "d465f947-de6e-4972-b738-b8246c64fe6b", "value": "T11C55375B788189ECD6BABD7D50F1650603F1B33527322791A12DE630CE932A2DDF6B09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774007142, "uuid": "566c6fda-69fd-402e-9f6c-5d98168dd1c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774007142, "uuid": "2f25ebff-9178-49a9-b989-398986e35ccf", "value": "24576:G42dpEOXG4bXJEnkt1vihvp5SumBLpJFdClQEP+:5295QdhRQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774007142, "uuid": "3252e57a-8ba2-465b-b078-dcfe15feeb07", "value": 1401344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774007142, "uuid": "563e5db2-8f4a-4028-8a44-7a0b873e639f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774007142, "uuid": "0078959b-0a67-460b-ac73-121a24ef0064", "value": "Clientdprotected.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c809056b-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989299, "uuid": "ede17b7f-f8e1-4aae-89f0-6eecacb4411c", "comment": "Malware payload (SmartLoader)", "value": "350d95af949ac486d8287eb51063b8b1", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989299, "uuid": "184719a6-1b85-40ac-b7bf-29174fe26d39", "comment": "Malware payload (SmartLoader)", "value": "1191bef746c05ed2c52bc77371232cbb47644fbb9885e8d1e028dbd2d23b0aef", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989299, "uuid": "8008dd73-2aa7-4672-8272-14fd4c02edd3", "comment": "Malware payload (SmartLoader)", "value": "aa194bc3a16e5c648a8de112255302246fd2af71", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989299, "uuid": "3a9f45ce-9dc6-4771-97fa-339fdb3354d0", "comment": "Malware payload (SmartLoader)", "value": "1f9217d7d51778940b6d77efd979567976746d8462d1292b0b3073e6e6bad2ba945d51b6d946b78fd18e5ce50a8c98b3", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989299, "uuid": "53a060be-27a3-4952-9ca2-5ad09eb9eb16", "value": "T1ADC4238BA3FE845390BF1F58AA57B48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989299, "uuid": "7437b7e2-dce8-4398-b032-57a662e5a290", "value": "12288:3+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byPH9I1P0QKw6FET:3+QqldA/TSO713u7xnPH9IaQKHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989299, "uuid": "bd5b962a-ee24-448c-9af9-41ac86c92ab7", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989299, "uuid": "b3e3b933-9b33-4194-a975-9430b8d8bb5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989299, "uuid": "70657fcb-4bcc-44fc-bebe-51437d630645", "value": "testnet-percolator-1.0-alpha.1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dca655-2467-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774016250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016250, "uuid": "cb5b453c-5bf7-4f12-88f2-268c8a3fe83e", "comment": "Malware payload", "value": "ea418f179328347d15ff316b3eeeec51", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016250, "uuid": "e113ff59-fc7d-4193-b4bd-a2bba1de6495", "comment": "Malware payload", "value": "1234b313e10a9a92dadb9644e03d5dae24a6bea0c209866bb2debdedffa28b9c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016250, "uuid": "1bb9eb76-4e82-41b1-9579-0de86991e830", "comment": "Malware payload", "value": "3d4838e25492d174aab9e620fc5437b4a6fa3f78", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016250, "uuid": "9a944827-960f-4620-be9d-67a5d9bdb554", "comment": "Malware payload", "value": "64a7b39c557be5944d26b0583b31bdf8c9826f1274dccb30f44a83be7d7a29d15d53dd9954d3ad155f01350f02df2219", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016250, "uuid": "f663826e-ccfa-467c-b376-60c5f143ba27", "value": "T16F112C046BED5205BAB35F42A6FF64A2147BBABDAC31C75C0114911C0AB1A48DC77F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016250, "uuid": "633c6a05-c342-4028-a20e-f8a93917dc2f", "value": "24:Q1Wh4mNlmZgFYQI+Pn1OjMuZJXk9wA8EhOZeKTvH5AAeL:v4PKFYQFn1E78OgKT5QL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774016250, "uuid": "3da545f1-4d95-4ce8-8e8b-d80197ba996e", "value": 1040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774016250, "uuid": "de3c63a5-5e68-4e21-a687-58d0e6174fef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016250, "uuid": "06bab41e-58fe-445c-bd50-f5cca79f72fe", "value": "1234b313e10a9a92dadb9644e03d5dae24a6bea0c209866bb2debdedffa28b9c.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9011dd0-2476-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774022829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022829, "uuid": "6516aace-f7a1-4d29-9db3-22d02629a43d", "comment": "Malware payload", "value": "a2840074951607e0610e6e9608dbb6f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022829, "uuid": "c03840dd-9f8b-464c-9af1-443f8a6e8f19", "comment": "Malware payload", "value": "149182139a67e57ed056d4280ba7570b030591e87886c679b817b664d8277d3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022829, "uuid": "16d8c658-77b0-4121-803e-136eae0129a3", "comment": "Malware payload", "value": "be1739331915a914922753e6ff8bb1679feba9aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022829, "uuid": "08ff6519-64e0-414d-82db-07ea51d97701", "comment": "Malware payload", "value": "a539bbcff01021878f33f523e10c0e04a622e5477d97b7a9e73e4ba05811628cea7ee278117574704181eb07dd07a6f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022829, "uuid": "444a0264-334f-46fa-b4e1-cf1420c22417", "value": "T1EFA3865E2E228F6EF768873447B78A259B6D33DA26E1D644D59CC1041F2028E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022829, "uuid": "a7293068-8220-479f-ad0c-9a1f45b32d1c", "value": "1536:DblBjVqrIb/P5QW6lDoN/NdFAcFy2V7kVL7Eqc5:fl+quvEVTAcFvV7kVnEt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774022829, "uuid": "d2a685b9-bfa9-4620-b2c4-3de13e55f594", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774022829, "uuid": "f5af97f6-a8fe-49b0-bb99-d21878443837", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022829, "uuid": "f244ec0c-9c88-4582-96eb-5a45839dcfce", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c4bfe5-2498-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774037134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037134, "uuid": "1708f5d6-6d8b-413e-8423-f9eb8c05e5f9", "comment": "Malware payload", "value": "5236ae9e231b6b5569f07db86fd46920", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037134, "uuid": "52bbe98c-7428-4ca3-bed5-b7449519fb1d", "comment": "Malware payload", "value": "168ebef015c15420620fea9740ef0c8d1c073d794c92aead2d1eb82b9b2447d5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037134, "uuid": "5bd6effb-f238-419b-b8f1-1181e53097fd", "comment": "Malware payload", "value": "764b5d324cbff3b47698bc73944958dacdde9b81", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037134, "uuid": "8e672911-7565-4389-9e69-758e16c90f81", "comment": "Malware payload", "value": "7f41def39cc232f7d331fc8606f3155612ca98cda9b6b2315c0e64519a61c885e091490f06cf5020fb9617a13813f4bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037134, "uuid": "dcb198e6-92be-473d-a3dc-ea45e7a5baba", "value": "T19F26BF203CA93DF1DE3C0E0EF01B564A7A7447A554E91098EE4FE18666A0F265FCE9F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037134, "uuid": "928c2e03-92bb-4df4-ba2d-670a2ae8f364", "value": "49152:N+kkeeO7V2dkc5jpAvYL3/jOU40tBcgvtkpp42qjR3sVp0JLByvpIP:k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774037134, "uuid": "1a7a1a9a-eda6-4ee1-8497-8c8604c5cd70", "value": 4653063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774037134, "uuid": "c8dacbed-4e40-44dd-b913-448ce3537d5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037134, "uuid": "f7b1ebcc-91d8-4023-9f27-c80dc30ec0cb", "value": "QUOTATION.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d1731c-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046979, "uuid": "6c89c0b9-b11d-48e3-a7ba-ece1bb5f2d0a", "comment": "Malware payload", "value": "8f3196fd3d8ee85d2e10f5b3299d9012", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046979, "uuid": "0db9067a-607d-463c-b311-d371e9adab69", "comment": "Malware payload", "value": "17b77052590234bc80eba16ebe508e85b99933efd3f809205bebd0c4a128cd1e", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046979, "uuid": "043ab4e1-4570-45e9-ad7c-219b833c9709", "comment": "Malware payload", "value": "93cc3926f19be6455599529a90b4c21061a0c0d7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046979, "uuid": "b6608c8d-d3dd-4983-a673-3a5e7c316f44", "comment": "Malware payload", "value": "724163a2204b71bfb45a17a873b93cf2dca968fbe36a17893de6fe2654fad9749035294a7272a48e0dcb7db7f258000a", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046979, "uuid": "24a4966e-6808-4544-a5da-325cf53c2701", "value": "T11A75121953F88B92E7BF0F79E020515987BAB62BEE5DEB8E594CF4DC1482351D920233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046979, "uuid": "e9c49715-ec45-4893-8643-36433a5e9b39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046979, "uuid": "9fda4f6d-6c0d-4266-80db-a49f664a1c32", "value": "49152:ZzRvNExdBSWmPDXyJvvX1K2yDghMP4T4KNx:Zz1qCWuDXyJvf1K2EP4Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046979, "uuid": "a4f0ac52-8a60-4ae2-8d8a-73d75499b6de", "value": 1575424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046979, "uuid": "97584201-180e-49b8-a6a2-9604a74666c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046979, "uuid": "6fcb0541-b388-4fe6-8400-f26dbaeba2d3", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017003ca-2469-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774016883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016883, "uuid": "97de442e-b6a2-4067-9f9d-76eff606fa47", "comment": "Malware payload", "value": "ffdd8124096ca3dd3e92c26165df2e78", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016883, "uuid": "89392d7e-f780-4e87-8543-7c437c356db1", "comment": "Malware payload", "value": "17e94d45a23f0b0df195f7c52ebbc55db0178d8e93bea2328b8761a2d6a771fb", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016883, "uuid": "8b35bbd7-e9f7-4ee2-97b6-5d9528340add", "comment": "Malware payload", "value": "eadb26005990179ecd774e67eff74b769129ae0a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016883, "uuid": "7f72e442-d56f-41eb-9a90-0795641de0ff", "comment": "Malware payload", "value": "983e07fc7743c29d64e8e94fe1387c7e7ad0494be6c21396e204cd39e4aa4c5cef5a420d20b9a2925aae97c719ef9642", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016883, "uuid": "b1963f00-471f-4c81-9cb2-90eea672d1f8", "value": "T182B4234CE65F0F29CBB182424482A4B0FD36F426A7A65458CDF12E5346F94B3EC587BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016883, "uuid": "19d209d6-bf40-42cb-8c1b-7d958a400621", "value": "12288:o2wIs6kl44CuhDFifTwtWrkPTKKOf487P54IWg/aV6sV:psFlZCu9F48PmKg487P5vWH6sV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774016883, "uuid": "b094857f-25ac-4cd3-8572-ec0d694b6922", "value": 533929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774016883, "uuid": "4f68de08-44f9-41d4-a34d-928783a888ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016883, "uuid": "1456751a-9186-4c23-9391-5e1742f489f9", "value": "32CF_Notificacion Fiscal (2)_4C5EC4_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d60030-246d-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1774018820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018820, "uuid": "422d9bef-3424-49b4-bd15-2609c0137509", "comment": "Malware payload (PhantomStealer)", "value": "b8637306748bc54f6bf3a5e5c13132b9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018820, "uuid": "6215b413-ae4d-4e27-94fe-43006841743e", "comment": "Malware payload (PhantomStealer)", "value": "191dd7079969ccb6ce15556059be86747df67a252bf27905aebb8e0e803f9926", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018820, "uuid": "93659915-0155-4983-b45c-51272522e89d", "comment": "Malware payload (PhantomStealer)", "value": "6024cf55c2a5fb319f88aba902bb81ed7d39fa62", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018820, "uuid": "e326a5e5-c1fb-4fc7-86f4-6d0a240c77a2", "comment": "Malware payload (PhantomStealer)", "value": "277379a6fa5db3c744e70f79089ffb2b4c2cdc1b34d686aa69116ba5763c495a7ce09de1fb10d431f6041f3fe17c15a5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018820, "uuid": "51923234-bfee-48af-baed-f65b24a7d8fd", "value": "T1BC35021249C86FB5CFAD1A1890FE161E63F09A8B4416768EEB73BD46AFF7444410B1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018820, "uuid": "5c1beb44-2e65-4c28-975e-934d20cd5d8d", "value": "12288:KFJpa4tFsE4tp1FlQJYhzEldPt+AuYSi2yb8zCLS8tc3V3HWWx1dtjPD7dtKUaic:KFfa4XCtplhhG10xEil3xntjPVBaaguG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018820, "uuid": "afa63d8e-ecc3-4a31-877d-6ac1a911f42a", "value": 1126242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018820, "uuid": "c640878a-00a8-47b7-a202-e85dd223ab0b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018820, "uuid": "9d93afbe-f221-4318-9483-8ef68a368042", "value": "z49FedexShippingDocument.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af6b2f2-2428-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773989170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989170, "uuid": "85c77e80-23c2-416d-90bf-eddd3bd0ba50", "comment": "Malware payload", "value": "ae9cebde92665fd58cddd4121843110d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989170, "uuid": "e89feacf-f1d9-4286-99da-19a6ccfcedad", "comment": "Malware payload", "value": "19d22973789738ba9081ebaee823230512489ecfc680d51144cb3d9bcd4cc833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989170, "uuid": "7c56952f-76bb-4fc9-95eb-d37aae00b359", "comment": "Malware payload", "value": "813bbc1162cf8c78c59ae518057c53d20a7a8ac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989170, "uuid": "43a112df-56b7-4125-a336-07e873151eb7", "comment": "Malware payload", "value": "c227bdbc923b4115c6d94d34b32475a35ad7052f8cb09c2fd1faee8904f6a2e2f5137f8e5a04aa9eabbdb21b30629b19", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989170, "uuid": "944273ac-d58e-45eb-9aee-25cb08131f5f", "value": "T1DC85330A5B22B92A95F514513E108FE31239F2EBD1A0515C1DCA09DA46702F9FBF8FE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989170, "uuid": "83972092-6508-4e8e-9a46-e4c511eda7e5", "value": "49152:vGNuaO0rOAMc8aE596rof2clqPy3jgXn+KkTrRGC:v+uKOAMp7POO8WrR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989170, "uuid": "e50c1400-0bf8-4aea-868d-9bd759864727", "value": 1717472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989170, "uuid": "9046e735-5663-48a9-852e-dfe215deb8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989170, "uuid": "0b00a47e-631c-4b98-b831-4fd8109bed7b", "value": "linux_mips_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abb4ed1c-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040791, "uuid": "e0859c7d-721c-42c1-af1f-93a484cdbeb5", "comment": "Malware payload", "value": "c05c17a209812cc07fc8d838f72ccfca", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040791, "uuid": "7e20b25e-ea9c-4814-8a06-9deb582c79b0", "comment": "Malware payload", "value": "1ab5275f1faff8498b7eafc2799679cbb248172b22d41bad6f85be07abb59259", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040791, "uuid": "0cbaefe8-a1e7-4a4e-8028-8cf94e0d3014", "comment": "Malware payload", "value": "f8df7850faf658f3c21000328e6d0853bd2d6281", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040791, "uuid": "494aae88-6c68-4bda-9797-3e2d4e890711", "comment": "Malware payload", "value": "1b65e3b502d7753bfd0aa6b75dd1216fe32795c0aace93608d297faad2c60bddb4659e14117afcbd86aee166d8453c6d", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040791, "uuid": "ae56e76b-ae37-4954-a574-81e473eac517", "value": "T102069D0BBCA02950C526523A49EA59C62F7DFE4B2B3117C73E50B3B92F726D658F8314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040791, "uuid": "8a059686-19e9-4311-b6f8-3050a5e181c4", "value": "49152:yCDrHlFvoW6vfz16EPf9Anl8ls6nxDTHOv2etap4tE345Sfh:yCnoZnV9A+VnxDY2T+FMfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040791, "uuid": "21462944-08c1-45bb-9d9b-c978123084b1", "value": 3835392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040791, "uuid": "fc0bbc18-6370-4945-8e97-5738119fee57", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040791, "uuid": "8d5ff852-7971-47c5-bb22-fc7084a74596", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563a623a-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977942, "uuid": "ce2d1fdd-b856-483f-a4e6-138f6a065b8c", "comment": "Malware payload (SharpHound)", "value": "721eda696d7cfb8fc11274cf8c7010b5", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977942, "uuid": "4de80a45-49b5-43f1-883e-891f8daa4aef", "comment": "Malware payload (SharpHound)", "value": "1ab7ca1e27fd64196c29df050f1892b98637755eee354ca436bac805a60292b9", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977942, "uuid": "a27c715c-8886-452e-860d-1b0a6688b4d5", "comment": "Malware payload (SharpHound)", "value": "f4fd47c3241f7cab368d50a639914d7554f42f43", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977942, "uuid": "0a26747f-a1cd-4a07-8d62-8f5c0672c11c", "comment": "Malware payload (SharpHound)", "value": "e93358b162842137cdf2853cd956417d1b8cf0c82993852b7e2ec94cdc89f000cc065db1d9b3231f43b13c42edc09bd8", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977942, "uuid": "301167e0-b1e5-4a31-902c-9b519f92e7aa", "value": "T14D55121993F89F85F2AF5B79A03041698BB7760BF9AEEB8D598C74DC2493344D811323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977942, "uuid": "86a03d13-d6ff-450d-aa80-1e7434288e1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977942, "uuid": "c332b835-2bd1-437f-98cb-74fc7b7b542e", "value": "24576:pLIGEDwgrRvNuXoVIa09WmPstYX3Afr3ppM4zH0CYzkong/iN9WCC7wQ:2zRvNE9WmPDXur3pTazFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977942, "uuid": "e2107f00-6c28-402a-8c49-8cc11b77f86e", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977942, "uuid": "db6a5313-620f-4169-b29b-99905dc828d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977942, "uuid": "de9abc50-86c0-4170-aaff-ee1a54595559", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b9f6e4-2445-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1774001476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001476, "uuid": "b8c76b77-c373-439e-885b-60c438b4aa28", "comment": "Malware payload (AsyncRAT)", "value": "dd6a97fb6d7cf9bec9781240ee56eec6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "automated-upload", "colour": "#3FB651", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001476, "uuid": "144bf9ca-162e-433c-8207-3d41765b4bff", "comment": "Malware payload (AsyncRAT)", "value": "1ad0c43a72f290d20938e2ac6b17ffcbba5481c9e12302ca3d977752e413a44b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "automated-upload", "colour": "#3FB651", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001476, "uuid": "99d00b90-1930-4135-81c1-37ff444b0aa9", "comment": "Malware payload (AsyncRAT)", "value": "b4d4c24d9937060ebb5cd9414f8a9d3e22f36518", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "automated-upload", "colour": "#3FB651", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001476, "uuid": "0f0e31bc-2a18-4a2d-971d-201cb1fa12a7", "comment": "Malware payload (AsyncRAT)", "value": "70d74d622889370a180903192b098b87f29a9beff7d0b59b569208137cdfcbb494dfe25a42ffa87729273d617954e545", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "automated-upload", "colour": "#3FB651", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001476, "uuid": "789995de-d731-41b6-9c62-571f985064fe", "value": "T13E232A047FE9C66AF0BE1FBD55F2121143B8E1972503E74B1EE051EA1A237C68E147E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001476, "uuid": "a7424329-f92c-4924-9ecd-68b79b12e12f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001476, "uuid": "018c6899-8a82-41b1-a9b4-651f5acab2e1", "value": "768:amfeGDufpwIWAAjhjrju3TSN1xDs/XvuIopQ2J3JYRorfeu0GNyHqVgX:DPKpcNPS3qDsfvA+2nYRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001476, "uuid": "1812bfcb-f49e-41f6-9775-78bf80c9303a", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001476, "uuid": "2f6602b6-1cda-4890-9a66-437eb0e49376", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001476, "uuid": "4a0b12a6-cbaa-46cf-bf05-c6dd84aaaadd", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340f3714-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977884, "uuid": "2eb958de-e7aa-454d-bece-feb95aa7ecf1", "comment": "Malware payload (SharpHound)", "value": "74625ca2082cdd4feb15c59148f5aa1d", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977884, "uuid": "a6bf18b4-4e86-41c2-9946-e47d56286fdf", "comment": "Malware payload (SharpHound)", "value": "1b86c5d26301af618d7b84a0a8ed10bb07e4cd2825bb5e331957d766fb96b16a", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977884, "uuid": "4fb52dc4-59ea-4b5a-9150-59a4273f367d", "comment": "Malware payload (SharpHound)", "value": "3a3424e8abe154046066b1b02f1f22d8286e0f76", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977884, "uuid": "c269a757-feb9-489e-883a-70016a8f5ade", "comment": "Malware payload (SharpHound)", "value": "ac2befde84316299aa9622d330393ac9fd8262242ef4502f446615d31a4d3330f1bc9fddd80c87208cb059ce01246df5", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977884, "uuid": "840087e3-f09d-4678-acec-49b5ed73e860", "value": "T16B55125893F84795F6BF0FF9A42681598BBA7527ED1DEB8DAD4CB4EC28823548500333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977884, "uuid": "a840b739-0151-495b-bfb2-f1e62f1fcf60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977884, "uuid": "02d40c97-87d9-4251-a728-8406c6a92135", "value": "24576:tyqgnLIGEDwgrRvNuXoVIa09WmPstYX3Afr3ppM4zH0CYzkong/iN9WC:tyyzRvNE9WmPDXur3pTazFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977884, "uuid": "02ded718-b7e8-42ee-b74e-42f00b2d8fa1", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977884, "uuid": "b0df4674-d63c-4d8d-9c2d-8224925379e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977884, "uuid": "5934a16f-bfff-47a4-b9b3-09adaceb8346", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a73c5e-2424-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773987327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987327, "uuid": "55315f65-0e30-4d3e-8619-7f0db6b92927", "comment": "Malware payload (Mirai)", "value": "163d06b013d78daa904dcb905d88b0ce", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987327, "uuid": "318fac5a-9d6e-4a9b-b5b4-41532fba8d13", "comment": "Malware payload (Mirai)", "value": "1b971a574361297ed7300120f61279bce1c5208975691e69f95ad686df4a7f74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987327, "uuid": "912e03d0-c3c5-43e9-9399-2ff7e55f1d72", "comment": "Malware payload (Mirai)", "value": "05622a319a5c97455849f0dc65d9f404c89ced97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987327, "uuid": "435f36e4-91d7-4d35-a49a-0cc8149d05f7", "comment": "Malware payload (Mirai)", "value": "c4214551ad9f89961bd549a99d1c6d774d46e8fc2b33cc1046cf9ee39260c286ff228a056b56b1b53ca0e5384a8f68d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987327, "uuid": "6ac4fe92-e353-4240-8d39-fee7589d3adc", "value": "T1EA262A97B8918683C0E43676A8BDC1C433636EB99B9763576D04FE3D3ABE1990E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987327, "uuid": "9b343667-13ef-4e30-ae2b-5cfd6e09e2b7", "value": "49152:Q5dA+xsrUANnymyeT7q37z/WPHkCYQaa9U1F1:KdA+aQAhymfT7qGMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987327, "uuid": "8a8097c7-cefa-4dca-ae05-07c389113b50", "value": 4587520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987327, "uuid": "43bc975f-050f-452a-ba58-aaff7f1bb3bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987327, "uuid": "a5a3e4e1-8678-4db7-8f05-dba4488f0ed6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019965c4-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978229, "uuid": "0dbc85d1-8b3f-41c6-b708-a4ea7da0db0e", "comment": "Malware payload (SharpHound)", "value": "b167da5095a79b7f7d2f905c6815e7ab", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978229, "uuid": "2653e280-d0b5-49f8-ace5-6b177a530164", "comment": "Malware payload (SharpHound)", "value": "1c41b224a3bd81315cf3bcd4b0392945f5de5dd05641ba39f06772f285a2132e", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978229, "uuid": "9082ef01-ea97-40e4-85da-4087e386be8f", "comment": "Malware payload (SharpHound)", "value": "2cea478b84acb3744942e2ca0ac454e2e6c8867b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978229, "uuid": "e7ca1044-aceb-42c8-a8ab-01a259740c0a", "comment": "Malware payload (SharpHound)", "value": "728d193911ee3200d31d4caee0529ed26949c73acb45e3c7c5e67d3a3b1bb9afd69ed2177ab25591b37240155bdcc813", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978229, "uuid": "67a56c3a-9616-4f85-a858-64a2eff77025", "value": "T15755122943F88BA5F6AF0BB8E0254155CBBA761BFD6DE78D994CF8ED14473608910323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978229, "uuid": "a8b3c9a8-353a-49d1-ab8d-e8b66525025b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978229, "uuid": "ff092b52-995a-4d51-9b5d-2b85c40ef0d4", "value": "24576:kSLIGEDwgrRvNuXoVIa09WmPstYX3euT4irNkong/iN9WCj:k9zRvNE9WmPDXjEONFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978229, "uuid": "bf64db1e-f783-440c-9fae-c51161c96b6e", "value": 1315840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978229, "uuid": "3fbfbdbd-7fc8-4db8-8f1b-252678d2104b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978229, "uuid": "31d7e22a-6f3e-4660-88ac-a2c6e2c24f81", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b2d094-249c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774038897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774038897, "uuid": "1aa74a69-908a-4643-8ffb-f5ded7d8807f", "comment": "Malware payload", "value": "24ece98caeefbf0d424e1d4bf50b7d14", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774038897, "uuid": "0a3d986e-36ba-4d04-bdb4-157e1bb6a442", "comment": "Malware payload", "value": "1d61e4b9490bd6d9ae2dc75c3a029e284bb0dba5578b0b1f607e0c5b70423204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774038897, "uuid": "3dfee67d-4199-4d32-ae22-cd7a42c52ca7", "comment": "Malware payload", "value": "54b32780eb31cd21015a6b052e988da19147c40c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774038897, "uuid": "ed731080-dc5a-44d9-8c36-e7a9051f7955", "comment": "Malware payload", "value": "864050647eb4230590a6ffe7e1fcd49bd87944ebfc49d9675f9c415c436cd25d7e9d1f533c145fa800728bad9ae0045f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774038897, "uuid": "b7378626-e51c-473e-8062-e1c4544f9526", "value": "T14FB307CBF800DDFDF81AE70A8857040AB130BBA644825B376257797BED3A1D91477E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774038897, "uuid": "18c945d9-ce7f-4378-8d80-077cf4c1b888", "value": "3072:6x3J1ZduMz15s2g1UiZOqARXG9qAHZVqjbiTLB:64c1klZOqWX9AHvLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774038897, "uuid": "5ba984a9-7c74-40bb-bb09-02d6768303f4", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774038897, "uuid": "1c91ba8a-1cb7-45aa-96e4-f68d8ff41ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774038897, "uuid": "d43ea6fc-92ce-4c9d-adfd-c39a10a9e0fc", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79e67d1-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978078, "uuid": "34263c2c-5aac-417f-9903-c7c9b2cd4955", "comment": "Malware payload (SharpHound)", "value": "89b56be327ffdddd23820f8cf394ac7d", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978078, "uuid": "279b3b9a-d501-47f0-b7e7-892f92b98e9b", "comment": "Malware payload (SharpHound)", "value": "1d829e2b12ce2467ad1248605894ff24ed9559e35c17d93cf685b66cbea3d6f9", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978078, "uuid": "ce055b90-2b36-451d-8f79-a06ae27ecadd", "comment": "Malware payload (SharpHound)", "value": "7d2464e20d9978f40e56d8aad543a3f5bbd5645e", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978078, "uuid": "0b849b5d-edbd-41e1-87dd-a813ea6ce456", "comment": "Malware payload (SharpHound)", "value": "206132da5b4754f5ed7f75e83f947e2446cc843dbc7e1410fcb9bb4be2ead0618aec3d42e33388b835b0b227df1d0700", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978078, "uuid": "7989f7d7-6d07-474f-82d4-e17e976071a0", "value": "T13A55125993E88B92F6AF0BF8E0218154C7BB7617FD5EEB8D9D4CF4E824893559810323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978078, "uuid": "8db3283e-c5c4-4bdb-b351-d3ff23354ccc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978078, "uuid": "b49f9cba-c6ae-41cb-86aa-9214ea6258ee", "value": "24576:b7LIGEDwgrRvNuXoVIa09WmPstYX38SXDNodEssEkong/iN9WC:bwzRvNE9WmPDXP2ZsEFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978078, "uuid": "71eaaf51-b1d1-4614-a318-84237e439958", "value": 1330688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978078, "uuid": "fabe7d71-caaf-44a9-b309-3124e6bf33e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978078, "uuid": "3fe1a622-b94f-4773-b62d-5d478a6df3a4", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e0313f-2425-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773988012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988012, "uuid": "1d134821-141d-4905-b2e3-f6a80a12f0cd", "comment": "Malware payload (Mirai)", "value": "a1aff10953e4d4afd1d1ad9c089298e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988012, "uuid": "a4a7bdc1-5de0-47f7-91a9-e1195dff95db", "comment": "Malware payload (Mirai)", "value": "1e3d33c6f08f8fe06eecadf7efa308fc78f978f5efbe19aa5927153bd350f22b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988012, "uuid": "be3b276b-714d-46ae-b353-65ab4f6fa36d", "comment": "Malware payload (Mirai)", "value": "8ce7f2daadc4d30a8f8b02fac29aac606117b999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988012, "uuid": "54dda443-3f89-4acf-a2c8-4baed979ce93", "comment": "Malware payload (Mirai)", "value": "32f329269cb07e2c5831b658c330bf366c56969df4bfeb89d54a25f67e3a593ceefefd762a281d33741270c25474320c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988012, "uuid": "463397b1-65a3-4263-aab2-06248af5a4d5", "value": "T18613F1BF5FC32482C8ABD1F1665EB986F8E1C05C7BAB43174CC019811CDD790E22CAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988012, "uuid": "8df2b068-be93-43c7-8f50-80843e71fd7a", "value": "768:PJZkyxKkzCWKJx6Hr2OkMFF+m91vMyA/NoNG0OdZFZCe7h+cWYCT7Bcw:PJZkyxKeKx0r2IfY5/NyyFBN+hfBcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988012, "uuid": "74c9e165-3bd1-4a1c-b365-51ec8e4d2b79", "value": 43152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988012, "uuid": "2c1c0cbb-ac55-43f6-bdc9-59350171d746", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988012, "uuid": "1d93b296-aff4-48db-a2f5-ab2b1a64e8bc", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b0ad65-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050524, "uuid": "92658611-d357-488a-9639-09fc294190d6", "comment": "Malware payload", "value": "c653793e1a982ba1c44ee92acc9cacaf", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050524, "uuid": "95f3174a-9f89-4c5d-914a-87e7fc96b957", "comment": "Malware payload", "value": "1edd5a4a49e02a350ac8b55411cae6bdc5d2a95c879600e6952f55c315ff8107", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050524, "uuid": "fd2cb242-7070-4a69-b73b-c031f99234c0", "comment": "Malware payload", "value": "35861741f5afacccdbf720c55bd9b330bebaf904", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050524, "uuid": "32f20908-e206-446d-a171-f512f75375bd", "comment": "Malware payload", "value": "17dab6024a37296110e435cfc8bb8316b5b4f0cd64a29bf9973b7d1c08256760b39cc183246b9c01456600043680199a", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050524, "uuid": "c2b364ef-d836-4e7f-ad3e-ae3fc3cacc3c", "value": "T1EBC67D557C1DB667D9C979347F6292943238BC049F82C3276618BB7DAAF2348CF23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050524, "uuid": "23860912-ccd8-422b-9515-e9e248c753a4", "value": "98304:kQlF7tiRfwKy+Iq76y+6bKwtzxgMap2l7xb3I6gcdqtUbTNq6lj2Ef:k67tiF7fIZydt1m2l7Fnqcjzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050524, "uuid": "a906a589-af76-4e1f-b906-8eb0fd77f92c", "value": 12320952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050524, "uuid": "6c110a60-9be9-48e2-9080-99105da84abd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050524, "uuid": "ae84b431-efa3-49bd-b8ab-33f37aedb077", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09815cb0-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046962, "uuid": "3e29ef36-910e-4a67-9012-82fcda5237de", "comment": "Malware payload", "value": "31098fcb3efc783619a2a651dfc4a255", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046962, "uuid": "0981b310-86d3-4a4c-92df-15ea4f195c27", "comment": "Malware payload", "value": "1f752e320d62fd9c08046162a4b4389909d0c3d1031b18be7cca118385b43e9e", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046962, "uuid": "513b6d97-0fb8-438d-82c4-4aee30c1e2d8", "comment": "Malware payload", "value": "18a748a33c26ca9dded759d23356aeda98c41545", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046962, "uuid": "0e329427-e8da-4e93-82b6-fe72a7620f81", "comment": "Malware payload", "value": "708c294f283b458ea10fc8316907f47bf76a234a7b3c8915ff82f4bb43887d0694acc1bbc0121577337a4b5e9da435f8", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046962, "uuid": "bfbae486-4696-4e01-83cd-7dd7143c1171", "value": "T10445122963F88B55E6AF1FBD503242154BBB671BFDAEE78E588C70ED18837009851237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046962, "uuid": "6e4af6b2-df40-4c27-a34c-42558cf73c4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046962, "uuid": "34ce8532-d4f6-4777-acd2-f0d892b46a53", "value": "24576:C3LIGEDwgrRvNuXoVIa09WmPstYX31FS4eD3IJXuAkong/iN9WC0:CEzRvNE9WmPDXlHe7I5vFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046962, "uuid": "3f8a5734-d7d7-4536-805a-1baab10683a6", "value": 1275392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046962, "uuid": "14d6654c-4814-4d99-ae9e-2b7c5ab66557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046962, "uuid": "3629585b-e9f2-4a72-aa36-7bf7ead64863", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a241e5d-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050479, "uuid": "78faa4df-a42c-4b73-9a70-cfc4ef264324", "comment": "Malware payload", "value": "6b2d6cf54fd1f9704e8fc8860fa5b189", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050479, "uuid": "ce5c8612-b5ab-4991-8ec1-43be2ea2bcc7", "comment": "Malware payload", "value": "202c08a83b03a70a9fc262427e3341695c98145d4650d73350db418dbe191860", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050479, "uuid": "e1768849-ab1f-4ff4-94dc-fc3be3c94d8e", "comment": "Malware payload", "value": "3666a8e670cb323e618f3f03282b30c630632f9b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050479, "uuid": "a78435a9-22d1-4961-9429-0ac59619f11b", "comment": "Malware payload", "value": "4b1cc0b038bf0806461040b6edb9a5d5997796386bd1610b641b7b892e1f9a721ed57e4a8f07338cf7582855030e518e", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050479, "uuid": "831074e8-39b1-4ca1-b803-f2c513b8e657", "value": "T1E8D64A03ECA585F9C0ADD134C6669262BB717C495B3027E72F60F7682F76BD06AB9310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050479, "uuid": "34a22898-9329-4293-8eb6-293fab580831", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050479, "uuid": "b40639f9-b1fd-46fc-b374-22e2ea435070", "value": "98304:9TRbIv5Gchps+behYDR7CCkFqCoDymv3/67NLi4F1RAYmGEa:91cNbkYDRGJ8Co7v3CTAFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050479, "uuid": "275fcc85-b9c7-4b47-b4b7-01a45e414bd9", "value": 13652480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050479, "uuid": "f98f1698-a92a-467e-84c6-87954cb108ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050479, "uuid": "d4d430e3-bad4-45c1-a30e-51cca2e01f2b", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb0c827-2405-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773974114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974114, "uuid": "66209f8a-644c-49b7-8f04-67359710424c", "comment": "Malware payload", "value": "5a93ba3ff880c42e10856f9238156ce3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974114, "uuid": "4c37572e-fa45-4c2e-be8b-af28e0fd3f77", "comment": "Malware payload", "value": "204b81759fddbff195fc2234ed15e557f52a75762ff9fc02687fe69102c5fb68", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974114, "uuid": "a0c911b3-7bf2-4628-a80d-9ef1779cc36a", "comment": "Malware payload", "value": "55b9f2418073bf03694381f2bd4c21e14e6828a9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974114, "uuid": "ed5fc1ba-86ea-4e98-9344-e25fdcb5d3d4", "comment": "Malware payload", "value": "2385828a8adad3ef06a6f760a89b974b25cf2ca4c275dd40661518f3f15ee1d98aff098aa07bbf60138029ab55f12404", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773974114, "uuid": "4a984d18-97e6-485a-9fce-afa2e86c5f8e", "value": "T1F65733C9D425454FE43ACD7C80646B49CA2C2F7ADD93588BE279339660FBBE0717E40A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773974114, "uuid": "c6992b02-fe05-4458-9562-0c571cbbb1a6", "value": "786432:i/2NqPxubtljat/fJWHjEOHBVXcJntE3V75E4SpgzDt:iONqGljat/B3OHBqk3N5spgzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773974114, "uuid": "4f96214b-a7d6-459e-9d76-1d65cab84faa", "value": 29364224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773974114, "uuid": "4c81206d-0f92-4e1c-8a8f-8320f2d81057", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773974114, "uuid": "2dfd6896-ec09-4307-aabf-265b413a2533", "value": "Hikiko Life.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b6b620-242a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989859, "uuid": "48f5b3af-5b53-4b1d-ba66-2d4a4a6517f3", "comment": "Malware payload (SmartLoader)", "value": "06b0c2ff9775198d58d40e3d9d91062a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989859, "uuid": "7df6b160-cb01-4812-b25d-f610f64d08d2", "comment": "Malware payload (SmartLoader)", "value": "213152bd967be9075da8775ec058dba00d51e0a365b73f18afeeeb6cfde9d4a3", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989859, "uuid": "4befa38e-547c-4383-91c5-83921cb3462b", "comment": "Malware payload (SmartLoader)", "value": "7dff8d2f49d4e277e9655cd330f9be6c9883b51b", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989859, "uuid": "f434d49a-39bd-4e22-9666-6ecdf42f4638", "comment": "Malware payload (SmartLoader)", "value": "e0a99e57a1cd54d9b52af7f9a581f10c21cc34ca44564f9ccae48d0c50b3260741c9549616883108d0a4b17371132a65", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989859, "uuid": "62ad2cba-72f2-44e8-a63e-35fa13fc910a", "value": "T1C9C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989859, "uuid": "d3be3f9a-98ef-4271-b00d-4176fa46441a", "value": "12288:4A7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWHSFyorOIic/7MPO:Dm6Jj6ESfUxZ91kmY/99z8yFXicTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989859, "uuid": "4cfb94ff-a016-4ad8-a34f-be1b98e7b8f0", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989859, "uuid": "33920e98-6f2e-4798-b088-a744d3276bb9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989859, "uuid": "13460752-1b78-43c1-9727-5130bdea427c", "value": "online_Calculator_corporally.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28926c03-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041001, "uuid": "0072a03f-d6fc-48e5-8c1d-37f2105c33cc", "comment": "Malware payload", "value": "40a97774ef7743cd408beb85460d83d9", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041001, "uuid": "3d90b023-4a7d-493e-a88f-a5f0f65a76c0", "comment": "Malware payload", "value": "215d880d85cd9784f3773bea68f1d84f2400498db8ec7556016e3e4f9380a233", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041001, "uuid": "044019b3-b5fe-445d-9a19-59ff9b577987", "comment": "Malware payload", "value": "4386e97aaf08f1d52467ea87dcf29bfce9f02489", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041001, "uuid": "d676dd5a-4c38-4cae-b251-0a849989a201", "comment": "Malware payload", "value": "5c1cf70377b135c0f49d2427192501fc176687062924db3557e719ca4504329dce638228f938729d6d84f1f362ffc1ee", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041001, "uuid": "64980e91-0fe4-4540-8580-a6f873c9b33d", "value": "T1D2069D07BCA02950C626523A49EA59C62F7DFE4B2B3117C73E50B3B92F726D658F8314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041001, "uuid": "8c6c6410-9c82-4eed-9eda-7c497265cf61", "value": "49152:pCDrHlFvoW6vfVk6EPf9Anl8ls6nxDTHOv2etap4tE345Sfh:pCnoZnI9A+VnxDY2T+FMfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041001, "uuid": "edc08c6d-c073-49f6-a10f-47e4eb73cfb7", "value": 3835392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041001, "uuid": "680ba1c2-d51b-4efd-a4c1-280381a0fefb", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041001, "uuid": "ad45407f-6ef0-4bb7-a256-fe706415de47", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ce5627-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040813, "uuid": "51a8ecde-0063-4916-b9c3-9181c72c32bd", "comment": "Malware payload", "value": "af0d9711ed73785c2651407beb420622", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040813, "uuid": "3c48e59d-4a35-4631-8b1d-883cf18c33b5", "comment": "Malware payload", "value": "21880850209cf23af96c968f949cd0d69cef2b55e340d462135acbcca3ca2ce3", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040813, "uuid": "edbbd0e4-205e-475e-8fef-5565b153cf21", "comment": "Malware payload", "value": "006074cbe910b7d55175879954a8f386da0b31e2", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040813, "uuid": "e827ba04-b3d6-406a-af48-10fa31cd148b", "comment": "Malware payload", "value": "0a7ddae3a5f76cecd55061fda97ca0bdaaadcb7ae71d3f113c4ffd5883c8b55fc145f506ebc3ad65838f6106f6f72568", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040813, "uuid": "198bfd81-5abe-419b-a487-1eec9f72e2e5", "value": "T1BD06AF45ED9724B5D603163A49EF56DF0B2CBF0B2F319B83B9443B6AA17749704B222C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040813, "uuid": "226d94d2-9e3b-4359-8c5b-aa6f50e0ce4a", "value": "24576:j8HerEUBLQlcAwC1hKYIA5oZQ0sGtaVJpddptySBO3n1Wvx/QZbQMRT4MwFDMJ6T:jaiLb/FmQ16EAumo/61cpxwLa+2E6Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040813, "uuid": "09f9bfd8-f7dd-4887-9aad-d238b7b56ce9", "value": 3755184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040813, "uuid": "c56f184d-14dd-47d5-85b2-2c40f1ef9f38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040813, "uuid": "b0cd9f83-8c01-45eb-851b-9d1cf777f41c", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471c9e03-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050501, "uuid": "4e48eddd-885e-4353-9ee7-71f57caaaccf", "comment": "Malware payload", "value": "2c4bfd7252ed039eaa174a123f4d7bf2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050501, "uuid": "24dd5a9f-e4b2-4a81-9008-82aaa2a177e0", "comment": "Malware payload", "value": "227fbf7e8db158b920b6539137483b64c26bacc7d3dae726fc4ba4dac787e211", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050501, "uuid": "33c62b88-760f-497b-8f79-1fd08ade08de", "comment": "Malware payload", "value": "74637223c8dfd65840fabce5bd2e135a3366b7ab", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050501, "uuid": "45048ce1-e7ca-4f5b-8c6f-84b9974124a9", "comment": "Malware payload", "value": "f13cb0f0fe9aae022782ed5b0aa4d6f187588da5aa1ecb244bb33a5cc55ce59e15a5e746e85c1627c32703263bbd0d70", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050501, "uuid": "d614e438-7e98-439e-829a-d5ec4e522335", "value": "T1C7D64B43EC9561E9C0ADE13486669713BB717C495B3137D72BA0F7282F76BD0AAB9300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050501, "uuid": "03771758-86c2-4fdb-918e-24893016b78c", "value": "98304:vS9DixqopORpZp+I9C7sXPZntthc0P6mrd6wJlVp+aaE+ED:vdpORXp+IUsfZtt60imAkH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050501, "uuid": "b561cb71-8c44-4e98-b44e-94fc8e49e6cd", "value": 13458112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050501, "uuid": "43991486-1dc1-4297-be6f-9d9f3cf20c45", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050501, "uuid": "ddabb87c-e1ef-4834-b40c-f13da9eb6b87", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b28910-2424-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773987331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987331, "uuid": "ebe8912b-9787-4ec8-be58-7364ea9adc1f", "comment": "Malware payload (Mirai)", "value": "dd186ed002318257e55c1115b0cc0749", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987331, "uuid": "1c0164fb-498a-45c4-b0ae-f5d5678268a4", "comment": "Malware payload (Mirai)", "value": "23f16417f68a23fb9f9178152cd0a58d0c047a98147601adf40641aee9f70b8d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987331, "uuid": "a374706e-01a0-4fa4-b9bd-c26d7911c4e2", "comment": "Malware payload (Mirai)", "value": "10f765af5a23865e21a0b487da2b46bf5addb2e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987331, "uuid": "f8cc84d8-4305-46fa-8ae0-e95ab6a09408", "comment": "Malware payload (Mirai)", "value": "eb33220c74bb2f0ad973f928679363526d09fab79e5e69d1a310e4796740f79371b26a2bd1866f22dec261c71257ea53", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987331, "uuid": "b8d3dd2e-7166-4624-b0e6-125b517fec9b", "value": "T126261A97B8918683C0E4267ABCBDC1C432672EB99B9713576D04FE3D3ABE1990E35314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987331, "uuid": "08fb7ca4-ec69-42f9-85d0-f9c86c3a9d6d", "value": "49152:LOEq5NC3J2lY+JXmtgGxlo8CnRo8FBU1F1:CEquB+JXmSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987331, "uuid": "8e097204-f046-4276-8954-e3c95f825bde", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987331, "uuid": "73c79b46-914a-40b0-b799-3a2daef8dc0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987331, "uuid": "a083e43b-ab8c-4ae3-b519-e969b86a864f", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ecf2c1-243c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773997824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997824, "uuid": "caaaa211-a318-45cf-9933-ada0a6f02b23", "comment": "Malware payload", "value": "c05fb811b05ba9e22e63be8888ffff1f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997824, "uuid": "e2ff580f-cfde-4595-ae8c-d32cab6dd79f", "comment": "Malware payload", "value": "2655a1596a595b54576fb72ffb57de0725c2dc4f0cefd3803346015b8d0e04db", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997824, "uuid": "851b28ea-53a2-48c3-8e93-431bb7653321", "comment": "Malware payload", "value": "d28bf963b5f4a2d924234ab9a92c337fa8ff95da", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997824, "uuid": "bfaf30f1-2466-45ea-9c1f-65dabf9fd5ae", "comment": "Malware payload", "value": "ae0c76695c84ae55ecccea34c6426e2863f1138bd58383e83e5b35b24b0f21bb697f0be51145f1935b3d646e62838eba", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997824, "uuid": "e1a4ce91-0926-47f2-a19b-60564cd92f15", "value": "T1D2B321AA49CE98FCCB5F642C561F5D07DA5E5213022DC490BEDE9F643F319B031A96E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997824, "uuid": "de1c00ec-e401-49b3-8654-0f0f4ae633c9", "value": "768:xi0cl5QvCGcN5b8W7obq8qunJM4jB1Ya/e32HgLYeSEjWlhrZxU40MfOLv29gZg+:0L3niFjqZgDCR7+qZE3xPZe4Odd1qA/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773997824, "uuid": "97a5cc9f-f371-4a44-8637-5208f2870b68", "value": 113995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773997824, "uuid": "b3330bc6-cb54-4a3c-825a-ab53ddfb09c3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997824, "uuid": "85aceac2-fc40-4788-aa11-ea3c8f625ff9", "value": "Beta_Journal_Germany_5316.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca99d3b1-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046856, "uuid": "8826f206-6edb-4684-b797-9ba965a1269c", "comment": "Malware payload", "value": "52b218329d00429f6a7a3a266af1b771", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046856, "uuid": "992e2c0f-4a86-466c-917a-4ade0b721432", "comment": "Malware payload", "value": "2691eb3b9b7710f2bf7864e7c88d038e431c47014d3ccd425116442228d44f40", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046856, "uuid": "606e09b2-6069-485b-8c5e-1f71c3c2eac5", "comment": "Malware payload", "value": "18216ae71ad42377e9dde0d037872d4e4f393973", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046856, "uuid": "d1ca4d75-ca92-4568-86cf-909d3a710808", "comment": "Malware payload", "value": "453df87416a74cc802897eac25b7d07a7d795c272a928c390f3aff640a4da19e25e01c8fa004ee8a1ba1676df000d145", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046856, "uuid": "aab08db6-9f2e-4421-bca6-5e5339bdf877", "value": "T1EB55122953F88B95E6AF1FB9603102698BFB7717F8ADEB8E594CB4DD2442700D851233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046856, "uuid": "11e836ce-3456-46b7-b332-a7e06d143046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046856, "uuid": "f06cd101-9851-456e-95f9-9d35483e5e32", "value": "24576:QbLIGEDwgrRvNuXoVIa09WmPstYX3HcVIGtSljkong/iN9WCH:QQzRvNE9WmPDXXs1gjFK4WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046856, "uuid": "781df0ac-d05a-429a-b8aa-ea4d232377f4", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046856, "uuid": "ae662f33-1df2-475f-921a-06e0ebb1a6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046856, "uuid": "deb6648d-5a68-4895-96d1-fb7ddb936bd5", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc99995d-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041276, "uuid": "fdc97a38-b38d-401a-83ca-7c81516c43c5", "comment": "Malware payload", "value": "4a2081520509ad1d570a4fd50e1a3fc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041276, "uuid": "a91ce993-3166-4df6-ab4b-1b5e8bfea25a", "comment": "Malware payload", "value": "2737d317df54fa02f30ea799617d067f89a0babb426dbafdc2d50d36e1b7297b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041276, "uuid": "eed564a5-fc05-432e-a5a6-97a579b14386", "comment": "Malware payload", "value": "5e82784936ae7ab11ebc9f698dc04520b9dd18a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041276, "uuid": "9b2c9fbf-a6ea-4278-97d1-a35ccd9487d2", "comment": "Malware payload", "value": "f01946caf756d08ab1342fa11b2b46be8b5719876c4a446d0c596a4fe1f7a80a45fb12b549a06bd61385817ad9368771", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041276, "uuid": "d71bb1b0-cdb0-446a-b3dc-e9a5a0694819", "value": "T104B37EE3D607EEAFF1AA8BB44DA3497862D4106326F78593E3696E011B052D04D1EFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041276, "uuid": "984df1c9-9915-46d5-9b02-fa06505727a0", "value": "1536:mNA7dksRK75rmVqmonkXNcqq3L6EgYKAphMAR/D1optLzi2UkJuBWuA38EiagPTM:K75rmCkX4wSuW2UjVs4ryee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041276, "uuid": "9f359974-80f0-40ca-9b6e-9174731abf79", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041276, "uuid": "975b81ac-c849-4a67-870c-81691d4da644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041276, "uuid": "4aa72720-772b-4ed2-bb09-8d02a8a559b1", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6251756c-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001155, "uuid": "90850d8f-3950-49d4-9e3c-8ac5ea6d85cd", "comment": "Malware payload (Mirai)", "value": "3900c585514c363314b83f33c6e0106d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001155, "uuid": "f8706108-17d6-411b-af55-f5b2f835028e", "comment": "Malware payload (Mirai)", "value": "27777a449104d410d1d076bfc449945a0b9369206efc2b12bb9e830d7689d470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001155, "uuid": "3c80e990-6906-461c-9790-bc0bbc738e21", "comment": "Malware payload (Mirai)", "value": "12cd00c0904f4a69710f9a9283048f38529807b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001155, "uuid": "85352c07-f9ae-4695-af9d-b0440bcff0bb", "comment": "Malware payload (Mirai)", "value": "ce7141b561380561baac0d1701beb7ceb4c29c5430ccaacb3358a16fb2699454e44b573a679131a2fdf8900da9ce799a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001155, "uuid": "874c76b5-aaa7-4ea2-b24b-14e63ae585aa", "value": "T1D2A36CC5F643D0F1E84304B16077BB365B32E1B9202ADD43E7B9AA32EC91951D61BB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001155, "uuid": "2475cc94-1e1f-47a8-8eeb-b6a016cb91c8", "value": "1536:85E/ZVt5rcLcCaRg1lo6Qwo2xlh2uvNlobSpzSjQ2tSP:85EBVt5ogCaG1lYGx7v021P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001155, "uuid": "e96bfab9-a050-4a67-85fb-2e3ed086f68e", "value": 102984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001155, "uuid": "8c67f323-704a-4ebe-95c5-7af5c940a2ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001155, "uuid": "267aa09d-1417-43c6-bfc9-fd77152c8f45", "value": "t", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab37dec0-247c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774025329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025329, "uuid": "f415a139-5ea9-4047-8068-ed5039886e49", "comment": "Malware payload", "value": "2abf86e0ecfde8513c18feaba9eb217b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025329, "uuid": "291c18fb-fada-4d8c-aa95-016946cb88b7", "comment": "Malware payload", "value": "27fb7ec5a25aa6bfb397c4e3a0edbf4ed36a6c7b8c5f34c55c9a45d4dd7bec65", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025329, "uuid": "7f5db293-68fd-440c-aebd-72be37923167", "comment": "Malware payload", "value": "0a7cb6c970154c6a11ce5eee5bc5cbbd507785af", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025329, "uuid": "3fe79fb0-046c-4802-b70c-51ae149b06b3", "comment": "Malware payload", "value": "f80c1f87b9092793cffab7d78c808ace35dda54a01fe037b7e364b9948ed82e3eddb4dbf0beeb6e39b2c7e2a241f678a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025329, "uuid": "87f8b7b4-5b35-4b62-8e3a-b1d69c7c6ada", "value": "T1DD96E42BF2A49D68CD9D813EC0A28A439CF375771F32C2E75593F3744A129C15E3AA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025329, "uuid": "828f84b0-5577-4e3d-a7dd-73b0e68ca2bb", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025329, "uuid": "0e68c319-ff12-4e7c-8c0f-09412d826e9f", "value": "49152:pEC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0Ppz/MiAyf7twKV1qO2:/YCp2JK/dfP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774025329, "uuid": "58d7cd27-6cfa-4ab8-a5b9-aba11701c6fb", "value": 8645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774025329, "uuid": "32ab9cc5-7ef9-4168-8795-8dfb9b80ae4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025329, "uuid": "62569a1d-f372-4611-8a2b-56dae8ea69ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "940ecacd-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978045, "uuid": "1e7ec899-0bf2-4e5f-9ecd-f7345aeb1347", "comment": "Malware payload (SharpHound)", "value": "942b84a367c3069374351d01bb8e405c", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978045, "uuid": "c0223b09-b8ff-4a67-bd16-6067b6a235c9", "comment": "Malware payload (SharpHound)", "value": "28153d7b817e07fb34e60b189dea378e759e3c36a46e4ab0fd2a09c1d86d62b3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978045, "uuid": "b8ccf9cc-7bea-4a17-ac2b-e24772385577", "comment": "Malware payload (SharpHound)", "value": "febee9836263f8c9ac9e3619a947c2f511e18d1a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978045, "uuid": "e5adbaff-7d6c-4096-bace-450f398cf1ef", "comment": "Malware payload (SharpHound)", "value": "2c616df07dc7ada2499e0f70fe6f171eb8c7bd22c91384931ff9538b191bd8f63ead0206655545f9ef9cc2dd6366b06b", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978045, "uuid": "6a285cb3-a3b4-4443-a91c-f7bbc5046a9d", "value": "T1BC55122A53F847A5F6AF0BF9E4218055CB7A7527E96DEB4DAC8CF4EC28423548950333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978045, "uuid": "459525d9-ae30-4329-8698-957583a26f3a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978045, "uuid": "1814aeb1-1851-4c4c-94fc-375e3d6e6864", "value": "24576:nY+zNLIGEDwgrRvNuXoVIa09WmPstYX3iAQTkk7kong/iN9WCh:nY3zRvNE9WmPDXWok7FK4WC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978045, "uuid": "0602d5d0-0b96-4b4a-a831-040154a46cf7", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978045, "uuid": "3f6af6e9-a234-4338-ade9-968622854bea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978045, "uuid": "fddf12a1-5837-4326-81c4-caf4a5e6a4d5", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15e9176-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989288, "uuid": "6138302b-856c-4a99-a936-5a920ffd68c4", "comment": "Malware payload (SmartLoader)", "value": "6afc9cd080fa4e037b32b251716f266a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989288, "uuid": "72fbf718-5808-4d2a-a138-2a87e00f0bd4", "comment": "Malware payload (SmartLoader)", "value": "286798871384015af27e458a090cafe3df92d9135c8d0663c439baf0c5728341", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989288, "uuid": "e8113408-3ad7-4ba3-9872-92eb285f50dd", "comment": "Malware payload (SmartLoader)", "value": "7bacd42b3dd5bc6c4a7c0874685e28f5d87ed44e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989288, "uuid": "968fb7f5-97ff-4674-9551-968b70ac189f", "comment": "Malware payload (SmartLoader)", "value": "d1ac0d16b02130387a1a889ef6f03d790921a88b05c663da251c70ef96841b8001c782a80cf5eb82ec874218c2b96d63", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989288, "uuid": "7fcbe0d6-7c52-4201-a97e-7b429a332023", "value": "T151C4238BA3FD845390BF1F58AA5BB48D091976F34722DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989288, "uuid": "a36da453-1c09-4bc1-b099-00e72aa263c1", "value": "12288:X+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byBH9I1P0QKw6FEp:X+QqldA/TSO713u7xnBH9IaQKHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989288, "uuid": "d7969586-21fb-4635-a50b-b35d8ff2415f", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989288, "uuid": "b26664c3-5497-4e24-b9b7-d1e27c597680", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989288, "uuid": "c3fe5f80-6693-4ae0-bfbe-b479ae463258", "value": "powersub-demo-1.4-beta.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e49f865-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977821, "uuid": "0b26f94a-b816-4637-94e5-0aba3e760321", "comment": "Malware payload (SharpHound)", "value": "c3b41372559d0194d11fbcdad670a31b", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977821, "uuid": "7c1f76aa-ad5b-467c-a09a-9918bf4a9d91", "comment": "Malware payload (SharpHound)", "value": "2868c28e9b3692a497ab12d3447dc7becc4873f9cb2a5232f10e7c1916560cf9", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977821, "uuid": "dde85828-425e-4cba-8cc1-e96f38cc8813", "comment": "Malware payload (SharpHound)", "value": "352c1223a5f4e918a4c6cd1b59f34b0c706eb050", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977821, "uuid": "247d73b2-8e2c-45ff-8059-649504c81b8b", "comment": "Malware payload (SharpHound)", "value": "0b4e4eb539f59c4a67b2f70e2c08792db3c6c3acee69aa9394a981f416cca19c0ea40eae9701cb14dbeb6fa371a28cad", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977821, "uuid": "5b7bca5e-39e1-4328-8157-65a53c16c770", "value": "T1F055125953F88B95F6AF1BBCA02481298BB77A4BF9ADFB4D5C8C64ED1483750D801323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977821, "uuid": "d369be06-9bc0-4fc9-8504-7647561aad03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977821, "uuid": "2e47f383-7a65-4117-8e73-c52c0a980f3c", "value": "24576:ndLIGEDwgrRvNuXoVIa09WmPstYX3rTbDcskong/iN9WC:SzRvNE9WmPDXbXQsFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977821, "uuid": "0bccdb10-cab6-44af-b29e-da30fec13a00", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977821, "uuid": "f6deb837-ccee-4f90-b5b0-6c4cb886b01d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977821, "uuid": "7966c8ef-81a5-46d0-b949-bf932a4e4335", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ae4e0f-240b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773976597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976597, "uuid": "386e717f-382d-4cb1-9a45-57fe56451031", "comment": "Malware payload (ValleyRAT)", "value": "81af70cee5f003923621f5ce32821d55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976597, "uuid": "d89daf63-bf3c-4e06-9206-c2bd4fd84cd7", "comment": "Malware payload (ValleyRAT)", "value": "2885a12a0caf401f675242145bf0392b5b37710b74f5f3ed7d3a5cc891fbc1ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976597, "uuid": "7a0e9bcb-5bcb-4411-b59c-7a13f23d7e9e", "comment": "Malware payload (ValleyRAT)", "value": "60d59e89d24ad57e03f2ad708e444fad633db281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976597, "uuid": "cd09472c-3be0-4d04-a74b-973f55b2cec4", "comment": "Malware payload (ValleyRAT)", "value": "2fbf19551f1ca23a0b51e78176ae1e9009cb541a612090534857b66fe33c8cc9db66b807a28b64ddb1e55a092da4ea55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976597, "uuid": "ee86e667-2725-4de9-91e5-fb158c046ce1", "value": "T16DB5120AE79908F8E0B7E63CD5564906E27A3C4E13719A8F13A116A71F77390CE3E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976597, "uuid": "03c8e02c-9800-4666-ad3e-f59236ac57b7", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976597, "uuid": "5f074737-fa53-4bf2-bfde-e116df904f20", "value": "49152:BZB1G8YmjCDAFgpdTPrHkiJ6YY7GqJw66acUyLy0hFeesrO2TSsDJL:z3GMjCDAFgpVPrbwvUacUugeSO0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976597, "uuid": "b4b5f1dc-ad6c-4e7a-83d4-90a8104e92b7", "value": 2302862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976597, "uuid": "a8a9335a-5408-451b-ace4-5144c4c644dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976597, "uuid": "551d30ce-968f-41b5-bfbe-cf85e9212284", "value": "2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e283c486-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978177, "uuid": "f17b6210-d429-4900-93ee-ee67702ad09d", "comment": "Malware payload (SharpHound)", "value": "033af9d56f5ab78757516961b7f56b08", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978177, "uuid": "d4f60a6a-6950-4bad-a5ad-53cab8794cac", "comment": "Malware payload (SharpHound)", "value": "28b132c8ab540499d9db0f6a75e4b3f149e31c574ecf24310b30c13b9e6d348f", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978177, "uuid": "a5d42a3e-346c-48d5-bf58-1e9e4a59072c", "comment": "Malware payload (SharpHound)", "value": "41dd502d5d0a55c73478330a32a867942d4373db", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978177, "uuid": "c9f70c45-66f6-4f80-9e1a-73efa7ddf874", "comment": "Malware payload (SharpHound)", "value": "9d3fddf50bad9b36cb5c54419a4ab2687c4296cd3335727f5db9c6c70b3d83f8f970aab601dbe767c70848eb5fb21eca", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978177, "uuid": "702eedd2-1ecf-4238-9d02-787a9227e9b7", "value": "T1B97523209E625DB94B79533C317D6A0DDE700B919878C9EBB2CF51C31F26A5390E287E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978177, "uuid": "fc8c6219-5412-4200-8eea-500c0eaad7f2", "value": "24576:AGpeHnuPp2tSU+Mu0TYGN1gcco/OyDgFxGfp2Glcud+nOQtsngcWZ/7TpwvAR1K:lkn9+MxoY/+xSKBvJTj1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978177, "uuid": "b609b594-5a6c-4d96-a6a0-9d99c2ed3c82", "value": 1607317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978177, "uuid": "61e7ffb9-f0bd-4506-aa3b-104a58791838", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978177, "uuid": "06203589-9242-49af-bd6d-a7124da0c041", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9438f429-245f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012835, "uuid": "169a7837-a649-4027-91d5-0ed778feb346", "comment": "Malware payload", "value": "ec4e3b06b7d226f9047976da662338e1", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012835, "uuid": "beb5159b-7081-4444-9bff-ccd8b3d73714", "comment": "Malware payload", "value": "292a74d8e56e7605802cace34f2ee9adef38a1455970b7468a83061ad86550da", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012835, "uuid": "9933acc2-76b3-4849-8b2c-6e0d3d15defc", "comment": "Malware payload", "value": "718e3788f6f5d0c0f87fea6564166ac191d3e0eb", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012835, "uuid": "6f34040e-d76a-43cd-9d10-bed25f720dfd", "comment": "Malware payload", "value": "2c71e42b7529cb9a8e16e85f07d10596ed1625d6f21db96fe0d556bd15054407b401fa4cc80e1fff144c9a5c741b2801", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012835, "uuid": "98759f38-d622-4454-84b5-73260196054c", "value": "T16A67D7916CD00CF4FD6CD738E2C11CA22E7958D0DEE126C91A7601593F93ED6A2ABF49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012835, "uuid": "7f3de224-e30a-4889-90e2-f71bb8dc4732", "value": "786432:o9MAcwML6Uz7bHO9WeYaxoTM+ESaKa9d47r8q6LKWTQ/bVDe0Trem6+WPlLvDBEH:1AcwML/zPuAe8TM+ESDa9d47rB6LdQ/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012835, "uuid": "6351246b-5696-46bf-ada9-17724445f73b", "value": 29763568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012835, "uuid": "3302e2f9-2847-44ad-9a74-08ce1081ec84", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012835, "uuid": "6caa0585-1a13-426e-a42d-9aba000c5ba3", "value": "292a74d8e56e7605802cace34f2ee9adef38a1455970b7468a83061ad86550da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d389f9d-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050404, "uuid": "72399a58-f2cf-4c15-83b7-5f82b5340a44", "comment": "Malware payload", "value": "c7202fa00c07b3d6c065217e54399b88", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050404, "uuid": "a3eb9863-8b53-429a-9b08-7e5e635a3d39", "comment": "Malware payload", "value": "293d8f81a3f2f7b41a72baca8913fac85f1b71a6dd30662417aac0f5437f533a", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050404, "uuid": "31be782f-3fc3-4115-820c-6efdb238604e", "comment": "Malware payload", "value": "1d08f700af253e01803e9c07493acde9d7278f90", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050404, "uuid": "55febfc0-a040-4f53-8b12-6514740f51dc", "comment": "Malware payload", "value": "1c0f045c46fce0cd34269b492d1de2a4652fe719e2efc850cfccd2cf8a5f6cabc42f4363da7bc44a8c83e8ece22143e4", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050404, "uuid": "43e179a7-22a8-4a3a-8122-28daf73756e2", "value": "T187D66B49B81D7062DAC979746B2613547338BC499F81C7262614FB7DAEF2398CF332A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050404, "uuid": "e053448a-1b3d-4a89-a66d-8b632eca425a", "value": "98304:NoNhXoLAmjXo0gxUcNEbhTVPgeZ5DU842AxlQrtG40kxukUhyOI4jp0rEc47Wdca:NqhXoLA6Xo/ObhZtZ5DAtk0d04cEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050404, "uuid": "4c356dcf-812d-444e-8486-f62780be90ae", "value": 12774866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050404, "uuid": "763c4327-5d5e-4438-9cea-ad6e26ca09cc", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050404, "uuid": "7af4e04b-3532-4947-8485-3f3f19fd34cb", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dc1c44-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977854, "uuid": "77baeeec-e09a-4afb-9598-d65e33c38ca3", "comment": "Malware payload (SharpHound)", "value": "271b6bab7f2616a922dbc02d05348108", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977854, "uuid": "b4afc79a-5664-418e-ae67-c71c33d9c397", "comment": "Malware payload (SharpHound)", "value": "29a53c7032a2c31170a45b6aa879c1d2021aa8b702a1a4b0cbfc2d0b46fa7476", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977854, "uuid": "ad44d991-16c9-4641-a1f4-c8c2f3fa0796", "comment": "Malware payload (SharpHound)", "value": "622c9c2e437171fee1d0a08b52ac45eb3b89c32b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977854, "uuid": "5ac80a93-9aae-4de5-b53f-b13b0f1fb731", "comment": "Malware payload (SharpHound)", "value": "50a136cb289664c2754bd850735a2206c452a59a369970434745200aaeab760a8aa36610180a453becc37f8e8ccde390", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977854, "uuid": "a411b13c-ea67-4785-bf9a-e2c299efe41e", "value": "T1EC553320BD4A1A790775C33871955B3ECBE00B935126EF1AB2DDA0936B3F74590AB0F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977854, "uuid": "a095eaae-f5a4-406f-a4dd-f737396e9355", "value": "24576:yKtFd5v8126O5uGGMVKh/GBWwWWuU1eUI1qds9CltOAPJXIng4Wt/7mJbC+:yKtFT8wYEKFXh5lN1qvh9Ldm5C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977854, "uuid": "0d5829eb-05c9-45bc-ac8a-d33902ffd3b0", "value": 1371693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977854, "uuid": "79c041d5-aab0-4b70-814b-072cb84c30ae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977854, "uuid": "59930fed-df38-4cc5-85e8-14a427bec20d", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51bf693b-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047083, "uuid": "a0c6d18a-3254-4925-89c4-68e10972c4bf", "comment": "Malware payload", "value": "3af2770b600c1fae6e53f136531a3f05", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047083, "uuid": "82e59135-cc08-40f3-97ed-d683501fc2e2", "comment": "Malware payload", "value": "2b041d0a46b1f01569410e8742de198921c97472d4ac262762ba4f38db80d104", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047083, "uuid": "642d6481-c53e-4532-aec3-84883f747604", "comment": "Malware payload", "value": "79d3de7b0f2daa02b3b900ae5cdeee3a7ab2b128", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047083, "uuid": "8e298241-5d3f-4367-ac05-354f3305585d", "comment": "Malware payload", "value": "d2d56c255a4305b4515ab55367a0492b76c082be0a20cc6e662361395c915bccd6f1e46266060c4d9932e007133275f6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047083, "uuid": "d1d2d322-92b6-4a8e-a084-4826cb956a51", "value": "T151953330BFE5146C0F798536367B5F9EDB302F936548918ABAEC90C4176EB88461F06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047083, "uuid": "217392ed-b2f6-4891-8c7c-20dd5dc6b508", "value": "24576:SvkPmZXDpGHOOtbWP/5HbRYD4Tb2GkKxZMWmD2Dv02ZWFyOLqp0iJMdzJNJj8JY+:i1pcaN7TRwWmaT0UdelkXd2OW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047083, "uuid": "1c578044-9450-4e5c-b098-dc65c196e2bd", "value": 1951565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047083, "uuid": "1f7cd7f4-ac78-41b9-b86f-c73e8c23331c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047083, "uuid": "4b089e28-efef-4821-a400-380c0d249123", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ac1ee7-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989322, "uuid": "0975b804-8ce2-4533-9eeb-0f5eb1589021", "comment": "Malware payload (SmartLoader)", "value": "9cee97ade92a6556af41504d3a72802d", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989322, "uuid": "33ef5eed-7f96-4b99-94f4-a56b734f2f5a", "comment": "Malware payload (SmartLoader)", "value": "2b263e84b679f604988922f3ad5928c68be97e3ffe305d1fad4e2b7623815b9d", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989322, "uuid": "91623a47-9012-4576-b790-f747ca38ba71", "comment": "Malware payload (SmartLoader)", "value": "44530de66a1eecf770a6e167a83c19bef5be6d01", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989322, "uuid": "84d93576-78eb-4e73-8cdc-aaf4e10e2c22", "comment": "Malware payload (SmartLoader)", "value": "126097fb1737153b8ba58a17de0e3afed76d5bb910985e3d20f918cb3cf74b6e80d2383269f80327324e7445c44300c4", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989322, "uuid": "207e606f-3d57-4845-b1c9-2c3b237c0f27", "value": "T100C42304340641D5835A2B1EAEC4E6E0BEF5A0DBFA1CF940AADD7ED06DE96A173C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989322, "uuid": "9c0ad73e-6a47-4c84-9d2e-bb6898cb66fd", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68mLeA924EwCd:r4MQOC/gHozN7NzomW8tA9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989322, "uuid": "ccdfc445-c544-477b-ba36-dec492abfedd", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989322, "uuid": "f9e9a6d9-2aee-4ab6-a0db-6eb36b3044cd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989322, "uuid": "edb3bc30-d1d4-4a91-98cc-9781118309c0", "value": "Software-v3.5-beta.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31200cdd-2431-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773992912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992912, "uuid": "c857d88e-c1a3-489d-aa88-d79728405aac", "comment": "Malware payload (CountLoader)", "value": "4aebef327d6be9de33e193a111639736", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992912, "uuid": "6566e2c5-fa2f-4fd0-a5d6-1b83ddfb8cf5", "comment": "Malware payload (CountLoader)", "value": "2b5b2bf0388d9d94702c1c1b8abb11a56d9c6e64ba8c7a7c77b40643ec147a87", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992912, "uuid": "e27f9573-872a-4c71-85b4-a4c5f19712d9", "comment": "Malware payload (CountLoader)", "value": "b687f451a62f039e00e014c5366035769d75a29b", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992912, "uuid": "2e534571-8161-4dd3-9c1c-fd03d038fd1a", "comment": "Malware payload (CountLoader)", "value": "ba3f1b504378267ce021470de0a42cd5ba73bc96585f908b86370826d9a6475641ef23be03d4390c8b532ce9d9d1a9eb", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992912, "uuid": "679b3912-d3b1-4fe9-a3a5-3f9a54a6b5cb", "value": "T108B30FD74E4E8CFCCBCB7428459F9D039AD952125E1EC190764FAE443F32DAA609ABD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992912, "uuid": "69be03dd-366b-4a18-85a2-28e01bd4633f", "value": "768:sn3Ela8UO9EYArjgz1OodyC9xyOoLYU7V4tHXeXeN39a4x2knUGBI/pM4o8rjKJF:RI8UO9mZR4tRUR3rjKJ2CdjADxRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992912, "uuid": "41563450-f0f2-45fb-91b5-9b613e9b7386", "value": 111121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992912, "uuid": "001a7fc4-821c-4288-86df-08d2daf77c1c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992912, "uuid": "7534fd97-c673-469f-9fa2-70214a8ec846", "value": "External_Project_Temp_8901.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952c72c3-24b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774049773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049773, "uuid": "abb4c5e5-265a-4cec-83cb-ff29bcb0b9b0", "comment": "Malware payload", "value": "e13569da598cf052a9c71d387e04552a", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "distributed-scanner", "colour": "#165401", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049773, "uuid": "519b4663-40b3-4452-ab24-77668dcd969f", "comment": "Malware payload", "value": "2c8f75ed14bb05f12525aea5eed7006ffdc11410c4509d634f093dd138436307", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "distributed-scanner", "colour": "#165401", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049773, "uuid": "777d7ddb-0835-41c8-bce9-ef9c28052ef7", "comment": "Malware payload", "value": "7ef853662175ef871b3dc83c142a2a02e8292d39", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "distributed-scanner", "colour": "#165401", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049773, "uuid": "c56eff90-0b99-4578-9d56-f33b3f1de135", "comment": "Malware payload", "value": "85656fbfbc6a6edfa193f313a7c54e84f1bbd2e222dd45d63bbbec5c3fcbbf7b601637d522e787012bce4c7cd3388f29", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "distributed-scanner", "colour": "#165401", "exportable": true, "hide_tag": false }, { "name": "reverse-shell", "colour": "#F39F75", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049773, "uuid": "2de9aab8-7a35-4f29-bbf6-a7ebe52a6cae", "value": "T15E21D691B6D522787B32447C0C86806B263234A765C9597CF9BCE1706F03F6EB1E4D65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049773, "uuid": "7e81a010-39e8-4929-9b4b-5751cfd896ea", "value": "24:mql3Uuqq/DFIupeNokeZAn+Wuyn3LA23OK9c/GlRL41ZAb4RALTJwSH:vl3Lqq+u0N3eRy3EKq/GDL4U4owSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774049773, "uuid": "e572d290-ce3d-4c50-985c-bcd7ce920fc7", "value": 1355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774049773, "uuid": "01a168c3-edff-4827-b6b7-7c6d3c17e493", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049773, "uuid": "0358b529-79ab-42e5-97b2-b816cfd8d982", "value": "c2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147364ed-2469-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774016915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016915, "uuid": "6428422c-9aac-4ee2-9870-6c053ee95247", "comment": "Malware payload (Gh0stRAT)", "value": "d653bcf60cc2aca6fd449605d8748adf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016915, "uuid": "6229ec36-0662-4d43-9fde-61d9e7b13195", "comment": "Malware payload (Gh0stRAT)", "value": "2d9435152cc275327c6f84832d4a3468ce677879cc350338f12296c276bb4227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016915, "uuid": "06312ba0-1ae9-4497-b19d-06080de66eab", "comment": "Malware payload (Gh0stRAT)", "value": "fba46b043033a5d222414067aa951d419654deb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016915, "uuid": "fad61244-096b-4f37-85ae-152f6cb6cd96", "comment": "Malware payload (Gh0stRAT)", "value": "518da717b34093c56e253f853187c7289ff14ba27b23e039a01525f5c15bb86aea020e162761500076093100da7cab60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016915, "uuid": "d5bf5a73-bf8c-4fcd-b22f-3971896d5a53", "value": "T18F27337FB2A8663ED4AB5B320973821088BBB761755A8C1F17F4849CCF395601E3B752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016915, "uuid": "98f4dcca-ae86-4bbe-b195-a4390ca54f5d", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016915, "uuid": "bbbd3240-563d-4b6b-8e5f-d9d70d01c9cc", "value": "393216:AThrmVZx6wHhgRAd7ID7jo+iysgh2WVVVTQQA:AU6ihg6SjLl2WQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774016915, "uuid": "dedafebf-65a6-45f9-bc5b-0a38efb67fa5", "value": 20885589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774016915, "uuid": "6adec499-2617-4955-bb89-397b517a8403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016915, "uuid": "fe6eea0b-4459-401b-91be-618db920d3dd", "value": "Microsoft Edg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced0a221-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989311, "uuid": "5af9955e-8e6b-47c0-bbc9-52c435468350", "comment": "Malware payload (SmartLoader)", "value": "67ebaf0694163bfed44d344fc71360bc", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989311, "uuid": "c6e77d62-d613-4627-bdd5-2e9a5f726a0d", "comment": "Malware payload (SmartLoader)", "value": "2def5f3586564612e03fa8b57bf3e8f2c4aede6f3be47001890c472b87ff79ee", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989311, "uuid": "d791da56-3d49-4c3a-a5cf-5f295647646a", "comment": "Malware payload (SmartLoader)", "value": "84597778b42910e88f7a55186e53519dd3f375cd", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989311, "uuid": "04114c1d-1b89-47f5-8054-7727ad54a3dd", "comment": "Malware payload (SmartLoader)", "value": "d826916fdc4036013cbb7a02d88c82067a1ffd617ff02f636a6bbe1f94f9385de9ec53610d84fd55f2fe869e55f66201", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989311, "uuid": "5ce580c9-7e73-46e3-bc92-c89203d31411", "value": "T1AFC4238BA3FE845390BF1F58AA57B48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989311, "uuid": "4aa2f753-15d0-4786-a1b6-a1a781f04276", "value": "12288:r+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byGH9I1P0QKw6FEg:r+QqldA/TSO713u7xnGH9IaQKHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989311, "uuid": "6574bcd5-835f-4623-88e7-534869a43229", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989311, "uuid": "35ecc39f-5ad7-4bfd-a528-8f35240864b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989311, "uuid": "dcc7b6e7-0f19-4c78-956c-890d01314769", "value": "Sitecore_MCP_v3.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31798d60-245f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012669, "uuid": "a7f57143-f4d5-4f50-9f70-967814223c95", "comment": "Malware payload", "value": "65beb3ab0aaf895caafca4cbbc8f1ca8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012669, "uuid": "4da97734-a9b7-4382-aa61-a07b15c92fbc", "comment": "Malware payload", "value": "2df91afaee60aa8a5dca05ff48acc26ea9096b7d6efb4cfc8911461ff9c63dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012669, "uuid": "f2dcc14f-988c-49c8-ad57-d166dc60a6dc", "comment": "Malware payload", "value": "bf3920c9e1eaaaec017010b9610faad782c25067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012669, "uuid": "48fc360b-4bcf-4fb8-9e46-7387716f9a67", "comment": "Malware payload", "value": "720a4b206f0bdf45ed8bb59ccafcb29a468466c18306763a5df2626ba95cb282267af0479a30b86f0fc21019c4f67508", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012669, "uuid": "c873f11b-b1c0-4293-a28c-cfe81d4f9467", "value": "T17F874C47F8E22DD4C4EAC671D525815BBAA13C2D1B3C23DB0AA1F3241F3ABD06A76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012669, "uuid": "1e2b037c-4630-4e97-9759-15c5c1fbc5db", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012669, "uuid": "0b9a405b-8925-4a79-8836-310217a455e2", "value": "196608:UoK8kUD+cZY6qGLNlBFeijYxV7QqrouIJHa4XoeEoQqfug7317p3MOuI:UoK8vSqoGLNTYijYzRqfug73AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012669, "uuid": "56af1a8b-b2c5-4db9-8683-404c85b856fb", "value": 36508672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012669, "uuid": "38b55b13-fc4f-4988-983b-4263f856be12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012669, "uuid": "ef9a655d-f6f4-4673-ad7c-5ceac7b9df4a", "value": "2df91afaee60aa8a5dca05ff48acc26ea9096b7d6efb4cfc8911461ff9c63dad(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6b0acb-246d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774018858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018858, "uuid": "26db364a-194c-4941-881b-40e48301ae9b", "comment": "Malware payload (Vidar)", "value": "38527902e3add802e99ecbb3f03f0fd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018858, "uuid": "1a87f516-2471-43a5-9e76-ff1c2f3f0553", "comment": "Malware payload (Vidar)", "value": "2e4ddf31d4e8b842716974f8b7c31089fb3ff6eda43503fb00f28c4d3f78e13a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018858, "uuid": "d4aa960f-9143-4d2f-9e0b-7e4894ae19eb", "comment": "Malware payload (Vidar)", "value": "e9720fcc440e4d26e3c6d14763875295343f657d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018858, "uuid": "2af0cab5-bb3a-4f69-b8cf-5eabd0d248bd", "comment": "Malware payload (Vidar)", "value": "1475fdef363e65a5dd691a080503e62ef22db2fb8f5d638ca4c68b3b662fa921114198345f4c43934832bd67a5ee7e32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018858, "uuid": "8c133a70-9ac4-4105-a600-7d163ed126a5", "value": "T1C2B57B0BBDD419FAC0AE977588B616927B30BC590B3223E31E90B6392F727D09D79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018858, "uuid": "1a08f2cc-2855-430e-a80d-265a873ddcc6", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018858, "uuid": "fbfebb55-fc55-4522-bf36-c6ea9ed2b36a", "value": "49152:D41jmbpADQ1VGKA/2WTGDzmk3tHAcb3sPwpc:DkeuM6/2WiHmslb3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018858, "uuid": "ec7d7952-a84d-4550-8e3e-85507f32731f", "value": 2491528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018858, "uuid": "903e9d21-a6ff-4571-80be-0d6ec6770b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018858, "uuid": "4c2769e3-8cf7-4a3c-ae6a-372974383840", "value": "2e4ddf31d4e8b842716974f8b7c31089fb3ff6eda43503fb00f28c4d3f78e13a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea8ab5a9-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989357, "uuid": "f3462aa4-e0bf-464f-adf5-6c73bef49256", "comment": "Malware payload (SmartLoader)", "value": "5be6f70d2aa29122f6d17f35fb26b3d9", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989357, "uuid": "9324fee4-5ea7-4fa3-9f82-4709a6d1312a", "comment": "Malware payload (SmartLoader)", "value": "2ec1e2ad3ec88546edb174adf5c5430ef41a7993709eb3cc5eedc967fe4a73cf", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989357, "uuid": "d9f4a56d-0fe7-49dc-a399-70d1876327a8", "comment": "Malware payload (SmartLoader)", "value": "9c839499e5b98d7b406fc4515784549daa8317e6", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989357, "uuid": "7bb573e1-85ce-466a-a24a-2c911ae61cef", "comment": "Malware payload (SmartLoader)", "value": "2ad7c4a24a4c7a42a76a839ddfe14aa30222890e8320ceb0bcb97fa5428de27cb353d2a3c682fd5f9beec5e917430821", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989357, "uuid": "63cbb4fc-f8e7-4723-846a-e724cb65469c", "value": "T1EDC42304340641D5835A2B1EAEC4E7E0BEB560DBFA1CF940AADD7ED06DE92A177C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989357, "uuid": "f258f344-47d5-4a43-a935-b55b25bf951b", "value": "12288:z6wlOMWROC/FTeHo22Qm7NzofOr68mIeA924EwCq:r4MQOC/gHozN7NzomW8eA91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989357, "uuid": "7534f6f0-ccf4-4288-9fa5-73130d9a30a5", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989357, "uuid": "363b6a19-9f8b-4716-a705-2796c5e575ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989357, "uuid": "23349baa-5813-49a4-989f-151422e6c3f4", "value": "hwm_harperdb_v3.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498dddca-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041056, "uuid": "b61cbd7d-2091-4f5c-8a21-25ac75ffca11", "comment": "Malware payload", "value": "c3bcaf0e5efcfc714b86fd1183a8156a", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041056, "uuid": "19436d33-b52e-4db4-bbe4-ee3bc3ec83c3", "comment": "Malware payload", "value": "2f0e5799b4b47c6a9fb522937ec66d71d34266ac8cf2c077508d794ee1ff71d2", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041056, "uuid": "32e3ff21-ef46-48bc-9963-359b60687000", "comment": "Malware payload", "value": "f648b36fbacd374b731792dd86c8035ba2eb3c09", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041056, "uuid": "ca23543d-f0be-4c16-b853-2fa2e7704283", "comment": "Malware payload", "value": "7043d3781809bb1c1feac17ddb48b977c9f0ed8d00b09dd0065d5b47272563a6f79b4db850423a054f899bb150189492", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041056, "uuid": "abd1636f-d310-4331-892e-cb9662c3ec08", "value": "T1E18348446817763B927BC2390DB61E6011F75F4E36A6272A307D719E8FB208D7819CBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041056, "uuid": "b4caf84c-f64f-4805-a05c-dc3a4020711d", "value": "1536:oAYc32mmmyBBR0LhPa53Mqfiiiiii28BX+p5qiiiiiiiiifiiiiiiiiiiiiiixqP:fYcygDjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041056, "uuid": "ba606d4d-490f-4345-a996-f3a8cb6becc8", "value": 80815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041056, "uuid": "d8065ef3-9b23-4f12-8772-9dec2145aa15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041056, "uuid": "bfd0f0b3-88bc-4ad1-8af8-741b2538cd3f", "value": "linpeas_small.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e8e01b-2475-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774022448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022448, "uuid": "a13b6e4a-853e-4f5d-952d-d1c664298305", "comment": "Malware payload", "value": "3c945c5a2d3ddea7e51b3aee1e454925", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022448, "uuid": "5345506d-5d44-4633-9d5d-c8cd08d13936", "comment": "Malware payload", "value": "2f60f97655a056851cd01186b4e22110d3360c5ed5500da061ec5e8ea6cd73b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022448, "uuid": "0b98054a-6d64-4b29-b54f-1eea2a7a305f", "comment": "Malware payload", "value": "df9b6d22a1825a2ec31fe348655dcd37ab8addd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022448, "uuid": "af5c498b-0ec1-49e4-ba61-512cf1881a18", "comment": "Malware payload", "value": "2eb1a411700f3c5bd193ffd7cd7d88411b90203fbc5cc4d8ae1ec4a50d3446180395d9a6cb636a573e581533989fcaa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022448, "uuid": "79623f6b-2ad4-416a-9c4c-1e1c66d94c84", "value": "T10BA37EE3D607EFAFF16A8BB44DA3493862D4106326F78593D3696E051B052D04D1AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022448, "uuid": "0057b4c3-2783-4bd9-a8ed-c714ba23143e", "value": "1536:mNA7dksRK75rmVqmonkXNcqq3L6EgYKAphMAR/D1optLzi2UkJuBWuA38EiagPT7:K75rmCkX4wSuW2UjVs4ryS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774022448, "uuid": "e60d45ed-0bec-48b7-8736-062e5d023ada", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774022448, "uuid": "669a0d51-7383-4730-b53a-4b3e1bd18fd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022448, "uuid": "3e792c2b-fb9e-468d-a1ef-f036e2ce0e86", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa4fc67-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050614, "uuid": "30c5ea5f-9382-456b-8853-6bcf995e721e", "comment": "Malware payload", "value": "2c26be89d7ca5427c2455bfb400f07d3", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050614, "uuid": "9f36df32-a502-4f5d-9919-aa713cd9372f", "comment": "Malware payload", "value": "2fa73ce2b5dcd03adf58a6a7692ef97fb005b967c2336686dd45495ec8b967e6", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050614, "uuid": "02cf3ba9-b13a-4619-b8c0-bdc15814b071", "comment": "Malware payload", "value": "d63b6a47e7abdaed4f356d5b0d484197558170c9", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050614, "uuid": "1ce75964-1263-45ae-95a3-4e3609343bf0", "comment": "Malware payload", "value": "90c5f86e41ecaff42cd6cf3f8d2e62c3a61de6eefc8e9d6fd918dd5067cffe04065d8eaa0c3d4323e4791daf63c7741d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050614, "uuid": "57a6346e-2f65-41f2-888e-b9e69f20913b", "value": "T190D67C59BC1D7462DAC975742B2253943338AC059F81C7276A14FF7CAEF2398CB236A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050614, "uuid": "41852d50-f93e-49b2-9c4a-617c3b0ac169", "value": "98304:UNLXBxiP1+9GFG+1bAa4MGL1iwHpgGs0/qpUAvtPC0kxukUhTIKcopxW1tERQcbz:U9XBxit+9wVAauIwHpLEceW1+RzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050614, "uuid": "b0d8ecb3-0aef-472f-a8cd-41d3ad3080a6", "value": 12725186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050614, "uuid": "f923ca83-1686-4fe8-b5da-60db3dd4c79e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050614, "uuid": "98e5901a-9b75-4bfb-b920-f7fcb5f7741e", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cb2b4bc-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040739, "uuid": "ca6ab828-105e-46ea-be72-8de2fd776d2f", "comment": "Malware payload", "value": "e01aa3723d3fa5f8253c00c45f3d93b7", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040739, "uuid": "2ecb29dc-eb26-43df-947e-0237df83f017", "comment": "Malware payload", "value": "302985f307db33a9b2dcc515a3b850611712af31a72047dbd123fd766eb022ff", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040739, "uuid": "5cfbf689-63d8-4ac7-ba46-8e39eeded179", "comment": "Malware payload", "value": "b6425cbb902f58c71e8880d12d5e84b3f8040749", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040739, "uuid": "25a81d35-481b-44f5-930a-62754a77fb96", "comment": "Malware payload", "value": "adeb75ae652fe65947fd127979857ddc658abee2cfea567003784e3432a13b0dd09943e4f421aabb4c5a53dfcdda179b", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040739, "uuid": "6e147aae-c1f3-4cda-b08c-56a5d9c33bf2", "value": "T151B6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040739, "uuid": "87ce4f57-9fc7-486f-beb9-d7586fc7200f", "value": "196608:uvyxUbTVBFUcwti7TQlyVN8iNISRTRmW5QF:vcjHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040739, "uuid": "03f912f7-3bff-4e31-a2db-ac16f820e7fc", "value": 11113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040739, "uuid": "de3ec717-43d4-425a-abc5-b654383d235d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040739, "uuid": "76f10fb5-9c35-4908-9c31-13a1a445b044", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c90f917-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046752, "uuid": "d1751035-f0a7-4f86-ab31-6ecd38803711", "comment": "Malware payload", "value": "91073ff47e1de62ac82890f3667ae824", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046752, "uuid": "33561094-9a85-40af-b584-694017a7d9e5", "comment": "Malware payload", "value": "306e347c4d6be117befcc707e858a75e3f0fd6570a45b8632f1b1460cd45e812", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046752, "uuid": "bfcd2c06-f7e7-4bdc-bd07-0c6827e67c0b", "comment": "Malware payload", "value": "668578ee270432b0a6f6562df2a951de67a65d17", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046752, "uuid": "2cf57c0a-de0e-49f4-af4a-c4c5297dee2b", "comment": "Malware payload", "value": "7242432ac38135a58b4be34099e56e45e96d73630dd2467c4471b6b269bffbd60f1b9fb529c0ca71de35c2d678bf7db1", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046752, "uuid": "36d611a6-91cf-4b86-a26d-1229912d8e70", "value": "T11F7533706BD20F2F4AB84238967F6F0CCBA049D7605E92D7B3EF25D227B6781411692D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046752, "uuid": "58ef0235-a9c4-4c63-9935-2ad7ad1a0e37", "value": "24576:CW17XpjGHySEpFhQWgcxfi2YyRCR+lOSn5z5EMOQuEuu+WfyYOce60z58e41/f2:zjpqHt7mCsVEM9cEC60KB/f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046752, "uuid": "846de17d-6028-456a-b5f7-fdc22abe1d42", "value": 1593033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046752, "uuid": "760827f2-5ddf-48f7-a49a-4bb603885130", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046752, "uuid": "1df4dde4-e44b-4e28-a600-87b060044694", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9dbcec-2427-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773988795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988795, "uuid": "33828c3f-0524-4314-8b60-11f3d65d556e", "comment": "Malware payload", "value": "23990c287942cc71e750572974f03f20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988795, "uuid": "79f429f3-83f6-4058-9774-075ec96bd754", "comment": "Malware payload", "value": "30b951ef9c020dd34e05f85e8de32df2a74a59c6205ebe5f71764607393525e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988795, "uuid": "dcc1d188-236e-4ce4-849e-d1c9ce3b8ef2", "comment": "Malware payload", "value": "a0c3aac38a755a6bd1f7d9b742ce62eca59a0b3f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988795, "uuid": "ac671682-2c1b-4b2d-9a08-5b5d71f6938f", "comment": "Malware payload", "value": "6b3a729241ff5bd872fd065850ca11f53403b7dd209fa6f588fbbf7c28d7b7c6ae12c393ef86fef2fbcea3e9cc90f02e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988795, "uuid": "7cde2aa1-ea2e-459e-ab5e-12427a4fddcd", "value": "T1A9924CB512896C79FBD1CE399F3C7F4DADE882C42124A3ACBA0F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988795, "uuid": "eb34c0ba-59bf-4694-933f-656054e40bbc", "value": "384:eiKcuQpWx+BL0SWL0grzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:eiK8i+BL0SI0AzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988795, "uuid": "933e072a-7f88-463c-b933-43394e7dc427", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988795, "uuid": "9f671171-3210-4672-a809-b4678604c014", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988795, "uuid": "c70271cd-820c-4aba-87a6-2d7e4bc8993b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954e179b-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046767, "uuid": "cbd16a70-9a67-4139-bdde-07ea3ba021f1", "comment": "Malware payload", "value": "bd411a07abffdae0c9d3e155f4d0f95b", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046767, "uuid": "a9e4dd70-5ad5-45a3-8a41-6c6e16fe0dc0", "comment": "Malware payload", "value": "344253813d7dfe6bb7238aa2ca2257c78cd3e098db6008ed973b034eafe922e0", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046767, "uuid": "bc937174-7c26-41c7-938b-55c721163e03", "comment": "Malware payload", "value": "5d2d8d8446391b7a0dcacfdddce9001841df945f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046767, "uuid": "aa974309-c4af-445d-a708-54b61641c221", "comment": "Malware payload", "value": "6ac2f1fe73ff2c2b270f12aa9584415a75ef65413999d82acd7937b5d017945ce9a00cbe38048bf8942215f8c196b3c7", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046767, "uuid": "4da25799-7ea4-405e-9665-23b3f2108368", "value": "T1AE752310DF510EFF0E788368A1AA6F568B708F631028D5E4B6DE13DA172BE0159B7968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046767, "uuid": "beaf094b-f0b1-4e0f-9a33-a156f318afa4", "value": "24576:PVM5sRW2Yx00oLgc23AD2EIvCt6z5EZOoGu5Nlu3DQ9M85ILWvzJR8DTBea:PaJNdAD2nCuEZtsMCGwsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046767, "uuid": "9133ff1a-fb9a-49bb-ad61-ff4ba2dff200", "value": 1581157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046767, "uuid": "f9c71386-66d4-4ff3-b560-e3e024fc2b71", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046767, "uuid": "e5eff719-a8b4-4660-9e40-d72c353491f8", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c7679a-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041080, "uuid": "45eef199-398f-46be-9785-134210436591", "comment": "Malware payload", "value": "6484275ba22f426b3ad0a9219dcc3084", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041080, "uuid": "77811493-41f8-4241-b930-3f79aaf925b1", "comment": "Malware payload", "value": "349866ba8a99df6e6c0b48e69f45170476be84c2dbcbef288e80e7b5afa1f22c", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041080, "uuid": "32e8a9e6-e1b0-4535-8b15-7b5f7ee789a5", "comment": "Malware payload", "value": "66ca347a04c81f1337ae2564f591d401db56ca3a", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041080, "uuid": "4a50ea75-19c3-4f36-ab75-b0d615fbb40a", "comment": "Malware payload", "value": "b49b3caa1f5591c518a43edc1914d0d1393d4f1c560e3c12c6d2ce1e4563a32cf8bd44994a3afb0342ee92ac77cbbf61", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041080, "uuid": "d8a99bd6-b90a-4864-b787-c93d0dfddd16", "value": "T199B6D14062DD046DD6AF0E79906202324B75761A175A8BC7FBCC81AC0F5BFE29F76326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041080, "uuid": "df10c942-9cf0-4db4-8518-a16e722baab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041080, "uuid": "01c2320d-ed05-44c5-aa42-d695bf59a1b1", "value": "98304:upy9jhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5QY:Q4jVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041080, "uuid": "0bc5c86a-f9c1-4b5d-bc91-4eeccc473c87", "value": 10931200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041080, "uuid": "d04855f5-dabb-4517-acf5-09888502ad11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041080, "uuid": "6dd86ae3-e1ec-4f34-b1cc-b7250d924627", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163c2369-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050419, "uuid": "b29547a9-b6a5-4441-9932-6eb62ba6f271", "comment": "Malware payload", "value": "1010dfc14bc3949205af9ede0ec5858a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050419, "uuid": "5d0af149-28c7-4af9-a4f3-6b1a98ca99ef", "comment": "Malware payload", "value": "34d0f9acca43f4ac1322f5093612cdc9da4041292ac8af8d62f2ff07679885b8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050419, "uuid": "e099d504-f24d-46b8-95e8-9455e8e5aaf7", "comment": "Malware payload", "value": "a041ec407b22c4e160e0789617f426e33870cb15", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050419, "uuid": "7539d06f-79b8-4161-8386-aa8764fff7fc", "comment": "Malware payload", "value": "bfaae42f2bcfb04a5bcc94bdf798897645b1070534b6e719602fe97fdeeaa0b48aab14ec46e06610fddaeabd8a9a895c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050419, "uuid": "f49b86e1-1686-4849-ab60-e4b72c451c22", "value": "T1C4C68D55B91D74A3EACDB5343FA652547238BC059F81C3272618BF7DAAF23488F23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050419, "uuid": "1895fb82-5909-4eba-9e34-bf4b63c5ce57", "value": "98304:0lQK0pr+Ta/Q9RzwSjnQGB4nJl/GBVVxD+yItpG+tZYyqbLJ/eEm:0n0pr+TE+R87GaDGBVuZhqbF/bm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050419, "uuid": "3317e055-41a6-4a64-a0ba-0d208f032cd4", "value": 12452024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050419, "uuid": "f0162142-5f85-4d4b-ba4f-549e6a1a447e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050419, "uuid": "c3f1a075-4e8d-4dff-8449-423d7c8b9798", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e671173-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050540, "uuid": "20eff23f-1eab-4774-a3d1-c7184761f15f", "comment": "Malware payload", "value": "66846dcbdc7210811f52c61b3e3ec7fa", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050540, "uuid": "18cc20e6-301f-45e6-bd6d-2989a2a7824c", "comment": "Malware payload", "value": "366e33f232987fe4bf591786420aa40a6beb92c2fb3b4f757f6cd825be925d58", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050540, "uuid": "3b0c8660-2f52-454e-9c8a-1d01bb69a414", "comment": "Malware payload", "value": "14f596c6b1c892a780f0bcc7f49699a7556b891f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050540, "uuid": "2d864957-5396-4131-82bc-aa5ee485182b", "comment": "Malware payload", "value": "d3d4a1008b31e8e481b99e5fb1e42b93c3e0a63f1019ae54faf193ed02f64b0f7e609bd7686368af5c6801091f4e6389", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050540, "uuid": "7155a076-6ac7-4f1c-bbbc-a4e5d69dabfa", "value": "T10BD66B45BC1D7462DAC9B5347F6653943238BC449F91C32A2518BB7CBEF2398CB632A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050540, "uuid": "db1cbd4d-adad-40aa-a6e6-a586a90073b8", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050540, "uuid": "65f6e52e-1e35-43c0-8f16-46f2476dd796", "value": "98304:6ohiMmLMbWn9dkiZWIT+PMhbde5Q3/bTo0v3gttsnR33/2NbGF8wjCqE:6siMmLMy9eQ4MhgAZ3/2bg8wjC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050540, "uuid": "5a5a94ad-32c4-4f89-8f75-a96c380c92a6", "value": 12676096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050540, "uuid": "8102120f-6cea-4474-b693-9df199f60f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050540, "uuid": "d1a7f17a-b976-4319-a6fe-579a537ee076", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2342f86a-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040992, "uuid": "274b636c-ce06-402e-aabe-9924d30e0876", "comment": "Malware payload", "value": "212fabbe4412b2329e0b77764a39a5d8", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040992, "uuid": "1ce85540-92d8-4260-b2a0-b3e90c313a89", "comment": "Malware payload", "value": "3684671ad23dcd6fd1db5f68bf5797af0e04b9ab62f9fbb35ae92af0e29d4c32", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040992, "uuid": "26b4b420-6861-419a-9125-955bb31a57dc", "comment": "Malware payload", "value": "f9728d5540d878619886e2dacad76e98af2dd9d0", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040992, "uuid": "9a4749a8-e5dc-4a98-aa5e-ed8163d828bc", "comment": "Malware payload", "value": "c62d0f54cdb95f838ea334e672c8ee9ca7fcbc2c604497d8f4fbd374a750a272348abe49cb306c9b82fdef46eff013a9", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040992, "uuid": "ba27d767-c2f8-424f-9931-bc5196349efc", "value": "T1A825FA5C640CEFB25025C97C1C950E7D19A3AF1F2665182870ECB71C7FECCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040992, "uuid": "50d095d2-2fd0-435e-8d80-c747348915e9", "value": "6144:hYcgbgkTA9TAnTANTA3Tx2a8ZTAhT/pTAtT/bTAlTAhTAJ8IEa8GT/84PkLHp+4t:j8wihTifEu3n+LT5YDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040992, "uuid": "267039fe-76cc-47b6-8148-e75c933df674", "value": 1005683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040992, "uuid": "292fa9d9-363d-4870-8ddb-1d97a7616b87", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040992, "uuid": "54a8419e-b36d-4977-b209-d9fa9a49dba1", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c20651-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989405, "uuid": "7b342253-f15d-49d5-b951-40abdab4c21a", "comment": "Malware payload (SmartLoader)", "value": "ab07bb5cefff4ae7ae84bf6a93d8ac07", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989405, "uuid": "bbf2f04b-f50e-40b6-ae00-b96ed5b3cc5c", "comment": "Malware payload (SmartLoader)", "value": "368fc944233a78323b3a92be44b0a6f3f2c8ba7cbc40fbbb2d8e8fdd67006391", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989405, "uuid": "ba1c5e53-f99f-4492-98c7-7168a67d102b", "comment": "Malware payload (SmartLoader)", "value": "0b12fbf1778cefbe6020f345ae5fb9db1e59a6cf", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989405, "uuid": "8abdecd8-80d5-41dd-9b39-18b13583514d", "comment": "Malware payload (SmartLoader)", "value": "4c8e32a275df93e19341a5a4c4a3a3fb4b5e53038c8ae91a91ec48a918c9cf042b4ea0d6d63745de66919f3a308f8c53", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989405, "uuid": "4f5a974e-2016-450d-a397-1f0787280550", "value": "T14CC4235D7018EB38E907A174F312C0F26BAE662BE0A5C39CD045053B37AFF26689D957", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989405, "uuid": "0ae6ba38-ae9d-4264-ab22-f3bc858106a7", "value": "12288:VMU+0xq75aS9iYIp6cP/G2Bku83tNvC28c5/VTUPkYy4:h+J71vI/GVYc5/pY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989405, "uuid": "d7a32d96-43f2-466b-b33f-b3b2f01ef8f9", "value": 587570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989405, "uuid": "63d47496-d0f3-48ff-a24c-06041041c413", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989405, "uuid": "5b9cfab6-6a89-4e6d-b671-de4546ea3d75", "value": "Cat_No_2.9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60ace69-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050714, "uuid": "b7e5a286-3be7-4aee-a58b-279d75235494", "comment": "Malware payload", "value": "4a3415246771da08100e4dfed6855ce3", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050714, "uuid": "3de37447-8a67-4442-9bc4-116def8679ca", "comment": "Malware payload", "value": "36e65d9e1863623ec984fc4f0d8d75720309710ef8e9a7a5e06c8d4a870b3b13", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050714, "uuid": "1cf064b5-88f6-4a80-ad87-3aad646e4f27", "comment": "Malware payload", "value": "25f8cf3d66fa3fa1e80f2e5e250db50774fa44ba", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050714, "uuid": "a78b800d-eab3-47e4-a0c3-e2f258e3ac2c", "comment": "Malware payload", "value": "0aa1ba69b06d9535d32a0d0d20fe03c2899213368f1cef39bf1d16f3ccfe1baf43b3e7fa1c84cb1fa7e16c3c06e42a65", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.8.3", "colour": "#C3CBEB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050714, "uuid": "ca696fc0-8455-4f44-98d5-48f0a0300fa3", "value": "T111D64A03E85555E9C0AEE53486669323BB717C495B3037D72F60FB282F76BD0AAB9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050714, "uuid": "323803f8-cd7b-4629-a55a-5632e3e4effd", "value": "98304:wa4O8oxSOeoFtqDTthx+F+jfdSNDGtLTUMd5gSpV+PD9OEZo/AD:wO5ekqvthxpf4DGFTx4P5rZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050714, "uuid": "b79f7761-bdfe-4fa4-8e44-92a3c1919a27", "value": 13440944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050714, "uuid": "f5368153-c695-4c41-b909-4c79e6172894", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050714, "uuid": "eed61507-8b86-41d9-8921-64bc5d463f5b", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf48b4c9-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978118, "uuid": "1d413234-d68b-4942-99a3-795075c9f891", "comment": "Malware payload (SharpHound)", "value": "2c50bf3e939b4c92b1106ca6765bbf6a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978118, "uuid": "297b66bd-ec33-44f4-be9f-796a98e32a9a", "comment": "Malware payload (SharpHound)", "value": "37b7a5811e38d943335d3256c819cfcc22701b2bc2198736a32e4d1553c7c2a3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978118, "uuid": "c644c5a0-41ca-4171-8018-26ad0c5b76f9", "comment": "Malware payload (SharpHound)", "value": "f7e41d8cf9c6bcdf7521771addadc4528be7111a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978118, "uuid": "1c611457-d7b5-48bb-920a-9467f9bf3190", "comment": "Malware payload (SharpHound)", "value": "8ab5c86cfcd3f239bcab11b2da1c01213e3b8bc9d2c03996dd12907722d8df2812c42475d258bb861b4375c9221c6a4a", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978118, "uuid": "b8e23f1b-e62a-42ee-9aa4-5474c3a5473c", "value": "T1D955121983F84B91F6AF0BBCE0268195C7BA7627FD5EEB4D9D4CF4E920863559900323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978118, "uuid": "8d5484f8-3864-495f-bc70-00f84c289ee5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978118, "uuid": "ecbe12d0-10dc-4878-8613-2aebc3c13188", "value": "24576:ybLIGEDwgrRvNuXoVIa09WmPstYX38n6x+5pwQjfkong/iN9WC:yQzRvNE9WmPDXA6mpwuFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978118, "uuid": "d6633506-8080-463e-85f0-a06318039297", "value": 1328128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978118, "uuid": "0146de05-1cd3-4c5a-8a87-744d2cf65b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978118, "uuid": "40fcacf6-c4be-4f08-ab36-b67a251209b5", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac0108a-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978298, "uuid": "e42f77df-dc5d-4112-9519-96c1d57fd1de", "comment": "Malware payload (SharpHound)", "value": "fe7c3bb16b376077e3665e88c16d4ac7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978298, "uuid": "670b76d7-942a-4067-bab9-fc20190f1d5a", "comment": "Malware payload (SharpHound)", "value": "381266f78bdc092297bc35f8a9bc7f95c341e265f8acf0660974aac14f899c25", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978298, "uuid": "b448d37a-4537-407a-b26c-ce0b551c1e24", "comment": "Malware payload (SharpHound)", "value": "2b9bb6858115d339130ad58326ce36126737054a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978298, "uuid": "ec7df63d-2acb-433c-8538-203e3336271f", "comment": "Malware payload (SharpHound)", "value": "1be87f22543cac408f5170e1c72006e365ff32704ee9d0805e40330be2d8c5158df80e3fb2bf0e076df55a4b838af6c8", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978298, "uuid": "aa43b156-118c-4363-9e6e-4a51f795ec0d", "value": "T1CB7523F09F670D5A076CC238483F3F9DC79A179398CC89CA7A8D53847F2AA80955B974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978298, "uuid": "59674b46-e1b4-42e2-80a1-acdf235477f3", "value": "24576:Qo95u//Snu2S0dmFxolCcpW3NmeoQFIrI/MpfqG3CrYuHq6lojHO1d2YP0s5nv1c:Q/4Q8QmI/MVXaKaoGLfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978298, "uuid": "046e53a4-1615-4b7c-a000-b5e91f912117", "value": 1582265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978298, "uuid": "8f3441a9-f5bd-4d20-9944-db9d405b7b3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978298, "uuid": "afb1cc2c-0c8e-45ff-97db-c98d829eb550", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43ff052-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040806, "uuid": "f846f8f6-5d23-459e-99ba-d1d77b5f61d8", "comment": "Malware payload", "value": "8456263b92cac52e661ad238b9ca8bcb", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040806, "uuid": "125a3224-335e-474f-984d-ebf6596548b7", "comment": "Malware payload", "value": "396454060ee01e37b2b2cfe165541152283ccba81c2ebab0591f2baa4ec607dd", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040806, "uuid": "bb4f9b73-8891-445a-8742-cf65a73d987a", "comment": "Malware payload", "value": "828cec46533e26f638f11580d631679b86e80c45", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040806, "uuid": "8d740e20-0b47-4e05-90b0-3c96e1a39e45", "comment": "Malware payload", "value": "029d3cffd9eb5c0d84e172860860bec5e67e2e596489bd7a3b308a43ce6a6aae453f8a4796d7750ee7806a460d2a2b24", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040806, "uuid": "1046f3ea-6e18-4983-8aea-ace3aafa4cb4", "value": "T1B825FA5C740CEFB25025C97C1C950E7E19A3AF1F2665182870ECB61C7FECCAD60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040806, "uuid": "a51ba189-3c33-4e7d-a3b7-f3b538a3940b", "value": "6144:hYcXMgYMfJMfbMf5MfLMkeMdmMfVMMdMf5MMJMfRMfVMf7MVXMdxMMyufQbHpggB:juIihTaiF23n+LT5YDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040806, "uuid": "dcebcc6b-c6bb-4766-97c7-61bfda2b2169", "value": 1005683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040806, "uuid": "929b9a88-f62b-499d-926f-24b947ebdb5d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040806, "uuid": "e5305d89-eeb3-4dfd-b0f7-b00c9989dce2", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5b737a-2422-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773986540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773986540, "uuid": "a32083bc-f533-46fc-a66b-262301b89f68", "comment": "Malware payload (XWorm)", "value": "2d0ceabc9e8e215dc7cb2f1098f3fdce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773986540, "uuid": "9268b3c1-4b8c-4510-aa6f-de411766de9e", "comment": "Malware payload (XWorm)", "value": "3a74f69b838484e036e7fe64ebaf2ecce077d7d3e6b2449a20a92350a18e6fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773986540, "uuid": "982db43b-46ef-47dd-8142-7d536cf50f7f", "comment": "Malware payload (XWorm)", "value": "0a02c32be66dcf038993e53c6b115827bb122e7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773986540, "uuid": "72cec9e1-fa93-4f43-b1a2-1be498d95276", "comment": "Malware payload (XWorm)", "value": "52299431d73fb3bf82123aea2b15f2e63f8e86fb21e9979fb8f897c43fc0f1fa5ec3f363257dc1ae7e21df1fd1a78d34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773986540, "uuid": "5ac816cc-9e22-4d4a-9c62-213117f71feb", "value": "T10285CF0573E442EDFEABE1768A13C507C7B17C450677861F06A0AA766F33B716A2E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773986540, "uuid": "eee799e0-76aa-409b-922b-0183d936cdc0", "value": "638af1c562ad8f76992023c9692ec222", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773986540, "uuid": "93196d84-1c2c-4dc1-b676-00645eb4d404", "value": "24576:xCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrnoqAas1cNUtwLID0Lpu8XcWJ8Y9iva:21H4jR2TYrQbDTrnoyO4FcmZMlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773986540, "uuid": "f463c702-f066-4665-807c-b447f677c2a4", "value": 1865216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773986540, "uuid": "3ec2a954-8525-4a42-baac-49fde6f54886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773986540, "uuid": "05599ebf-f2b7-4f21-a29b-d7ae52415b6f", "value": "OP-2602-02-001 MBL & HBL SURRENDEERED REVISED OB.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5296efb-244c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774004837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774004837, "uuid": "fb4e2ff1-50dd-47ed-a477-9cf37ba3a7f0", "comment": "Malware payload", "value": "c6b35113dc1d4cf3a3ad72ec5095f5f4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774004837, "uuid": "d6296b8d-2772-48af-8531-d167c3cc2656", "comment": "Malware payload", "value": "3bb8fa3a9be3d0875eec96430696199b4690a7fa66e337b44474b7fe1afac3ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774004837, "uuid": "0eb81aeb-6e6f-4fe4-99a6-9aaf69f539cf", "comment": "Malware payload", "value": "07fd2610954fbe83dc88e2e9642b679dec1351a9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774004837, "uuid": "376dbf19-690a-474a-802c-38382de78f7d", "comment": "Malware payload", "value": "5a2766aa84cc2a6c4ee21fe49604b5c30c6aab09e53162aa58fa8d069a7440a66a6c49d84f16372a15a4cf27b8cdd678", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774004837, "uuid": "66f353aa-9fb6-4891-a9c8-6477c5356d81", "value": "T168925CB512496C79FBD0CE399F3C7F4CADE8C2C42124A3ACBA0F39205A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774004837, "uuid": "1d034df6-d02f-4f79-a0a1-f3e6dcca91e6", "value": "384:TEBcuQpWx+BL0SWL0gUzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:TEB8i+BL0SI0XzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774004837, "uuid": "08a86eca-7986-4d03-b097-2eafc5e1f3a3", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774004837, "uuid": "24721d9d-2516-44c3-872d-7026a7f83739", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774004837, "uuid": "09b0b67b-a261-4f2c-a496-0164d9c1b9d9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56b9877-24a5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774042982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042982, "uuid": "4f15c717-1439-49b2-b8a2-6adc550ad67b", "comment": "Malware payload (RemcosRAT)", "value": "788c72e216fad36019fcda300ff60c08", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042982, "uuid": "2e77f889-2b34-4cd0-b1d4-eb03d2e96f80", "comment": "Malware payload (RemcosRAT)", "value": "3c7f6b27fa9226afffba94d5069801a22ad682a08a580e930c77d0b259929958", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042982, "uuid": "949401fb-eede-4dd1-af7c-6bbd0bc495d4", "comment": "Malware payload (RemcosRAT)", "value": "09a7ef3dd698b0acbfd5611e46694d6041e0f177", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042982, "uuid": "9fb49f0f-dd5f-43cc-97eb-43d12c5519c6", "comment": "Malware payload (RemcosRAT)", "value": "6e57fcf3ff35ae25cee66ea6bc21651bf0e8638b2b2130c5e01341975b298353ede30e2197e4ba34b01dddcecf3dbc24", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042982, "uuid": "918188c8-bb1d-4aa4-aa3e-64c342105880", "value": "T17C83EB7031A0C5A79283D8C0AF41D96CB27BAEB5FD4438365A4E43E72DA50E4F1BB5E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042982, "uuid": "bf51dbf8-d8c2-4738-b8ab-5d0e4b755368", "value": "768:mmutiQDifVU+E4sSjOYXy3jJQcdEnaszrW3MwG/fieU4T2/ZyfvMNLY5:mprDifVU+LjOYXMCcGnXfW3MwQi/Ao0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042982, "uuid": "491b6804-1293-4366-9eca-c10f8160bedb", "value": 82774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042982, "uuid": "21c71c0b-7b93-4643-9052-e3119da74177", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042982, "uuid": "d57bdfcd-cffa-4413-b401-a8d0514b4d87", "value": "20032026_6375.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4b71757-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978207, "uuid": "8d1c907f-2f60-436e-a439-93b4be694fa1", "comment": "Malware payload (SharpHound)", "value": "b4e7d9c788e66123fd6bcbc0ee15bf67", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978207, "uuid": "2e2ca3ce-aa38-4667-8465-407dad61c4f7", "comment": "Malware payload (SharpHound)", "value": "3ca27b6c0e1d0e2db30a1843650c66b73381281448118b9442e20457b6db87dc", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978207, "uuid": "3b662feb-8b72-46cb-bf75-1cae005cb1d4", "comment": "Malware payload (SharpHound)", "value": "017fa2b8a98c7c8d0675ce0a0a4cf05791be7377", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978207, "uuid": "4edc2e30-03af-42da-ac6f-418b080fada9", "comment": "Malware payload (SharpHound)", "value": "73bcfcafeea94c27d1da793fe45214f8049233401e5936bf00237f84639dec5879bdfe9d625e8f224b96d6d9be9927ce", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978207, "uuid": "695102bb-bf82-4274-8b5f-22c8d6c24963", "value": "T1DA55122563F88B95E6AF1F79903142244BFA7717F9AEEB8E584C74ED2482304D852337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978207, "uuid": "64fe7d23-ad4b-4cea-a534-21189a369ba1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978207, "uuid": "2bcb1ede-4676-40e1-96a0-002d130a437a", "value": "24576:RLLIGEDwgrRvNuXoVIa09WmPstYX3LrSApksxruRgLkong/iN9WC:RgzRvNE9WmPDXXSpSqOLFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978207, "uuid": "78a7d272-08ff-4f42-b6a4-adfd65479175", "value": 1302016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978207, "uuid": "2c3eac28-a57c-490e-aa31-493778c773fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978207, "uuid": "5be4378f-2a53-4f4e-9686-22d0b4f03a7e", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fbc5ea-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050315, "uuid": "c0db2fa5-4ebd-42e4-b88d-88dd55675471", "comment": "Malware payload", "value": "1fab32c060179dcb506fac5bc0dcecb2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050315, "uuid": "58ffe6d3-74a9-456e-8e16-a91d1c80260a", "comment": "Malware payload", "value": "3cc791292cbec7b058eda015194980a44ddf0017302fcbfe813a993293607951", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050315, "uuid": "d4682711-3346-4327-83e0-65f9ded12289", "comment": "Malware payload", "value": "6ee64ee33d00cc7b0589156730dbbbcb5a0bff2a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050315, "uuid": "65a437a3-4b7f-4458-a321-f4c4885a5f04", "comment": "Malware payload", "value": "f7e6087e233c4d88d4726318173033ac468086c71e8f34fbe4cd1958c0adf365b8685644342bb97c5e41b3e598b4c94f", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050315, "uuid": "b991a299-120e-4cd2-a3d2-a5d050e0e4a7", "value": "T1BDC68D55B92D78A6D9C9B5347F7242953238BC058F81C2273618BF7DEAF23588F23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050315, "uuid": "f7753beb-450f-4ad9-b2b7-b2ff16b7eb37", "value": "98304:HbIvUaqfO1fSB6wn/1a2z1rDlY1LD3fKEoMzwY1HAFtwEyq15taJE5:HQUaqfKKAw/z1fqD3fvlH9q1PaK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050315, "uuid": "d2f08659-3008-4849-896f-3c777f2cd1cb", "value": 12452024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050315, "uuid": "69501f9e-bbd6-4636-99cd-f3bb5d3dcf29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050315, "uuid": "a98f24bb-0925-47c6-91fd-831ea6791acd", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29e5ab6-2446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774002121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002121, "uuid": "6fa9da8b-b64d-44b6-86a3-d9f08ff16269", "comment": "Malware payload", "value": "f7022cf0603c362dffa5270557ce7e86", "object_relation": "md5", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002121, "uuid": "e2db8db0-1b3d-4241-988c-d412a92f3f51", "comment": "Malware payload", "value": "3cc7a2c40431146c4972cc3ccdf649f693ae7052bde477c444606d168877eaff", "object_relation": "sha256", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002121, "uuid": "7ec2cd6f-431a-462a-924e-576ae2eba346", "comment": "Malware payload", "value": "72598478b90e92e099873e67476f036d54710299", "object_relation": "sha1", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002121, "uuid": "eaf8c955-534b-4457-9906-19b2dbd472bf", "comment": "Malware payload", "value": "4f8a82c97ada51fe4887f7ea51d25d056299b7ce0b6ec2d60d0749216877c0961bc9505180dc7e40fc810c578ef7b575", "object_relation": "sha3-384", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002121, "uuid": "af7d9ca7-9532-44eb-9b97-7151d8c27e84", "value": "T10F25E167F21F06AAED1FC83790204D117CB9A1E1DC4B702F16B5499A44D79CDAF0A3AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002121, "uuid": "7e781fe7-31e7-4b6c-971f-ae761341105d", "value": "24576:0ZtFoRDuEG3cMiF1U4QEi26n0Z6pa/7bAHDuEG3cMiF1U4QEi20mU:eXsDu33XoKEY0qaTbsDu33XoKEqmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002121, "uuid": "3006322a-94cf-460b-9251-548e59694d36", "value": 980964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002121, "uuid": "af221c98-2a46-44bf-897d-6c2fea0fa4e1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002121, "uuid": "b90f7ad0-34cf-4734-a7bb-4e92f92d4f36", "value": "XenonClient-1.21.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de477c5-249f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040231, "uuid": "16f09eb1-c6f0-4d44-99a4-935ceb8707bb", "comment": "Malware payload", "value": "404c9303a4f8fa888efb54d1bcb60995", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040231, "uuid": "7da9c158-2a8e-44bd-a863-1a0311c09ab4", "comment": "Malware payload", "value": "3e3201cdfeb646ff9ed91ee5dbc20ee67bdb92fb301a7ae2c73308e1570b41b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040231, "uuid": "1b65b262-988f-4e29-904b-aac7640db5dd", "comment": "Malware payload", "value": "34d8caa8024606e9a148d49b54ed20f641f8aea4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040231, "uuid": "85dc68ad-b2fa-4eec-829a-5c2a07c1b550", "comment": "Malware payload", "value": "b0f35f8e062609beb55e837a405b134d89822bbe53f7526e93ef9f494bac7c8fd4221fd8ce6e0fdd0805ff08c06984a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040231, "uuid": "6b19e7b1-a19e-4165-84b3-f8dab507e2cb", "value": "T126B37C38774E7C86E3CBD378DF1A4E61302B35E6C666D1657D12232DC5C3EA68AE0990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040231, "uuid": "7c1adbf2-fbfc-4492-baec-7cccd2c2a975", "value": "1536:xbL7HuR8BlCGEnNi98Qjmw6NzQPfGIngsMoLv2F5E4PiBT5jHyuF:xbL7HueljEnqjmw6nGSnfST5jZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040231, "uuid": "46ea85ce-221d-49cb-87bd-1ea665513487", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040231, "uuid": "c1e9d347-f2d0-4458-bc1f-e98b73896f4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040231, "uuid": "e3e30c28-0fb6-479b-bc63-c3d5420a5667", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0d1711-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977844, "uuid": "f38e6c4b-4723-44c0-83aa-59b4da9edef0", "comment": "Malware payload (SharpHound)", "value": "569220589c787e6aff233e49c7966f10", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977844, "uuid": "a21bc588-7ab3-40bf-96e3-3779ef2b94e3", "comment": "Malware payload (SharpHound)", "value": "3f1de04ba87bae0e0a8fd5999a184f8798332723f82b057f8e7c79765cdfb80d", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977844, "uuid": "0ca2ebd5-ce59-4350-a7c0-a58f43d02ecd", "comment": "Malware payload (SharpHound)", "value": "0519c4ac0fe8ace02c9a407b506b3db9f9626bcd", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977844, "uuid": "55f1e708-1676-45d1-8f2f-e2189d520fc3", "comment": "Malware payload (SharpHound)", "value": "487629ba9589d26050c57b46327058218130cdd7de848d171109cfa74939e1f2a1946d54d8c8ad804355fde7ab3929f1", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977844, "uuid": "4215a967-07fc-40af-813a-b5fb20b1cd15", "value": "T1E635016457FC8795F6AF0BF8E46280648BBA7527E92CEB4D5E0CF4EC2C563918911323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977844, "uuid": "5f133b71-1ad2-4675-a316-24c7cee1dd50", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977844, "uuid": "be4d39d4-16ab-4cfc-8d17-7592ad983770", "value": "24576:X5qKvNuXoVIa09WmPstYX3wTasVa2fdzqkong/iN9WCF:XXvNE9WmPDXAmsM2fQFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977844, "uuid": "796120d2-b7d3-4b2d-90d4-9669c18e5607", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977844, "uuid": "992655a1-9395-4fb4-a843-117a182834ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977844, "uuid": "8dc040ca-1981-4cd7-ae62-396fc6bc07d3", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62e670a8-2473-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774021342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021342, "uuid": "9ae0c23c-0882-4099-b0a5-69a816093114", "comment": "Malware payload", "value": "0d522171edc56cb76115324e72a70542", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021342, "uuid": "aa517d75-4cad-4378-ba9d-8e7a4512e9e5", "comment": "Malware payload", "value": "3f86078d3f758aedeaea357c75f7bc82b8fb7ad33a4e8802e93ca5ddc0f3e02b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021342, "uuid": "d3afe3eb-c782-4742-ba88-4664403478d0", "comment": "Malware payload", "value": "534e1072f01844169871d861f807eff85900f176", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021342, "uuid": "96921375-fd7b-485d-8d94-410e77c82b39", "comment": "Malware payload", "value": "b717c985f3b5141af4d7cfb016fc6d9f6b8103cf07509cf7bb288108b8e14c21ac5659ca29134a73b91fb55bc7e0fd0b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021342, "uuid": "1804f2ea-f7b2-4850-94e2-b8e687318138", "value": "T1A4C3644D4A9F459D6B533868C07E140FDEED212B031DD980BF5FABD02F06DA8A1E4AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021342, "uuid": "fa5fd154-6515-4721-b5d8-0e79d5c3cd7d", "value": "768:XpXUwaf6JwY9jC2ERPx2fe6KfCtgzwLlOhSJz6PRzMdNtGND6Xjm38ysPO5KttPe:XdAiJ99U8+GzD+NDwjm38yIH7oAMRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774021342, "uuid": "e71b4e52-a54b-4bf3-8c6c-876ab293e73b", "value": 119145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774021342, "uuid": "8576ff1c-1a4f-494f-bf94-df6b2eb8712a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021342, "uuid": "dba643b3-361d-49ad-a9c3-18715d275ce6", "value": "Research_Snapshot_Temp_3334.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf107df-2431-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773993146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993146, "uuid": "88338d5c-b789-44c9-b630-ad69160f418f", "comment": "Malware payload (XWorm)", "value": "0eae56941c4b9537b0bbc914e1b191c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993146, "uuid": "257f7ff1-5947-4753-83f1-d2c4fff2bab0", "comment": "Malware payload (XWorm)", "value": "4077650d26e922bd7751ad46759b96612bde298e66fbb6235dd08da9280d2370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993146, "uuid": "fdd84d48-7587-4389-b659-76d64d55a036", "comment": "Malware payload (XWorm)", "value": "e475d9af4325d727128365700e24b2d91392c7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993146, "uuid": "02a41687-07b4-4e7f-98d3-60266de5c717", "comment": "Malware payload (XWorm)", "value": "740d3b6313e2edfe2aad393d184a6f95d88ea955558669e0976b113fa4ec521bea61ee6f2a9a259f39fc4bbb6a5347e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993146, "uuid": "0f79d5fb-72d1-41bc-98aa-1874cd261f33", "value": "T1B24733C0AD4EA6B6E866F8F3A05051007619DBA9B0DCDD7B5F89478CC884D18E83793B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993146, "uuid": "5f9e1b10-3c73-4474-a024-39a98011fad2", "value": "786432:mNcRQoGY8e+WWSc+uPihPr+WilDeW0o2NezikK:EcDUbSctipixeW0ohikK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993146, "uuid": "0971976a-a1df-45e8-9d63-d22f4e571931", "value": 26577408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993146, "uuid": "00046cf1-1d31-43ed-931f-db6aca142d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993146, "uuid": "6da7cc9b-06bf-445b-a384-348f92b683d5", "value": "rfdnmghdfngdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fc5039-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989264, "uuid": "66b0f14f-67c6-4b0f-b999-3f4901744606", "comment": "Malware payload (SmartLoader)", "value": "a8a8fbb1b583e8e6ca5c66fc6e63d7c4", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989264, "uuid": "6f840359-e016-47ad-8d10-d0517a136d69", "comment": "Malware payload (SmartLoader)", "value": "42739cde2f5721fba549713f1a222a90ce734b52a19dfe1ca6f04b23b5f5def5", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989264, "uuid": "561f8720-fb17-4422-8ed3-910274e15b63", "comment": "Malware payload (SmartLoader)", "value": "81c6f41ea222565168d7501c4f1dbbc5f7bcb18a", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989264, "uuid": "a43a842b-e793-42a2-8cf4-3a380afe557a", "comment": "Malware payload (SmartLoader)", "value": "335d4de4ad95befdf9708222a4627ab68a62ad603dc22f92eadcf3da0f58227a6fb355e55acece8fdb89fc22c2304bc8", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989264, "uuid": "c4ddf1c6-08f1-45d5-8dce-5b5ed7ab98d9", "value": "T1CAC4238BA3FD845390BB1F58AA5BB48D091976F34722DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989264, "uuid": "826a196b-d615-4485-9fe0-baa494031c55", "value": "12288:T+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byvH9I1P0QKw6FEH:T+QqldA/TSO713u7xnvH9IaQKH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989264, "uuid": "6fa134ea-99f9-4f7e-9bf4-d955ee41110e", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989264, "uuid": "bc277c51-d959-426e-aa9f-4b250ceaefcb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989264, "uuid": "73179b67-7fe2-45c9-8156-dfd407dccb61", "value": "End_to_Databricks_Data_Factory.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4566db37-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041049, "uuid": "e4b89566-ad7e-4bd3-94c5-b5bc77c916f1", "comment": "Malware payload", "value": "55b4a29277b9a44634e372504b22d7bc", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041049, "uuid": "ede34f5f-1703-46a9-9a40-aab98525052e", "comment": "Malware payload", "value": "432cb8cb4f4a07d1667ffc2e2d2be5f0b81882430c29ba3fe05a8053ac1661ff", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041049, "uuid": "5fea19c9-b846-43ea-97ec-d5df2c4d0774", "comment": "Malware payload", "value": "18681ae64d5c77c92a059d7f3b714510ea160cc7", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041049, "uuid": "dde6071b-3247-4b54-9f2e-bf46bfe65b5b", "comment": "Malware payload", "value": "1d1d3a1f97c288d9f735d4560039850ec8acb92a9625a0be32f4ba7dd7657f1464d2f3df7722a675e12825c69b7a59d8", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041049, "uuid": "1f1f30a9-a798-448f-992b-c63af1b5c3a6", "value": "T1B706BF89BD9D3950DA856A3E5FFA06C5272DFE4F2F5287173910B3AE21F22094ED1234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041049, "uuid": "f58bd7ee-9930-48bd-9977-eb04e84e8a54", "value": "24576:0FUB1DvoWAgd0OwCL88V5FLXn1WvxRQZbQbRT4MwFDMJ6FA0+y3E2nm7VztxY2FC:0FUfDweLk6EaA0hngVpx3/ZXPImKiDLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041049, "uuid": "b90f3a04-5040-4c8f-bd36-62d99f6361ff", "value": 3923737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041049, "uuid": "a00d9bc0-a917-4277-9560-d6ec0df66ba0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041049, "uuid": "e97b1fdf-b34d-4d12-8f32-8babe2d1a3dd", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79f8d7b-246d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774018907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018907, "uuid": "5c254850-38cd-496f-8141-0f6236e22e77", "comment": "Malware payload (Mirai)", "value": "31935d5d5a32a71a1fff6cbb527b933e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018907, "uuid": "cfc80b03-6f84-4424-951d-29bae8e8f6dd", "comment": "Malware payload (Mirai)", "value": "4373b23c8aec543833b243bff35382c1c035baa3f788b63c55f3a7feb7733a57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018907, "uuid": "6f56af94-9915-4b1d-8a61-ab86cbaa4ab5", "comment": "Malware payload (Mirai)", "value": "b1cf30f817de977cef804e11634df8685b63beb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018907, "uuid": "cc9510ea-9dac-43dc-b872-2106081cac0d", "comment": "Malware payload (Mirai)", "value": "78921ef68165e67b86f8baf01ca24ba037a32e38674b4d8c7912d67204f1a07ade21ff0b6a53647a4d5c674d8ef2bbca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018907, "uuid": "fc37cb17-4cea-4d41-9840-159eb5a310b2", "value": "T1BCB3E649F8415B11D9D625FAFA5E0289335707BCE3FEB102AA211F2137CAA5F0F36946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018907, "uuid": "1f750d59-4fe4-407d-80cc-30d2dd8a41c9", "value": "1536:C3nrDHrWXW0+3BEVYqxmPJtEwIJqUgmP/MatQ1CMseTo0Bl1GqUifG0wHYHQQ2H:oWmbBEePj/UjgmPEatQ1CMs+pG0wH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018907, "uuid": "f357201c-d036-4800-ad2b-1bd8b87639f2", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018907, "uuid": "1b659373-fe02-41d3-bba4-d6f13e00796f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018907, "uuid": "ba9def9b-d07c-4be1-9313-fe1a709ee3a2", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce63e650-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050299, "uuid": "904610aa-2181-4b3c-a2d2-0f9da47670a5", "comment": "Malware payload", "value": "77e8862b1e383e7e22046f4df1b78e02", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050299, "uuid": "8f4db479-d1de-47b4-8402-3338a5cbb8a7", "comment": "Malware payload", "value": "4397674e2b3f14b9b6e9e66b4aa8e30cf68ef082b8f1d4e80ec885958b08a9c7", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050299, "uuid": "1fb3e277-f6a8-4131-887f-5d8100b06e64", "comment": "Malware payload", "value": "d2b0ec807b7839088502a0e4b18d17cc8f3d0cbd", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050299, "uuid": "e3a2d5f6-af10-4ca3-b8f4-cc023ab34c00", "comment": "Malware payload", "value": "f9eb256e54711bd32f6cbee28b3d70c078dacd12bb034f986768f6293e4171aab9266fa7559c59a17e9dd4218843e701", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050299, "uuid": "e8fff240-3a3d-4a31-b306-87532988c8d5", "value": "T1C6D66A49BC1D7462DAC979742B2613547338FC459B81C3266624FB7CAFF2398CB636A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050299, "uuid": "d642e858-56f0-48bd-adf8-161df161cd9c", "value": "98304:N+xuYyshUltLUUmeAImmpVqDoJcG+FEL2K9HAotJV0kxukUhkJI4ds7mE+GWTgi:NIuYyshStLrbmm6kJcGzVnFW7DXhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050299, "uuid": "104bf53e-908f-4e39-907d-c7d4ebd65659", "value": 12774882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050299, "uuid": "8eeacf48-fea9-44e6-ab3c-fe48718a5a1a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050299, "uuid": "6049c148-cd00-479c-859b-f7a00dce28e4", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a626b21e-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050661, "uuid": "cf8d8b92-639c-43e9-afce-78d399567aec", "comment": "Malware payload", "value": "8cad6f87a77c99650cf971859ecd9096", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050661, "uuid": "59450aaa-e96b-4d08-9477-c19d5ade7938", "comment": "Malware payload", "value": "454c3881ca6a4de23eed3d09884fa43485ee0a80de54187259639ce60949ba02", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050661, "uuid": "4947b772-94cb-4c70-9a16-b57479c9c5de", "comment": "Malware payload", "value": "6106ab021c3d9ff52376bbb30c12d76043e4b91f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050661, "uuid": "93f22715-722e-41d8-bcc3-2ff2c7687c40", "comment": "Malware payload", "value": "d1c7e987f9a1a0a5283170c72f0f600207f8c10bbe747b68a8d3a428fb62694de60c3197dafa39a66bc11f8f628cd8cb", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050661, "uuid": "7724e6f2-d6c6-4404-8ee6-c36cb56e03a8", "value": "T176D63903E86565E9C1AAE23486669313BB717C495B3033D72B60F7342F77BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050661, "uuid": "ac30f863-8863-458c-8f84-03f35c4b675c", "value": "98304:xGPK/6Nukibu3xFxzeXyahdxHCnCN77F0AkQQvALd1Tw16VhdkkHPEJtWD:xxkibuhFxzSfxHAy77uA1TXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050661, "uuid": "d7d5c56a-5fb4-4f05-81c1-418ac417da99", "value": 13437664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050661, "uuid": "d35846ce-045b-4e80-b565-16a928ae6f5b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050661, "uuid": "9d8caf38-97f6-4cc7-a91b-1447715e3754", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9716d393-24a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774042904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042904, "uuid": "33b3a135-c971-4cb3-81b1-289e226b29fd", "comment": "Malware payload (Mirai)", "value": "dd8e95ebfdd2a24f86e5053a7b688a4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042904, "uuid": "c83a5186-a32f-43dd-b598-b863e32fc688", "comment": "Malware payload (Mirai)", "value": "4632a5635ff349865211b872bb7a8e8463acaae7354881ae1d90d4ffb8ceff2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042904, "uuid": "d1b4bfca-4e4a-413d-9eb5-c58d9369b854", "comment": "Malware payload (Mirai)", "value": "53afb6e596aa3a15a490d671324efc9f8d3430bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042904, "uuid": "b1b935e9-c097-4309-8a72-ab6198dfb254", "comment": "Malware payload (Mirai)", "value": "5ede3da991e0ae6d048b920ec3ddca171b44ad8e8079496e457ead7a25817ea990b67b7f223e19446be0cc0018a0c609", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042904, "uuid": "87466641-d47e-4256-baea-5ba6c316ab48", "value": "T12FA3F649F8415B11D9D635FAFA5E0289335707BCE3FAB102AA211F2137CAA1F0F36946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042904, "uuid": "439522b9-854b-42b1-b964-c211c6098743", "value": "1536:C3nrDHrWXW0+3BEVYqxmPJtEwIJqUgmP/MatQ1CMseTo0Bl1GqUifG0wHYHQQ2HK:oWmbBEePj/UjgmPEatQ1CMs+pG0wH1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042904, "uuid": "750ab997-dba5-4c44-b485-abb51892d80d", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042904, "uuid": "aef3c403-457f-40d3-880b-385ca35c0612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042904, "uuid": "409b6f80-5bed-4041-86a9-5e1209bbda87", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cde9830-244a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774003776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003776, "uuid": "09519d04-7805-49ec-8385-a07a4948b93d", "comment": "Malware payload (ACRStealer)", "value": "4618187ead58675e7069e4e8549ee8a3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003776, "uuid": "42fc7131-3076-4068-b394-75c5d724724b", "comment": "Malware payload (ACRStealer)", "value": "468a08bdc8fdccd23edbcdcc59289473c7599c7e09a75f23578adf0ffe227874", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003776, "uuid": "4e0e2c54-d523-481b-bac2-475b41613ce6", "comment": "Malware payload (ACRStealer)", "value": "af680932927d275f7c54a2c24a9ce0e7fef360f4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003776, "uuid": "44458958-61b9-4ac6-82cf-cecde83a8917", "comment": "Malware payload (ACRStealer)", "value": "7d13b8acd634dbd081bb9acb6ef785c5d07314db702bc05dc9467a84af371d17f8881aae8177ba930b9e7789bb19ab8c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003776, "uuid": "8ac9fb2b-8b62-4103-a7df-5acef7313a15", "value": "T11855084684C510E7F3B242BFB75AA5173F7F90884A35CD2E41D9829D209356EB3AF6E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003776, "uuid": "9751651d-9261-4510-a377-aa7830200642", "value": "930cd30b71f5517743cd215519f67f2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003776, "uuid": "ce473415-4ccf-4ce7-a664-a4f5da8b41fc", "value": "12288:Ebc34pewV/oK3eo8+KaoNz7KJlYsEi1dhRztOGLvvobXDZcFohvxUHE7q7ps7PuT:CpeaAKt8Al51dTHnobXDZ1tQwuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774003776, "uuid": "5d3654bd-c34b-41a5-baa8-cebfcd26c3ae", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774003776, "uuid": "2cc7ce80-5735-4f03-9f67-e19ed3b61cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003776, "uuid": "df3dfe11-90c7-4094-ac93-c4bf60fb00a7", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6437e3d-242d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773991444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991444, "uuid": "a9caf28d-f8c9-4b64-ba44-0557bb6300f7", "comment": "Malware payload", "value": "e9909a7e16b2a87f182687d4449c0d91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991444, "uuid": "f3861012-860f-4e39-a46f-e26c99e2b2b9", "comment": "Malware payload", "value": "471ad160762a5c3f541d4e76ee086ee351da2e280daf11d6d009f89366395d83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991444, "uuid": "1122f99b-e000-4f84-be8e-bcee4f0244e6", "comment": "Malware payload", "value": "8f4ea08fac48620303f0735fd7d98c455eb2d40c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991444, "uuid": "6e1a0b12-550d-4d1b-8562-f62618d6bc5b", "comment": "Malware payload", "value": "15628d3a2b4ab29fb2f2fa62f6bf1e62acd8fbd2e447614f16846b7ab45125af9972696eb552873e96e9b0b4414e0c29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991444, "uuid": "50df5792-0152-42f1-ac2a-bbec50a879bf", "value": "T19B7533F62480FE2B47AB635986AD2444A9E053BD7E83DE1DC2D35FE041A3456E3264A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991444, "uuid": "1c640b88-40ce-427e-bd08-dbdf872cf880", "value": "24576:PBAkZU/g2bB6GXkXYF6EUSnIjiB29NSN6UIruCVFQcyYBOarpvfXZc5j+RAU2Gae:P21QGeJEUMTXjKyGEo3X25jm2FIyHz2Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773991444, "uuid": "2ab0709a-c49a-4ba0-a4c8-e77e53f6c6c2", "value": 1695124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773991444, "uuid": "a0539155-aa63-4664-8fa3-95831ab6d226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991444, "uuid": "ea2ecd67-aca4-43e3-96ec-813a8aff957a", "value": "linux_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d56e51-248d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1774032645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774032645, "uuid": "8b5b5fa9-40ff-442f-8af4-4fd3932b86fe", "comment": "Malware payload (SalatStealer)", "value": "d448fb4d9b090639c467dda44d3545a7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774032645, "uuid": "be47f6ef-3823-48dc-b662-395222462d2f", "comment": "Malware payload (SalatStealer)", "value": "475ac7aac96ed4d60028f3f267946d3e2071b82f05f0e0a432f0e5e6ea0f3ff5", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774032645, "uuid": "15c2768e-41cd-4af3-8666-7802db5f8a1f", "comment": "Malware payload (SalatStealer)", "value": "015b73ae3dbb4e17dce9463a509f4b3da257ddce", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774032645, "uuid": "8f597724-a9f5-4c48-abbb-2f77eabf24be", "comment": "Malware payload (SalatStealer)", "value": "27e6d0b2cd3b6003d6770e71a02dee02ddd64c3ab45043603ed1ac4b9306ba45d6c91883b11478ced246a4cb2d5e6563", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774032645, "uuid": "575b4890-14e5-43f2-a741-6f93bcb4697f", "value": "T1AD76334CFB2325F4E56640B128EF327AA6A61E194509CAD7CFD97825B67FB302E04707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774032645, "uuid": "ac77b495-de2e-4eaf-9814-cb77dcd1192f", "value": "ed5d1d363850b12b657661b44431abdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774032645, "uuid": "f2265b14-adcc-42a6-b9e8-c3e55225090a", "value": "196608:Xpi/2rPETYQ/s8i+JsjX5EfxsjX5EfxsjX5EfL:GaHN8tJsjSsjSsjq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774032645, "uuid": "e639befd-aace-4567-b047-7003a5850f50", "value": 7142592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774032645, "uuid": "b5de5f3e-dc24-4ac6-9ebe-76f4b8912862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774032645, "uuid": "91536650-0e1e-422d-93aa-8032d9d1ea45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99f059c7-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978055, "uuid": "9c08d0a7-05e3-4316-8f22-fccd602227b7", "comment": "Malware payload (SharpHound)", "value": "0ffa220da6506b79e8b7fbd2e20bccea", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978055, "uuid": "0d098d3c-650a-49ab-a9b2-6cace4561733", "comment": "Malware payload (SharpHound)", "value": "47d5ccab5b87b01221569b1ea01c81dc9136b28bdeaf3f50e362f763de6f10b8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978055, "uuid": "6dc87164-babf-4e63-8b36-5ebd294724e1", "comment": "Malware payload (SharpHound)", "value": "1df5cb31582a06693d3a11805ed276a3cd6893a6", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978055, "uuid": "782941cd-8bb2-4c49-8334-6842af7af9e1", "comment": "Malware payload (SharpHound)", "value": "fd64e685b9e48f3f223ebba5a66acff7133d6bff20230856fe5cb7bd797c4f628ca8b384b27253889fe7957adf408ba2", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978055, "uuid": "eebbb5f3-0032-4d08-a89b-b013ed1a88e0", "value": "T1ED7533725E2B4C6D4F3882385AB7B76C8BA46783802DC9B777CC94C11B2BF90499746D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978055, "uuid": "e881dd93-8934-4d01-ab3a-9cf07b86af46", "value": "24576:h8uADIrpM8TtspjylCsP+/UxC5GAY1JFBx2aP0kRaOKM6B9VTsXnykP2z/Hdh4:ZADeprQAr2Mw6ydh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978055, "uuid": "16c2b879-7404-4e91-ae90-0ccf50929235", "value": 1625925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978055, "uuid": "40407464-5109-4366-ac9f-292437d44836", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978055, "uuid": "d76ed160-8ee3-4278-9c73-2463a9a7cd0a", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009fc295-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046947, "uuid": "5c4249b1-5769-4c2d-96ed-bc20814f1cc9", "comment": "Malware payload", "value": "6c62cfa6ab6a9ad0ffe6088d3dca772b", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046947, "uuid": "eb198b89-260a-4dca-9363-926510be1992", "comment": "Malware payload", "value": "483de888694618655ee378f5d97f73103c2bf734b09eaf1bc261d9cf48b2970b", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046947, "uuid": "0e9c4d50-d45e-4793-93eb-2fec11a5cca8", "comment": "Malware payload", "value": "1db3d38fc0fe7c8d9be3957a83b7ac6fe44e5abc", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046947, "uuid": "b860a5a0-78e7-4c01-bc7a-993408581461", "comment": "Malware payload", "value": "4c0112adabeb19f0322b26917516bc23d1145d49ca710cc9d45e7d7e4820a67cdf11a534fc049886e2d638a18bc45477", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046947, "uuid": "996d7ebe-2530-4d5e-9d7d-600b9be438dc", "value": "T15955121943F88B92F6AF0BB9A4658045C7BA372BF96DEB4D994CF4ED1882354C940337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046947, "uuid": "904d078a-4ba8-4b66-b046-6589ee92db4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046947, "uuid": "14fc4bf4-71ff-4abf-b8e3-f89c7e6246a2", "value": "24576:0ILIGEDwgrRvNuXoVIa09WmPstYX31FS4eD3IJXuAkong/iN9WCp:0DzRvNE9WmPDXlHe7I5vFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046947, "uuid": "1e7ef632-2dc4-4bda-ba24-ee0581ac4069", "value": 1295872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046947, "uuid": "e6b3f24e-c804-4f77-b4d3-a53f4cc675b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046947, "uuid": "a935b4f8-6704-45c2-923a-740b545a5e9c", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69e2388-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040837, "uuid": "a8362d13-7620-4498-9ace-bd4f7e912ed3", "comment": "Malware payload", "value": "f9ffa6cad0746638e3edbda51a0db90e", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040837, "uuid": "205a3994-f00d-4f95-b84b-5edd479cbdf8", "comment": "Malware payload", "value": "48a320c4c181c8d5a2560c23b10ec8ad829ce7fb5dd73b0122e87155d3b83347", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040837, "uuid": "e8986566-7c2f-40b3-b1f8-c35c58b4234d", "comment": "Malware payload", "value": "3b9a10b386affa372aab09f367518f83b7daa12b", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040837, "uuid": "312c0243-a26d-4e29-82d5-1fc94b324c23", "comment": "Malware payload", "value": "c1cc30836fc15530383f076f728631438203f338ee7bbcff77483f8d72b97f7735a9e43c1e56627aee24ed12ffdbd766", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040837, "uuid": "c0d732e0-d5c3-4e66-9068-226630dd0db0", "value": "T12906BF89BD9D3950DA856A3E5FFA06C5272DFE4F3F5287173910B3AE21F22094E91234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040837, "uuid": "78fb2b30-3b5c-4d7a-a9ad-2c4b14d8f509", "value": "24576:cFUB1DvoWAgd0OwCL88V5FLXn1Wvx/QZbQMRT4MwFDMJ6FA0+y3E2nm7VztxY2FC:cFUfDwel16EaA0hngVpx3/ZXPImKiDLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040837, "uuid": "ce838534-f062-45d5-8db7-513f8c893df7", "value": 3923737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040837, "uuid": "c6dd976b-efde-4b4c-85df-5d27f6585c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040837, "uuid": "192e8e5a-589e-41d5-b598-d4e305decac9", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cda980e-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978033, "uuid": "4cb67d74-f3e4-4f8a-9bac-f2426dee78d0", "comment": "Malware payload (SharpHound)", "value": "02519eac10cb0606e8c49282489efa1b", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978033, "uuid": "e07332e4-f3b9-4c1c-b3df-c37916a990ee", "comment": "Malware payload (SharpHound)", "value": "4a546034fa7a4076be358e027447ee262a5e274e9050ba9bdab5c8dff4ca1080", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978033, "uuid": "7e72dfa7-0bc8-42c4-9a01-4d0f87d829d4", "comment": "Malware payload (SharpHound)", "value": "bf351fffaf8a44e85fd1aed2330428de01ff1f55", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978033, "uuid": "42ba06a4-6fe7-46ed-850b-f1221a41f856", "comment": "Malware payload (SharpHound)", "value": "2b8fa6795c94d13d8929dc94a328840ae7c35baaa69ca95d509015543f192e126930d5cf60e97156745db706eb481459", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978033, "uuid": "f22a1d95-83d5-4a81-859c-a8448187de5c", "value": "T1E4753373EE427DBC8974D63874AF5E0EC5A087A7908C9DA633DC488597AFB06046783D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978033, "uuid": "072b4c6c-232c-46a1-9c1e-821e942ce501", "value": "24576:cIsZvVhR2IUADsXXMR0J2iIQhVldeMGrTnRujytraia5EEULmBbKlv9ysHADijGH:iNEvU0FhmMjytmZ5BkhHAeb1lO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978033, "uuid": "5e948b86-1d1b-45a5-9af2-d300265262b1", "value": 1616185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978033, "uuid": "706147d0-0bb4-4352-a4e7-8931b405d8d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978033, "uuid": "ad0a7312-9a93-4030-b517-b6759be7343a", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ef7da1-2429-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773989771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989771, "uuid": "be029f7b-3de1-424c-a91b-f13cabc8f2da", "comment": "Malware payload", "value": "2ca4fce71ab235536d6047a1eff8a6ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989771, "uuid": "36d30ef7-d693-4466-ab23-1ca676bb65c6", "comment": "Malware payload", "value": "4a665feddc2f1e4ed7665f49c2dfae1d05b11d6fe921e2e4f7ae1798fee0c89a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989771, "uuid": "f1d2547c-9488-44f7-82b4-0451fb80b708", "comment": "Malware payload", "value": "dbc0e6fb02993ba74eefdeb1c62ab8739883d63d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989771, "uuid": "2988cf92-a1b6-43fe-9209-c7b4cb2d67d8", "comment": "Malware payload", "value": "dbb9cd7daad457cafe28c6a6264c84544dd88b49034952600718f544496abd87bca1fefc89363d12644122ef783f42cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989771, "uuid": "36750923-bb3d-4e5f-a50f-c74b008daacc", "value": "T1548533CDB9A1BF5E5CAA4A6B19111B244F35C4A0C8B1213BBE210EDE997FB3270547F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989771, "uuid": "be65fe42-b616-4513-9ae3-66be42a20bbc", "value": "49152:pMs8ZepcxFYANCFZ93KCozhrAc/rJA8zOc:pxp6l49dozhrrJHzOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989771, "uuid": "fc5f1cb6-0252-480d-a7ad-8af15ab9b768", "value": 1707176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989771, "uuid": "d94805a1-9bbf-4591-b934-0aae122f0594", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989771, "uuid": "24823b24-8344-4aa1-ae43-43834130a4e9", "value": "linux_mipsel_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4de30166-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041064, "uuid": "adc9c65f-acb8-4aa4-8f59-9ea2cb8cb4c8", "comment": "Malware payload", "value": "1a01c4cfa819794a74c3d7740f885b70", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041064, "uuid": "f8138bb9-d0a3-4a0a-ad76-4c4b822141d5", "comment": "Malware payload", "value": "4a91614f59c9a659a54532f065fdb9913ec414c87edcdf293416612053a0ec85", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041064, "uuid": "3deca581-f9f7-4f4f-8e9e-87f2f1ca4502", "comment": "Malware payload", "value": "b0c5e8beb0b393d72a51591f95be3556c3687ac8", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041064, "uuid": "a9edc033-f190-46d1-96dd-56208c6e4f99", "comment": "Malware payload", "value": "80b1574709e8244aa7e00416a73ae02a8d601e1dffa98aedda7e1e5ce8b3ca054add141aa8ff42b25d0b170a3a450260", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041064, "uuid": "e1521864-dafc-4e8a-b114-e1e22f299039", "value": "T17403C68635141C1843F6E7B7AA414B80137311B72D176ACE3ADDA9BD9B2E1EE1B710CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041064, "uuid": "c38d9cd3-bfdd-4a43-8657-fc303ee2db27", "value": "768:THwAhDBRQ6u54v8VgqEkQVlB1Zmw6CMUM4LvfnCMOaHLhqghCPzr0Ih5ITOx1ZoW:7wAhDBRRu54v8iqTQVlB1Zmw6CMUM4L+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041064, "uuid": "add63c75-5626-4a51-846d-f6ed428a035c", "value": 39529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041064, "uuid": "cc9763c3-95da-43b2-a35c-8db49d689480", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041064, "uuid": "d36583b0-4ba3-47c8-a734-6dfa37aab513", "value": "winPEAS.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb666c5a-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040845, "uuid": "4a80f7f6-17b6-468c-9211-b66e284191c7", "comment": "Malware payload", "value": "830bb84eef7f1257c90771b954fb37c6", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040845, "uuid": "49bfef63-875c-44a3-be13-5a427ea24e1f", "comment": "Malware payload", "value": "4b2f116845d50d9ba9f663d308803e474aeec82712a725b527ff8a6cf744cdbb", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040845, "uuid": "2ec2d8f7-95af-4663-af36-2e0e292b580c", "comment": "Malware payload", "value": "1c1dc2077d3612e885606b553d27910267c3a800", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040845, "uuid": "ff44c2e2-44c6-4b1e-8e6c-4591d69c9beb", "comment": "Malware payload", "value": "4cd0bdc30fd03e8f35857ef95c92121b10dafe01911d87c55d36f913ad2e2fd5576f0b5083e2c20365c2810cba23a76b", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040845, "uuid": "d4420df1-4304-4b6e-9911-b30c771a2b9d", "value": "T15EB6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040845, "uuid": "2f14a3e4-d949-4164-8d28-8e3a43eec708", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040845, "uuid": "d0c9f583-4461-4b98-8271-eeb06effa076", "value": "196608:ovyxUb/VBFUcwti7TQlyVN8iNISRTRmW5Qy:NcXHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040845, "uuid": "2ceb0cb9-38f3-4e10-b215-be1151a248e3", "value": 11109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040845, "uuid": "8a493a66-82ba-4da6-857c-90b64ba5ae2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040845, "uuid": "eeeb67c4-f6fc-4bd5-be2c-b65d426c443e", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cdb9c87-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041089, "uuid": "00cde7ee-aaaf-42d8-b734-fe95b63f9c50", "comment": "Malware payload", "value": "a8356b34ed9a1f35c5ada7d232215552", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041089, "uuid": "3522a952-94ca-4b3b-82be-6a77d9c3297a", "comment": "Malware payload", "value": "4bac0e3bfdb3abcc357612247572ff7567229c65ff75454794225fd50e4b0047", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041089, "uuid": "9d31d97c-ed58-4664-a9a6-7e510638632f", "comment": "Malware payload", "value": "6c40409b04a5c6bb27e81d217949a5e3de534cd7", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041089, "uuid": "d60b8dbb-0d78-4109-a76d-8c22f689abad", "comment": "Malware payload", "value": "fd66012d7311ec3d42ccce7ebfb3437dca35302baaa5b061bea6c2eb4eb54d11df04c42db79a4a975dc40551c6098bfc", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041089, "uuid": "9d0fa52d-8e9e-4db6-9d77-13af82b85d95", "value": "T180B6D044A2D90969D5AF0E7D806102325739760A539ACBCBFBCC82980F53FE5DB77326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041089, "uuid": "be19df56-ec9d-42e7-abfd-967043f8dfbf", "value": "196608:dkvwQVBFUcwti7TQlyVN8iNISRTRmW5QD:u4IHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041089, "uuid": "5b501056-59a4-4631-8ef5-a1600b972d89", "value": 11084800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041089, "uuid": "a4cb7d7e-a190-4fa8-99e8-0156231a4b27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041089, "uuid": "a6ee8d22-766d-4c4c-affe-c02f4cb76403", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c01be3-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041072, "uuid": "ebc1b78f-68e2-440d-844e-0f2278fadd87", "comment": "Malware payload", "value": "6ffe4dc13ef84ff63f65946d74e4c47a", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041072, "uuid": "b3e0fee8-3d57-436e-bb26-8d008d29f040", "comment": "Malware payload", "value": "4c075484e0a6d35d495bf46117ff5a531c23606b97661fdda19febbeee89b80e", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041072, "uuid": "77782d6b-ed33-46d6-adf4-3d67a54c8e3f", "comment": "Malware payload", "value": "80a5b6149f996222f749293c13b6b0c05a2f07dd", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041072, "uuid": "a03334e2-b3bb-46ca-a586-8cc9b8b50355", "comment": "Malware payload", "value": "39b07396811d0ab605f34991fc87feb71e348da7e944ef2acc3462418a969f2a3ddba00b5b02e162900ac43b779785a4", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041072, "uuid": "d345126f-0db6-404a-bb01-83c7d86bf2ea", "value": "T199B6D044A2D90969D5AF0E7D806102325739760A539ACBCBFBCC82980F53FE5DB77326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041072, "uuid": "082eddf1-6909-4777-9bc4-005db1854ca8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041072, "uuid": "d46c9216-289b-4de9-925d-1993f085d347", "value": "196608:kkvwQVBFUcwti7TQlyVN8iNISRTRmW5Qqh:T4IHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041072, "uuid": "15e158a9-493d-4526-a578-4e38a7b92dc8", "value": 11085312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041072, "uuid": "2bd589c8-5c61-4bb7-9b9b-40c9b3914b46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041072, "uuid": "43a007c4-891f-4ebd-bca9-223be1bce4c9", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae337ead-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046809, "uuid": "8defcba8-c328-4e7f-b64c-25a84dc60168", "comment": "Malware payload", "value": "640270a8885bae8b43016fd277ea299a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046809, "uuid": "48c9eb74-fbc1-4e5a-92df-d9e86e9335d9", "comment": "Malware payload", "value": "4c1e7c7aed75491471f54c06ed6bf96749db2d43d314ca7a00a477ebb112d7bd", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046809, "uuid": "ce808ef1-51d9-462a-aaab-f53876be8084", "comment": "Malware payload", "value": "0b55c0b68af89d80ac070147d8608bb2f71ab8a0", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046809, "uuid": "2518b859-0504-40ef-9421-41010817825f", "comment": "Malware payload", "value": "a0a9044cc1a2270d05a17f499aa1b6c5bf342fef273ca1a91884a5bac05ff2626c3d6c7cb6f63bf291a8d59b425c5325", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046809, "uuid": "5a08fd35-59c5-4083-8f88-5a085213fb3e", "value": "T18655121A43F88B55F2AF0FB8A426505987BB7617F9ADE78C994CF4ED2482360C950333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046809, "uuid": "734acac2-b029-4f86-8c0b-c6c9b48bc7bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046809, "uuid": "3942fb7f-96eb-4ddd-9aed-b20691353e7e", "value": "24576:7pLIGEDwgrRvNuXoVIa09WmPstYX3Rg8ZV4CtrLlZkong/iN9WC:72zRvNE9WmPDX1ZV4C/ZFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046809, "uuid": "1faa1553-7edd-483b-bb0f-33a97b1b8e86", "value": 1305088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046809, "uuid": "dfc19467-27de-4276-96d1-80354c3a01f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046809, "uuid": "6a1c6d9c-254d-4fb2-9cca-c39925ae78c6", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec855a4-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977902, "uuid": "7d7fcf8d-4482-4880-8373-4f585622e8cc", "comment": "Malware payload (SharpHound)", "value": "7225c80762692788533364b6c58b06a9", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977902, "uuid": "411e1e3c-78e0-433c-b4ba-411725d6dd6c", "comment": "Malware payload (SharpHound)", "value": "4d41b6918f05770efffca656a666714f49cf53d1a41c7dc094577d252b729271", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977902, "uuid": "8fc059a5-3929-48b8-aa2d-f70340f8e95c", "comment": "Malware payload (SharpHound)", "value": "35edba76d0d8790ae785ea5e7933a3184589f6d7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977902, "uuid": "550c5684-7791-4703-a2d5-21084966bbd7", "comment": "Malware payload (SharpHound)", "value": "ea17866a7c7d1a76b13a2e843e97089375fd5600543884ceb963ebd6ed5f85090d8b96c3a430680041d924e104ba4d5c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977902, "uuid": "ea0d635b-cc34-4aa2-aebd-9d047633617d", "value": "T15F55121993F89F85F2AF5B79A03041698BB7760BF9AEEB8D598C74DC2493344D811323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977902, "uuid": "5cfc37f0-b888-455e-9bc7-f05644f3876c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977902, "uuid": "f04fba19-e871-40b2-adf6-8ef8e05821c4", "value": "24576:3LIGEDwgrRvNuXoVIa09WmPstYX3Afr3ppM4zH0CYzkong/iN9WCS3w1:EzRvNE9WmPDXur3pTazFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977902, "uuid": "8df92f09-7540-42ed-a318-6c17f99f9a31", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977902, "uuid": "9cc33bbc-997a-4dd8-a409-c5ab18ed52cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977902, "uuid": "ed7a567f-08a6-40dc-85e2-74372c5ca5df", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd528de-2429-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773989578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989578, "uuid": "7d8b59af-8f74-4608-91f5-255eb776b56c", "comment": "Malware payload", "value": "9690c731f827a245e9d7773bca8a49ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989578, "uuid": "961d0e96-c3e1-4bbd-ab58-d8112ce773e0", "comment": "Malware payload", "value": "4ddefa7635a60e03ff39678587427cc09f810a65b1c33e1d065174fbf98042ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989578, "uuid": "113e53f1-9ee4-4c1e-939e-1ff6ed9a7ffc", "comment": "Malware payload", "value": "177db5523faa16ea4eebcbcf05ed74c22d7d9772", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989578, "uuid": "d87d3cd5-a183-407d-a6a7-2ec6cdec4bc0", "comment": "Malware payload", "value": "72ae5d0956875cca97e9abdbd2262c215fafb544e1382d636737eed027ddbf80e8e65ef1772e3e8faefe266f23103200", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989578, "uuid": "ff67769d-13bb-49b7-823c-f9d3f5e41177", "value": "T14D8533C926D1D8710C105B05B34EF7EC8E89A02FF1B0B56954CB53AD913F63BA6A99F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989578, "uuid": "7cc1a69b-fc7f-4af2-aac2-2a0fbefed86d", "value": "49152:ITF6X8DXTpS5GJGPjqJ7G6cVbzaUm0BNmbJS9KXrH0jEO:ITFi8jkoJIeWbWUvy+KXrUjEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989578, "uuid": "fb32ba16-805f-4d59-b6ee-ac171d0cf31e", "value": 1743360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989578, "uuid": "adfcd63e-3494-4386-8229-261f2216651f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989578, "uuid": "190f507d-c37f-4a53-b209-d1e71e2a5086", "value": "linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453e275c-2404-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773973618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773973618, "uuid": "c7627fdf-ceda-4a8a-90ca-4516ddc46d1c", "comment": "Malware payload", "value": "a6f25df70487773e526a0ce632c955ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773973618, "uuid": "03daee0d-d6d6-431f-ad8b-dc4eade79538", "comment": "Malware payload", "value": "4de3807844f97f84e8f1bfec83ba5c634c57d79e1df138614bd30b447a5555b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773973618, "uuid": "d6de3cd3-ac83-494d-8667-b5c4ad6bd931", "comment": "Malware payload", "value": "08f15ed1120344738e42c9a71117bd00dfc980af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773973618, "uuid": "a670cb3f-c485-4002-b147-5cd732330730", "comment": "Malware payload", "value": "92c24ee2fe5310ae92ef322fcee8fc048fff42898f53ce91986a6fbd183e5d783e80e27db3ab0cc944f77ec5399ff666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773973618, "uuid": "d1a1493e-9016-4594-8c2d-2a181b5a8be7", "value": "T17F45BE52F3C5FE63E47781704B7B5BE69B1EEC214B02C0AB36A0369A8D3E6D13594346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773973618, "uuid": "90657d62-f71d-447f-8db0-72be31c406f6", "value": "0a95813dd2062bbceb7b94c8b7a627c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773973618, "uuid": "1efe021f-b111-472d-a367-5eadfa23d668", "value": "24576:EVUVgpvVNfVzf+lNKuUGavkg3NyuobbTQ4YBAUZLYKVEeBH:kpv/9kNKuUGaXVL4YBAUZLYBeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773973618, "uuid": "32bb2768-2923-4777-9332-99eac7021c9d", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773973618, "uuid": "a715e8b7-6586-4c58-83d6-bee749de7947", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773973618, "uuid": "2965ac65-44dc-4cfb-ac85-c0d1aca16c90", "value": "2025-05-05_a6f25df70487773e526a0ce632c955ed_black-basta_elex_luca-stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84f7734-249f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040464, "uuid": "fbcf29f5-9d4d-47b9-8a5b-6d66e2365190", "comment": "Malware payload", "value": "98e203490e01500be622db3bf2bf526d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040464, "uuid": "59bb77af-fba5-440c-99d2-078e93911ad0", "comment": "Malware payload", "value": "4e99b6ed57f9b1ebfe112fffa6893f743a64c93042515f2c53b091f6f7fa2994", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040464, "uuid": "5ff348c9-58c5-4f05-a86a-5d6f9b77f81d", "comment": "Malware payload", "value": "5857b0f4221a8c4bee15b782b3e1f66937b09740", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040464, "uuid": "08ef0a51-bb60-489a-9120-1f2877f8cc69", "comment": "Malware payload", "value": "9938d9e36676ed0ddf3a308457c7efdac446956f2b4637678ecca88617dacd3fd28cf1b71edf85f7ba427f2a33f3441f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040464, "uuid": "960a80e4-fff3-493e-9ddf-aa2a5bd981fa", "value": "T107C58D217586C136D67F03B02A2DC76B45797E603B7784D773E86A2F1EB09C18632B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040464, "uuid": "43f0ec57-7cb2-4471-8d32-748e3fc219ff", "value": "49152:/T4vLNgmUESIEjPMN2lv+oBrY6qYaZrf5jSTUial6MV3eVougTtA0JrMf+7UVZD3:b4veHjPMNaXYhjSTBBMV393A2q+ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040464, "uuid": "3a3cbaef-6a90-411e-95a8-03cf7d6e9e9a", "value": 2597888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040464, "uuid": "d307762d-1bf4-4f90-8f92-73e5664bac29", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040464, "uuid": "3fec4fc4-9b3c-4174-9349-67b8a7a50197", "value": "ast.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e66956-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978189, "uuid": "ac174ddd-4f25-487f-8077-362e4698946b", "comment": "Malware payload (SharpHound)", "value": "954207db3b47bc38dc76972d2619d873", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978189, "uuid": "d539641f-59e6-46f1-8f06-cd1e2399bd03", "comment": "Malware payload (SharpHound)", "value": "4ecc8db282d50ce1166f0e476f6cc6ec2791cf040ceb1dd9451f65bb95bacca8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978189, "uuid": "903cdd1a-1efc-486d-8755-956791250cd9", "comment": "Malware payload (SharpHound)", "value": "8ef907ef5e66fab70250ba1fd95600b4c48c3cd6", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978189, "uuid": "5bf6e595-7b18-4fd5-bac6-a10209b9eb1d", "comment": "Malware payload (SharpHound)", "value": "78141efde266934d3be71b1ef8e1eb2313ffa2c30ad758969dce5866964c039893324511fa7e45f9467883ab2a6bf21d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978189, "uuid": "60a6da68-7240-4ac4-baf7-79b348379b1d", "value": "T1EB55125943F84BA5F2AF0BB8E0358155CBBA7627FD6DEB8E994CF4DD24863508910323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978189, "uuid": "45863bea-4736-4f66-ac5f-6b058a37730f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978189, "uuid": "0609b69b-db2e-402a-80b4-4233a3c995d8", "value": "24576:wrLIGEDwgrRvNuXoVIa09WmPstYX3LrSApksxruRgLkong/iN9WC9:wAzRvNE9WmPDXXSpSqOLFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978189, "uuid": "39f8eb0d-501d-4bc4-a9c1-e29bc933d726", "value": 1322496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978189, "uuid": "7ccfed65-e16d-44b5-ac90-6aae08f6041d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978189, "uuid": "7b8d4a63-c575-4644-92d3-995fd5a788bf", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d713e8ca-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978158, "uuid": "322d46bf-9ff3-4be2-9cd4-a8524c122aff", "comment": "Malware payload (SharpHound)", "value": "b0e2c1d62ba55f631182d5b2313c3a02", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978158, "uuid": "977acdf7-382b-4655-977e-ffef0d342770", "comment": "Malware payload (SharpHound)", "value": "4ee15469f7a644017ab31495ed235759314f424c0628c36f7d2d35a2b0038274", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978158, "uuid": "101cc189-268e-43b0-8bd9-0be1c07537ee", "comment": "Malware payload (SharpHound)", "value": "a5684cae47ee823b3692b2cbb98c82747f18be7d", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978158, "uuid": "1b25516b-c094-4f1b-ab2b-64a5b123b9a8", "comment": "Malware payload (SharpHound)", "value": "92726f07069283e0078e345f5023ff7e12f4f571a60d997f41a4a9fd8712e11389eca2e5d18b9b4dfaaaef7a3419abba", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978158, "uuid": "2943cb1d-0c42-4db0-a197-a405913f94d2", "value": "T1CF7533607F420E6F02788128A8E76F3DCAA099935485E66FF7DC639A5B775C04097CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978158, "uuid": "7069ad08-868b-468d-88dd-79d48b26f840", "value": "24576:FfsJokHe2tyK2quFd7j306YXppls7gcNf0hZ8A+tJDQFABcMBTCaVYuPWV/ywE:ux+yLQf06y1rhGIcG5kwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978158, "uuid": "e99fcb71-70c6-442f-bd89-b1981e284d2f", "value": 1618745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978158, "uuid": "fce827ab-9140-429f-a25e-12a2bdd86fc7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978158, "uuid": "967c447c-7b3a-49d6-b681-92b8b9be608c", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "144e0ec9-2471-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774020351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020351, "uuid": "7e8c6034-7df3-4758-8526-451ecb231950", "comment": "Malware payload", "value": "5c46c04aa48d87736fd1384a7a9eef85", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020351, "uuid": "4dd0e4fb-6839-4100-8450-8289974d18e6", "comment": "Malware payload", "value": "4ee92ec6c55dc328195fbe80701186b0ef054002fa8232be2d568244f24ee5aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020351, "uuid": "72e2fb70-d358-4a11-a6f7-d708da9895d5", "comment": "Malware payload", "value": "5a308d6cf4153560e66a96a53144853296760e86", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020351, "uuid": "6fa1ef1c-0a65-4bec-8e3f-df829160e7be", "comment": "Malware payload", "value": "41a5f64681607326d7c64e7b96bc8e1e6c42807d16b2855fc109271f64ab7f4089630d7cc369bb36b632bccaf4ec1cec", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020351, "uuid": "6753ce22-d8d1-4920-bc01-c3044a6ab59b", "value": "T136924CB512896C79FBD1CE399F3C7F4DADE4C2C42124A3ACBA4F39205A1166DC60535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020351, "uuid": "67537806-2050-4a73-9a12-05e99b759989", "value": "384:bFcuQpWx+BL0SWL0g4zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:bF8i+BL0SI0jzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774020351, "uuid": "58c4f259-bd02-4d7a-9ad2-56c9d85ebb8b", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774020351, "uuid": "a49571ae-db72-4174-b5b9-9b705a595914", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020351, "uuid": "0cbf9508-f8b4-4236-8752-e90a24b63693", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d56d13e-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050592, "uuid": "3298e99a-6960-48a7-9c40-eec5f39d56cc", "comment": "Malware payload", "value": "2f3efa5e718990917156df71bb049ca7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050592, "uuid": "1bc01fec-11ce-422a-9ebe-3634615550a5", "comment": "Malware payload", "value": "4fd58e9815354ef73a21808d316c0929128bc30f704d525cd5f7d9a1c33a745f", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050592, "uuid": "027b2659-7fdd-4f1f-9838-5eda8624694f", "comment": "Malware payload", "value": "f44051477a3229e1bdf6a46ade5253c55c465ed1", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050592, "uuid": "e2a36ef7-1aa7-4c02-b6b2-bb8a35670eeb", "comment": "Malware payload", "value": "3183ab7858a7a2b4823bc890a72fc41cb79e0e408db359bb91d84fa55a4764350fcd2b915b7db7ef753ec949e351df91", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050592, "uuid": "cffd3047-220e-4e00-b634-e69b740593ed", "value": "T159D68D58BC1D7462DAC9B5346F7653943338BC449F92C3262614BBBCAEF2348CB67261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050592, "uuid": "5b4e7e13-8a86-4870-b03f-e6fb8b429b46", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050592, "uuid": "fb2e7952-bd68-4a7b-b2d3-13d7ba66e3b8", "value": "98304:I91KT9pYoUWgexwSO8pdwiZRtuzO5dVeGY3oJe4PCqaGnPuyt0f4iZCBE:ILKT9p5GemC3RtBBriZCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050592, "uuid": "9d63fd32-fca6-4856-a9a2-e0f4ac6bd83f", "value": 12653568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050592, "uuid": "0f24d63a-97e0-4e97-a5e1-f963bbfb0da9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050592, "uuid": "51471444-6c31-4e91-98dd-e7b35c725eef", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0a188b-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046728, "uuid": "ebd44ecf-b959-4a4c-a3c2-03cd49ceff18", "comment": "Malware payload", "value": "b2ca53763825cd0a1db7db46cf107ae1", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046728, "uuid": "4ab83616-67c9-4328-8f93-977af0a5ef3d", "comment": "Malware payload", "value": "50a2fc1f55fdc0f5799a49126f2e47ba9c00d2a92f47a608e4bea1c7070ae5d1", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046728, "uuid": "7cc059b8-f94e-40f1-9ee7-a24b1794dab1", "comment": "Malware payload", "value": "bc5243037150c5903c9afb2d7d64c9604cd40c41", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046728, "uuid": "5f7f7121-ddcf-442e-a5f4-882f809339f4", "comment": "Malware payload", "value": "237c69b74252d33df7c67df214064dd56a9409fab7b903c883a2f996b141b03db53d1e41134e56e8dab321a883a83e5f", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046728, "uuid": "c928e715-ff9f-4b77-837d-0e85349860d7", "value": "T15155125963F88A91F6AF1FB9A02442298BB77647F9ADFB8D5C8C74DC2483740D841327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046728, "uuid": "cfc07919-9e08-489f-85c8-d5e01c584b49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046728, "uuid": "5d22b9ab-b106-43d0-8ba7-3fdd5b68163f", "value": "24576:TdLIGEDwgrRvNuXoVIa09WmPstYX3wrZviCZkong/iN9WC:ezRvNE9WmPDXArZaCZFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046728, "uuid": "0b12ed3a-11c7-4219-978c-6e825dc7ce3c", "value": 1320960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046728, "uuid": "d4a124e9-59a6-4c40-88df-7c2453280dca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046728, "uuid": "5b842739-5d4c-4aba-a150-0802cb47f690", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a783c41-243c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773997813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997813, "uuid": "0a016e8b-a933-4acd-93b1-1c3f8eff656b", "comment": "Malware payload", "value": "466fc35d1c192d06ce3179b217dca91a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997813, "uuid": "72f3e212-a863-46bc-8fc8-9e5e329b31ed", "comment": "Malware payload", "value": "51c34b0d2b0a7627e2624db04903c550640f65bceaac14668eab8843dfe3b5cc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997813, "uuid": "8bdaf056-88d3-46bd-b232-31df5da64ff1", "comment": "Malware payload", "value": "ee9534a0e81552cdd62384edca3d0187c0696f1d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997813, "uuid": "7f5cc036-7740-4f1f-bfba-d7b28fc91f3f", "comment": "Malware payload", "value": "08c939e3155cf9768029d0cc739c71f36d4e3f731ff55e69deb7298ab7d45f38d41d81980b442214c5145b32b2a9b30e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997813, "uuid": "c446e8fd-768b-4076-b730-82326a68430f", "value": "T1C3924CB912496D74BBD1DE3D9F3C6F0CADE982C02128E3ACB94F39715A206ACD605359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997813, "uuid": "eca7de81-256d-4c77-a104-29eee4e41e46", "value": "384:82sYgbWowcL9dbwUINgzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:8bZ3Dbwh6zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773997813, "uuid": "a33b7596-d9df-40ca-9150-097fa86f6203", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773997813, "uuid": "9496d730-f0b6-4301-a526-d02ff5ce80a4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997813, "uuid": "7c2bc007-8a90-4ba5-a693-12f7337dd108", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de2347d-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989417, "uuid": "eab7c5da-804c-4452-ac00-15377cc2cc20", "comment": "Malware payload (SmartLoader)", "value": "f0cc3ae25517eb3e935b9621bb1eb34e", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989417, "uuid": "214516fe-71e0-48cc-8551-e363d3fbcb41", "comment": "Malware payload (SmartLoader)", "value": "53b752fb3afa94791fdd142204fb850e44179368ef480f79306c975b896b16b0", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989417, "uuid": "aa495520-f8fa-43ac-adfc-13f589958532", "comment": "Malware payload (SmartLoader)", "value": "08ad2add26d4ba7940081755d6de16021dfafbbe", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989417, "uuid": "a758eedd-8118-4f79-9735-2affbaafcd80", "comment": "Malware payload (SmartLoader)", "value": "f7e5044452c2393864a34adf92888abf4ed5175188cba871cff4a4b9bfd7a51bf896f8b23e5335020e90547b4c4bc55b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989417, "uuid": "6626d9b3-a479-43ce-823b-ef00a4c00877", "value": "T1BBB4231EF4D078CFD68ACDA394292C785F6C96C9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989417, "uuid": "e2c26a55-23f8-426c-9417-5b86b84e3886", "value": "12288:5TibgSMFBOBSlqrGKu7FxPbzJTVBU+8JM9hAC8Z39VOBRkbKQDiUbpKm:QcSMFYkKkxpTKJM9mCw39VOMWAPbpR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989417, "uuid": "639b3365-2f02-4484-8d22-bd3ddfc041be", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989417, "uuid": "3e3836ca-ad99-49da-a8a6-8ee7d46aafbf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989417, "uuid": "f7d0c2a9-e508-40d8-9dc4-f6fb9c5a44b9", "value": "mj-actionscript-madship.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31cdf930-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001073, "uuid": "73c8803d-d39a-46db-b0f6-70955983a4b5", "comment": "Malware payload (Mirai)", "value": "0891d12fa22b54f6dea59c0ed6993787", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001073, "uuid": "a5b131d2-40a8-4e82-887e-4c38f10fbfc2", "comment": "Malware payload (Mirai)", "value": "53e1a20d847c1f9a445385258ff5c192d866702a37a3e2c1cb6fa76ad874b9f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001073, "uuid": "7eea7d36-09a8-4cb4-a867-84fc9e49b3cc", "comment": "Malware payload (Mirai)", "value": "199a7d51a41b5b27317682e541e057dfc54b8579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001073, "uuid": "0fa71e66-a172-4454-ba38-0c9ca9f5f595", "comment": "Malware payload (Mirai)", "value": "d54889cc3ad0d220f482107e76b6dd65c81dd288520f7cf632217ce5544052fa242754db38690ae5e060ad7d319df88b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001073, "uuid": "59838b35-c906-4abe-91aa-4195f7ac46d6", "value": "T1B6E31A56F8818B12D5D111BAFE1E124E37131B78E3DE7202AD246F747B8A97F0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001073, "uuid": "7dc005f3-4a6d-49a7-b4cc-1a6e81bcec7b", "value": "3072:vfKtnMwIMUYehT8XKkzG3j+aVLXM6WDgyjfIq:nKtbbu8XfzG3SadHyjfIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001073, "uuid": "d5d1691b-e7e6-49e8-b1b9-0d1492314f34", "value": 156636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001073, "uuid": "c944e21d-16ed-461e-97e9-4a87303a429e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001073, "uuid": "039bcdea-5046-4833-adc2-ba61cc003dc4", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1791ae53-249f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040113, "uuid": "fa0bad2d-42de-4b59-b589-e67eb36c0e88", "comment": "Malware payload", "value": "3a4bb1a3e1122f7d7d3cd2d96aa50698", "object_relation": "md5", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040113, "uuid": "391b5ce6-73f8-4000-b4d0-f7905c75c41e", "comment": "Malware payload", "value": "54c6c97c13496805d91230ab37f447f0eb7b40b212e65a13b753c55fd9f2200a", "object_relation": "sha256", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040113, "uuid": "73ef7206-df03-43a5-b6b7-79eef885c9ab", "comment": "Malware payload", "value": "d031bd594453a4a6032f5d6e79194d8b70158844", "object_relation": "sha1", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040113, "uuid": "7b1dc9b7-3e67-4eb0-9124-e78a015eacc2", "comment": "Malware payload", "value": "44cd018a01338bd7728ddb9bb2437ffcace8c813999f39649a5b7ae39c2b525270f8dd2ff8fb423cce88ced00c4ea624", "object_relation": "sha3-384", "Tag": [ { "name": "APT28", "colour": "#854B0E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040113, "uuid": "22845dc9-6384-472d-9a05-628e80b404d6", "value": "T1E311C00416D81F69C7B50E34641F2313DA33AD0FEE81EF56024151C65D45701AE79EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040113, "uuid": "52d6c651-d11e-4c1c-9373-81e6b5e84937", "value": "24:8t6pk2s3xJK+k2HK1EckiJ/O+IzEw5hVqQytdon:8t6bs3xJbklSiJ/Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040113, "uuid": "ecf75a50-a5a5-4e0c-bb18-163752724796", "value": 1066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040113, "uuid": "c36875a2-5906-46ef-a547-a17cab0f37d6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040113, "uuid": "40ba8019-0e14-451a-9880-e92fb5dc5f49", "value": "WindowsUpdateDiagnostic.xml.LNK", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fb713d3-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989097, "uuid": "75e17c7f-c30b-4dc2-976a-836d72b3fb2f", "comment": "Malware payload (SmartLoader)", "value": "c962ca5c068a6030ca6006ef29efa454", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989097, "uuid": "d1909953-20e7-462d-a0bd-94401b30b793", "comment": "Malware payload (SmartLoader)", "value": "556423dff6289dff19b6fee345e4efa67e041a909cbd0422d18798734f2ef7f5", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989097, "uuid": "44739d49-9ec8-4706-b55d-505ea925374c", "comment": "Malware payload (SmartLoader)", "value": "fd85ca48b25b421821342f6c8994990ef01524a7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989097, "uuid": "a9fee640-f2b4-454f-9102-eface5787178", "comment": "Malware payload (SmartLoader)", "value": "8b243bd24ec9a7273c9ffcf86796b9e5619984e04f332adda2906361f547a1b9ca046e55195a958a4e62900cd507cb7e", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989097, "uuid": "c6e0d2ea-25e6-4504-a1f2-0bf6b613a562", "value": "T10AC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989097, "uuid": "581e64ec-b35e-4e4e-b456-142e5fbe1b53", "value": "12288:b+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byXH9I1P0QKw6FEz:b+QqldA/TSO713u7xnXH9IaQKHS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989097, "uuid": "137b60e4-c42d-4036-81ef-b846222c4486", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989097, "uuid": "1932ffa6-e2ba-4c48-a539-bc4bf716a32a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989097, "uuid": "a9941723-0cf6-43a2-ba80-fb775f1e0195", "value": "Software-v2.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f4b4f3-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001107, "uuid": "eee9b2a1-20e3-4662-bef4-316854eabcdb", "comment": "Malware payload (Mirai)", "value": "84c1b7526efed37ec3b720ea9cccaf9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001107, "uuid": "f42884c2-8b35-45ac-b0ff-b8efe469aa29", "comment": "Malware payload (Mirai)", "value": "557d4bec11c771eef7209d911c2d468a14f89227409eeec5747185545a0db6f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001107, "uuid": "08c84b87-63f0-4f23-a7c8-d239fe8c87ff", "comment": "Malware payload (Mirai)", "value": "5ad22b9e8da9baa6b2ca008acad44576ee008225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001107, "uuid": "88c88ba9-e3cd-4fdc-99dd-44208b01cba3", "comment": "Malware payload (Mirai)", "value": "7422565131f587241f71456797b199df33638f7e2350bf2a0307b7b207588f46a9bb98db3f11982abb59cb58d5d40a3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001107, "uuid": "77e3b9e6-e998-4bf9-9120-2a09588132e6", "value": "T1AB045CA3A703DE9FF5AB47710AE74D3466E129F226B68192E235BF411B311C01D19FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001107, "uuid": "48e4778b-493f-4ecb-922a-46886200fbcb", "value": "1536:mNA7dksRK75rmVqmonkXNcqq3L6EgYKAphMAR/D1optLzi2UkJuBWuA38EiagPTa:K75rmCkX4wSuW2UjVs4ryehMRZgDpBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001107, "uuid": "a1792910-5a29-4690-8779-6d1791345290", "value": 174999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001107, "uuid": "66bb13aa-a4c3-40b4-a061-2733eba1a174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001107, "uuid": "b9549e90-6633-44a2-a32d-a1745379b4a4", "value": "q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e04dac6-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040715, "uuid": "410c47f2-c3ab-419c-a1cd-d62d63e76657", "comment": "Malware payload", "value": "f25aa1ceeb5ee85564917960a9fa878e", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040715, "uuid": "b5438047-2e80-4594-b612-a8c8030b4b90", "comment": "Malware payload", "value": "55f51e0058f167a54588674e79d8b6717d12963e56ef9c4a04114f29714ad101", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040715, "uuid": "df0d2d1e-7821-4c81-aefc-fe9750d86a31", "comment": "Malware payload", "value": "376aa0ec3170edb0a6c81df8073262537de9ad80", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040715, "uuid": "7543f133-6caf-4a64-ac60-acede849159e", "comment": "Malware payload", "value": "8012beb5961773e41378411c895a13638d627b168ecdd7cafef1e2682febca884486669081732adb5b64eb6be07d2476", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040715, "uuid": "98f8baec-964d-4b72-b6fd-0fec3b56a6c2", "value": "T10106BF89BDAD3950DA852A7A5FFA06C1172DFE4F3F5287173A14B3AF11F22094E91234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040715, "uuid": "3297038f-7190-4cfa-999e-ccaa0b71c411", "value": "24576:SZhuBvlNAwmQ9pQBzBsjXn1WvxdyCy91h+TlziPb0+y3E2nJsVztxY2FN8NCETt9:SZhu5BblDrPb0hneVpx3T89TH8ImKiZs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040715, "uuid": "9a0496e1-adca-4169-8b19-7ae5d06d14c3", "value": 3989257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040715, "uuid": "031b1817-4fe0-4c45-8d14-fae79fc75f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040715, "uuid": "70067b15-d816-41bc-89af-ecead2e3745a", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9a46e9-24a8-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774044073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044073, "uuid": "f4dd4322-9c2a-426e-8863-7df0f35e63dc", "comment": "Malware payload (ValleyRAT)", "value": "513a21a7417a4be551ed62de55530a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044073, "uuid": "37cf6a9a-0727-43dc-8edb-61200ac68270", "comment": "Malware payload (ValleyRAT)", "value": "5666ea13363e66098c490f88821dd251b2082ef2fa4d9de797a5701a3584969b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044073, "uuid": "1eb35002-e59f-49cc-9074-2e1008e47e4d", "comment": "Malware payload (ValleyRAT)", "value": "6bf162d13d08fb9ae9a7f227a452361448071cf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044073, "uuid": "50a611b1-28d2-430d-b167-5ec864d37045", "comment": "Malware payload (ValleyRAT)", "value": "b35c8fdb7f81827ee41335111a1e5b4a8ccd62915d821940e583a74f1998368719ae9b842ac9552030e56f0b1d2d26a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044073, "uuid": "3d39100f-62bc-4e5a-ae94-3eee1fc2b8df", "value": "T1131833831C9013B2D3D12073428E54D8F97F772ED0996EF96FB3864B1AA65402F9963E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044073, "uuid": "81bc50cb-5965-46ee-9864-0a15c31b6a9f", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044073, "uuid": "f0577633-0cc1-482c-9340-6492f8ff7bb1", "value": "1572864:A9Hd/Gm2U0ZvId1M59w0LasAJtIivToE8GPLk6Fyef4LNbhAlitdV2Yc:kd/Gm2U0Zvg0RLasAUPh6F5faFd7V2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774044073, "uuid": "d5980a93-7dce-4973-b0b3-0c724f7c9ce6", "value": 89627096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774044073, "uuid": "5c16b566-e437-48cd-adbf-e53e1d5389d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044073, "uuid": "471b32bc-ca5c-4908-9d7b-b7edf303b71b", "value": "3.20ToDesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34bf768-2472-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774021020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021020, "uuid": "160a992e-aa13-4044-8d14-14c41fed144e", "comment": "Malware payload (Mirai)", "value": "b42227083a2350269f88c9a0692764df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021020, "uuid": "e39a01d1-daf0-47fe-908c-42480478def6", "comment": "Malware payload (Mirai)", "value": "56efd0e0002f5bee69b76a79016d64b94dab2e18e2f00a9d90df287941cabab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021020, "uuid": "9d3c6de6-faa9-44a5-84b2-4a2586e7cc29", "comment": "Malware payload (Mirai)", "value": "ba07cc045e7674a235c266f0a1bebe88a069de06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021020, "uuid": "ed52ba62-7bc2-437e-8fc4-83e4a2eba034", "comment": "Malware payload (Mirai)", "value": "5c20ed5657b23e994547eed93cb81889f44608c4f9574d477fcff2882868a797221261e4eb621cc9747910054574bd2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021020, "uuid": "a4c4be36-d0b8-4c69-84f6-da3e0016ca31", "value": "T11AA36B73E8262F58C554D0B5B0618FB81F9385A1824B5FBE69B3C2749083D8DF649BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021020, "uuid": "90d85e74-ade6-42fd-9cdc-d25855c97655", "value": "1536:/1z7j+hmSW2yPbUzDHQs7CDKgCLh7Q/qpxZJOWkrGtBUVM9Q2UhfN:/1z9SWJUfws77gn/q/OWcGtaJNN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774021020, "uuid": "96339e53-b7a7-42ea-bd52-7e86303b1dcf", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774021020, "uuid": "8dc17ce2-fca2-46f3-b771-19303f91cee7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021020, "uuid": "e93a17c4-2af2-4799-a034-aa2e905e8c65", "value": "r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8c147f-2477-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774022915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022915, "uuid": "1a570a7b-1600-4b2d-ab9c-1c1e59cdc56b", "comment": "Malware payload (LummaStealer)", "value": "0b923eedaf438ed4de405c4df7a29de9", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022915, "uuid": "8a36f3ec-5252-4459-9d4d-cec05f6e98d5", "comment": "Malware payload (LummaStealer)", "value": "578b8982422bdc9eafccf8477c8d1f18be7a2bfd0e9d007236544eda444cdb13", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022915, "uuid": "3a8b0439-56c3-4c18-ba2b-80ca46ad725e", "comment": "Malware payload (LummaStealer)", "value": "0cccda35061d71f9a0e5f725d53cd54967a73743", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022915, "uuid": "5692d7ee-d0a9-494c-abe5-9a5e8c072127", "comment": "Malware payload (LummaStealer)", "value": "1c30cadd298af50e292f53a506b080883be0ac9cd8e169a4ef616282243c22738634cf6ac31c33119102cf87dfe503db", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022915, "uuid": "9c311889-2109-4090-b685-351ff47fd8a1", "value": "T19CC5124AA2D01539D1B543FAB9FF133B0662BDA167125E4F12687C273F73A851E36B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022915, "uuid": "f56ad17f-10ea-4f7e-8b68-10da74d6c6d3", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022915, "uuid": "f19a37cd-086a-48ca-9369-3b3b759f6d6e", "value": "49152:hYz2geFELCzVZ1Ppse8gHZ+sRAdyn3fHTbM1X4ZE:uzyELCRRTZ5tRCyfXMxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774022915, "uuid": "375526fd-2521-4ebb-a58d-f2d6b1f9ca05", "value": 2741758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774022915, "uuid": "d796d23b-b3c1-45f1-8693-6eebbe74efbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022915, "uuid": "7e9d1726-7cc0-41f3-9d11-5f7da26601a8", "value": "setup_installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd1f886-24a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774042510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042510, "uuid": "3d85d08c-caa8-4804-bf6f-6869e815a9d9", "comment": "Malware payload", "value": "4ece4e261f0656e4d63823c725d3b70c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042510, "uuid": "19960529-afbb-4a2b-8faa-97b4462302b7", "comment": "Malware payload", "value": "589c878e757653ca547ff2bcb3a156351f716801d29bb771d34f13b73f3fd2d9", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042510, "uuid": "489649b0-135d-4994-ba08-efc79764859b", "comment": "Malware payload", "value": "e015dab1466d26803935a6af34fbf0fe2728b89e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042510, "uuid": "5206f9be-616b-42ac-b8f8-f6d4da09fb46", "comment": "Malware payload", "value": "a70c4782e367a93cfb9fe0473af7e7e60a6696b0e4a5ed7e704851fe84bef83356875373d4ac78e9fe07e59b91751cb7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042510, "uuid": "e6ba9e2e-71b9-478b-a3a6-5395961f2b75", "value": "T1E7C59C217585C132D56F03702A2DCBAA46797E603B7384DB73EC9A2E1FB19C15232B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042510, "uuid": "fb89cb1e-6233-44e4-bda3-4230be115a1a", "value": "49152:n8DY5qYaZrf5jSTUialWMV3eVougT5AzJrMf+7UVZDEFeKk44vLNgmUESIEjPMN0:2YWjSTB5MV39TAlq+T4veHjPMNa5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042510, "uuid": "adb3ffa9-bd46-4028-8715-4674a2e2aabb", "value": 2577408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042510, "uuid": "a2b23b6e-893e-48d3-814e-2a88de6d06f9", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042510, "uuid": "f56d6bd9-0dc4-4fea-8fad-78908c698ee8", "value": "importer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4c707c2-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040860, "uuid": "cd9b0147-82af-4bc0-a449-801c2178e32d", "comment": "Malware payload", "value": "d696c6ffce217b9ce4bac259b5dab7e4", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040860, "uuid": "408cc8fa-9638-41bf-882f-7cceeec97387", "comment": "Malware payload", "value": "58e5dee20df855f517b1294fba8a68e271e76022fdcbfd759dce5d052127730a", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040860, "uuid": "03b2c562-bf8b-4371-a468-6d8957f1ea8e", "comment": "Malware payload", "value": "e8135c6a28aeb4638df30628eb0d4b4be7c063ea", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040860, "uuid": "5b4d3f50-f18a-42c9-ad4a-77160a5afd97", "comment": "Malware payload", "value": "e189dc75b93aba9f9c8df36e326ea9fd5150dac4e7f09605cf198c3674ad842c2b8f9a439daa5007d8b5f6c140286e90", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040860, "uuid": "9e14e266-56aa-4a83-b656-bbc5419a6f6a", "value": "T16CB6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040860, "uuid": "611e800c-5d0a-4f8c-8047-08b8d475a5c0", "value": "196608:evyxUb/VBFUcwti7TQlyVN8iNISRTRmW5Qo:fcXHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040860, "uuid": "ca8dd6c5-146d-43a4-b49c-c898cb0dde64", "value": 11108864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040860, "uuid": "d94e21d4-68fa-4e59-ba6a-e2b781148e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040860, "uuid": "684ba245-8366-4316-800d-bff7b20efd37", "value": "winPEASx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a1fcfe-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040669, "uuid": "515af1a5-29c6-41b3-a804-32aa702f6fd5", "comment": "Malware payload", "value": "4b0b301eae3b2f8557406c710db33d7a", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040669, "uuid": "d591c762-518e-4a7b-a18d-80423b3b2573", "comment": "Malware payload", "value": "59d2899a00e51d8f410c5ff2f573fe1d21b9b6c71c010f53aac1a73e64ad0480", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040669, "uuid": "5e8fa7ed-949b-4b2f-85dd-b7211211d701", "comment": "Malware payload", "value": "a7646264bd7a02dd89415880eeda3ceb66cd313b", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040669, "uuid": "128c74a8-ed0c-43cf-8735-cd1722c712f2", "comment": "Malware payload", "value": "003a45b116f319a3c1b5e58de643f8a129f889a7a46f26d97fc3f6586d9187a8c2f4152bd5896df3e6dc4364f92a0e6d", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040669, "uuid": "7074b379-8a78-4241-a853-b3192cc6471e", "value": "T1B925EA5C640CEFB25025C97C1C950F7E19A3AF1F2665182870ECB61C7FDCCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040669, "uuid": "1448f919-b928-4f2f-91b0-1797996af394", "value": "6144:hYcosUjgUFgULgUVgU7ZUIgUggUp1U5gUl1UtgU1gUJgUxiU7gUn1UECs6BHp8Ix:jbmihTi2Fw3n+LTtRYDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040669, "uuid": "b84dc5ea-9aa6-496c-8760-ad82d154aad5", "value": 1016911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040669, "uuid": "876895c1-3e42-4509-a714-6ad1805d6c4d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040669, "uuid": "692ff12d-8759-4499-8f7a-f6d6caaa514d", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba98d98-249f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040335, "uuid": "f78be206-ed16-4c93-b8ec-1c3b1b714022", "comment": "Malware payload", "value": "9030bad5a7ef4cc6e060aff2c4f181a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040335, "uuid": "a4b296c5-731e-4644-bef0-ea30a1e0efd7", "comment": "Malware payload", "value": "5ab7b4677f8c02d57436dc1710e269c547ae54e8e753c6d5fbdfc07804602b8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040335, "uuid": "93839c09-231d-4afd-8e81-1db1ec075c35", "comment": "Malware payload", "value": "f8e64178e102ce90871468a68646c8503dab66e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040335, "uuid": "7c2c6270-8959-44a7-9797-dc836fec8f5c", "comment": "Malware payload", "value": "e4f99a0e730e38137896bede8977831825743e3170f6b5feaa80b5eccc75ce90e6cc6d3936871aa698f45e2f6ff95428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040335, "uuid": "5984073e-a41f-463f-84a9-98517ca4c524", "value": "T120F2288FBB9288DCC9A5C838C5FBA732ADB0FC4915A0A73D0B68D9225F50F60523D745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040335, "uuid": "801f877b-3737-4070-8748-e2494c06973c", "value": "c4862b91e4ea82ca468e51df69025de0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040335, "uuid": "911ba93d-301a-4fa0-8597-01a184eb1c5a", "value": "384:ZLPCbesL9hD2p3LHokFPWaaB6Lqh2xmVcESTr+chVZZNGJ3bz2sWUIS2q1i4J47:ZjCLDw3LYJhKSi/BZZNGdbz2sWPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040335, "uuid": "094e718f-eecf-43e8-851b-da26347bd38e", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040335, "uuid": "fdd5d015-3fbc-4976-a7aa-8dc74b1256e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040335, "uuid": "a6b6312f-7239-44af-b1d1-f6dc650e807c", "value": "RAE.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af79c03-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050561, "uuid": "7920c023-af15-4589-b97d-4545d1d75f29", "comment": "Malware payload", "value": "3f82dc81e02a65c341789d75d27ef0d7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050561, "uuid": "80c0d9ea-f2af-453f-bef1-a1bd8c0d4b8a", "comment": "Malware payload", "value": "5ae3c460f15b09721dcee74c8b4e0cfff6fbdc51830bf498fa4a09421e5d655a", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050561, "uuid": "881b9e27-993c-4957-9a02-01bf4a28db92", "comment": "Malware payload", "value": "b661a98ba50dd4b7fd9bf3a3da5d2caa7de51d1d", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050561, "uuid": "6934b583-5a54-496e-b141-b6bff16df13e", "comment": "Malware payload", "value": "f3b8fa4414ea7fa1ac649c0ec75dc0513902771b6119201e66a313096b0c2831bde4bf59a27a1756164d30e734d009c0", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050561, "uuid": "db5e6137-b7cf-46f8-a4d9-d83e9f1349ea", "value": "T136D67C55BC1D7462EAC975742B2253547338BC059F81C7266A18FF7CEEF23988B232A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050561, "uuid": "10caf38e-3542-4017-bd34-1addc2066798", "value": "98304:AMGy2AO+GW0ovFw5Om1692QfFiNU4uigYCsEUSMtwn0kxukUhoI0w9lh49lEiL8k:Ahy2AOzW0Evm1YpINU4ddSwJ49WiS+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050561, "uuid": "21d2ec0a-1f23-4266-b593-92a6f83386f2", "value": 12724386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050561, "uuid": "23b51949-25a6-422f-9aca-dbc957f4b308", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050561, "uuid": "f0779788-6304-4bf8-b44d-5bf2cef06ccb", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30f8a268-24a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041445, "uuid": "60495d35-3b01-4a71-861f-592d5f1a0387", "comment": "Malware payload", "value": "2658aa94079d52368dccf0c17ed26d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041445, "uuid": "17cc37b2-0293-42fa-ba18-f794d3431220", "comment": "Malware payload", "value": "5b70a2722060b5ca6e91c699acfe09404303ef84411a2abba4bab5b017d86ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041445, "uuid": "ff23af16-5e1d-4149-a4e3-e801d2dc89a7", "comment": "Malware payload", "value": "bf6a4ae8f2af017a6b87805285541f547def2c1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041445, "uuid": "596e7aac-2905-4282-9f9d-21a653894a48", "comment": "Malware payload", "value": "a198480f2a8fc02084c72845d35aeb96448e18c1b133cfc40394548b3efe64db90025e12b2160cb0eb1bc02e632c4e94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041445, "uuid": "7cceff1c-f700-47bf-8b57-36af88a0870e", "value": "T16FB30845FC919B1746D522BBFB5E428C3B2A1768E2EF3203DD256F20378A95B0D7B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041445, "uuid": "9409e051-8173-414f-b66c-25de3497a8ed", "value": "1536:vh3XRomWbR7hcOydxKAMvus4VFIzNTsAhaJsm8VephwMdnlsOwywJsDvitcCoTIn:Z3+bphFWxKDh4EzNQAhaO8ft28tC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041445, "uuid": "9bcfd4cc-10b4-44ef-b44c-2eb94400ed66", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041445, "uuid": "6f69f977-fc7a-4473-ba9e-6a55e7f39342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041445, "uuid": "f37100cb-ba22-46f0-9cbf-1fce5eac0c29", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a7a6e8-2424-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773987334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987334, "uuid": "8feba3c2-d127-4029-a140-3ecdc9e24148", "comment": "Malware payload", "value": "a9a61125d1dbf3d36109f868ad1adc97", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987334, "uuid": "1be6de7b-a1b9-44a9-926c-4f163850e61f", "comment": "Malware payload", "value": "5babbc707ebf159367c68c2e6a5e5326f78d17b43d8ba04f8372b5049492db1b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987334, "uuid": "29563578-effc-4055-8058-5ecad5eb5ef7", "comment": "Malware payload", "value": "969220d78ce6355d4b354dc0be885a05f86e5b22", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987334, "uuid": "06549d98-6acf-45e0-a20b-b7f3163f3278", "comment": "Malware payload", "value": "6a5ed6c60344c90197c588d5e487fa994eda1b8dedff020ae1e0c7f9bde30e031ff260a34383dafa2abf4e29ff12ee24", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987334, "uuid": "99fcb77c-cacf-4083-bb2a-7f3906d02001", "value": "T1EA263A03F89191B5C0AED130C666D293BA717C881B3023D76B50FBB92B76BD4AE79354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987334, "uuid": "a34f1623-c05a-4a63-a5d5-ff508cd26071", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987334, "uuid": "34880482-361a-4f71-9156-efaa5854e3dc", "value": "49152:2nwR3yvjrb/TcvO90dL3BmAFd4A64nsfJf06+EBCz4VcpVufrfjcF4DnMgpJIrue:ziMIPYkrcGqrEft6g/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987334, "uuid": "6425837c-3dd7-4f0a-9ec4-354bcaefd420", "value": 4682240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987334, "uuid": "57616e8e-9f51-4223-a3b7-089c9ad446c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987334, "uuid": "1b811c18-662a-44a8-9336-fece98fe875a", "value": "bot.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42640e56-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047057, "uuid": "7019c083-38de-4c30-8f5e-2b59f87a5165", "comment": "Malware payload", "value": "aedc1e5e1bf8a58a77b7ebaedbd8618f", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047057, "uuid": "c97efdcd-0de8-4c11-a43e-2e5317ebafc2", "comment": "Malware payload", "value": "5c36aebf8007e718a916a0edb464ad1c6cb2e64ccb755b276acda2c19f5a7801", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047057, "uuid": "b10b9f39-342e-4785-8f0e-866648e95bb7", "comment": "Malware payload", "value": "ecea30c5abb6cbf60b2f23d4d39537accd777d13", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047057, "uuid": "b44e6b3e-0506-413a-b3cb-76761b2d548e", "comment": "Malware payload", "value": "d879eea5a3c2b0db7fa2f8035ca8ae379958f126a023b6a6c38b64d9078fc0f69b44818314a23e51bc709f6ed0b05d6f", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047057, "uuid": "3682e7b1-ad8c-4809-a90f-eed981d8809b", "value": "T12B75132953F89B95D6BF1F7D902052584BBABA0AFDAEEF5D684CB0ED1893700D510323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047057, "uuid": "1b00d8ea-69e1-4132-bcab-34f0fbc12186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047057, "uuid": "e5f43315-1909-4ca9-bce8-10163e6eabb2", "value": "24576:rWLIGEDwgrRvNuXoVIa0xdBSWmPstYX3keNuMkWckoZ1g/28DDghy1pBN94T4vyU:r5zRvNExdBSWmPDXUeNuM7cX1K2yDghl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047057, "uuid": "d262e89a-d744-4526-9fd7-8b00fa41b0a5", "value": 1557504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047057, "uuid": "0f8c9f2f-68ee-449f-946a-9f61ccd4f0f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047057, "uuid": "105011b2-d6c0-4945-9d10-d82ab1b201ec", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546eb7cf-2433-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773993830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993830, "uuid": "2172365f-f8a0-41f2-a981-7cf0bbb9fd39", "comment": "Malware payload (ACRStealer)", "value": "07bf0f71eed01ddaa3fa4ad486748188", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993830, "uuid": "6cc6fcf0-c32a-48fc-ba1e-3c4752e15be3", "comment": "Malware payload (ACRStealer)", "value": "5c81dcd6c3824436c1997ed858bf562e5d97584d14a88269f1553d211cdd9e15", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993830, "uuid": "6a6c412a-a051-4a7d-8bc1-dc9f78f8a282", "comment": "Malware payload (ACRStealer)", "value": "03f98bc79d7c5791dee13b8d6fc3e31e0a7a9dfb", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993830, "uuid": "5ab4d6e4-c2d8-48ab-8506-2ebee60e2925", "comment": "Malware payload (ACRStealer)", "value": "277a8002186f0636b1e2b19ebb2538a2c885f7dd0cce3dec1e12d26bf08fce5c8fa818357ccea838bf588ef63914f1ed", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993830, "uuid": "1d20e0b0-5a90-4dcb-93e9-f0b538c2473a", "value": "T1EDA69C51F6D1AC53D816C273C9DF93AE723462007B17CB87F68C3B64AB667C01E66A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993830, "uuid": "f86ba4c5-3e4e-4a6c-819e-c0f542b27f8b", "value": "5e92bfd51c257abe46ca2939646e3725", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993830, "uuid": "688e9547-a4f3-4d5f-9273-53711d66f60b", "value": "98304:yGWJbIv94wtGize2u1qOC0y8SO7ytPOy/dfGoAA37CFtK4D4:yGWJsnV2qOYhrhdfGoAmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993830, "uuid": "5675f9be-cd67-45d5-8e4b-cce953bdfebe", "value": 9787040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993830, "uuid": "41713bd5-8831-422b-abb6-fc957c2a8108", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993830, "uuid": "f8e57030-5788-4da5-88f0-52d5581daef9", "value": "Win_Driver_SSL_support_v43.22.209.44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6528562a-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773989563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989563, "uuid": "72f16998-399c-4a59-8846-c7d2247eecca", "comment": "Malware payload (QuasarRAT)", "value": "53f1a5c8b9d637f6fe992d6962c69cbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989563, "uuid": "58247f6d-a29e-4ac5-b430-129c41f36a25", "comment": "Malware payload (QuasarRAT)", "value": "5cdb08302598109d9acfa37730dd8bee5018dce9d62c8382e900c2b726806dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989563, "uuid": "7a084c26-4ea6-4c67-a339-945572352e9c", "comment": "Malware payload (QuasarRAT)", "value": "91680072ecb9c1efe0923c59d247f0763af38c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989563, "uuid": "082cce84-8b92-4cca-ae4a-56026d634089", "comment": "Malware payload (QuasarRAT)", "value": "96152c23654470bcef1020f3bc4d138d39f074d3850f1bafea2838ec14de1f56a64737a199dc14a20648e3da1a23b97a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989563, "uuid": "f1446038-1182-4544-8ddd-390dd2e63395", "value": "T10FE56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989563, "uuid": "b76ec2b1-d550-4f02-973b-418fd8878f23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989563, "uuid": "894feb94-9d49-41fd-a685-ec42b938f988", "value": "49152:nvze821/aQWl8P0lSk3aKA3Z+nVqRJ6HbR3LoGdCTHHB72eh2NT:nvS821/aQWl8P0lSk3DA3Z+nVqRJ6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989563, "uuid": "449e2e42-b119-4a8d-9983-5a9043d8aa76", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989563, "uuid": "92f25ad2-3a01-4f44-a0f0-ab7226dac687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989563, "uuid": "32cddcc4-6208-4331-a6e8-039d67aed3f9", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79c2d0b5-242f-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773992175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992175, "uuid": "e2e94138-72da-4464-b8a4-544218b58982", "comment": "Malware payload (PhantomStealer)", "value": "e0ac7ebb27727deb4e096ec2f6f33e3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992175, "uuid": "eedac5fb-d413-446a-a3b6-ea9a15d41966", "comment": "Malware payload (PhantomStealer)", "value": "5cea4bcf5320bb0589ae5e965b268c7f74149ae3c43e49ebc0b4bbbc84174435", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992175, "uuid": "87432bd1-cec6-4ccc-8cd4-0e1bee3bf998", "comment": "Malware payload (PhantomStealer)", "value": "c8fced442fbb6e0a30c5b6720ddb01c513cb52ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992175, "uuid": "b2e549a4-9a2a-4ade-92d7-bfee10010d3a", "comment": "Malware payload (PhantomStealer)", "value": "44e5c8cc078e827c36a248e31a1cbc20c5548faa50e2d73888f69bdb59d142dd4f517e72db41482ad786664cb3254d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992175, "uuid": "a019513f-7fcc-4c79-b727-0ff7cdad5c16", "value": "T13545225E66497207E800FC324D32976F81366E180AE5AD0D6D767BAE4C37BF76D2204E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992175, "uuid": "fd786d72-e942-4cc8-973a-e64f33163f0d", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992175, "uuid": "cea77ce0-c121-4d4c-9f1b-7fbc35fd45cc", "value": "24576:Pf+iN57Gtene3jJKzfYFGXwQ+qmhMb9hl3089:3LXKtene3jlFqwQ+ybR08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992175, "uuid": "d96f5c53-1710-4c04-87fb-65fd4d911a77", "value": 1249792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992175, "uuid": "8abac12c-b5dd-4b53-bb60-a4233c36f521", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992175, "uuid": "2495329f-8958-4f8b-b5f1-0c5654015906", "value": "DHL -OUSTANDING SOA FOR SIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d632149e-2476-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1774022824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022824, "uuid": "cbc42822-ee93-4d9a-9b13-ab4fc2d8577d", "comment": "Malware payload (LummaStealer)", "value": "588e8b5d3094281044199b16dc57d638", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022824, "uuid": "66199bcc-5e32-4a02-a765-5d2c8db4d123", "comment": "Malware payload (LummaStealer)", "value": "5dac597e13f6ddef6f0c50afe394bf6945e7105648e00bd1e845af96c90698db", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022824, "uuid": "fcd40b80-fae8-44e7-ac55-9472c80abb70", "comment": "Malware payload (LummaStealer)", "value": "15f086f9aa2ab102b51d12c17ac90b3b1462606e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774022824, "uuid": "cccb75a3-ef73-4c21-91e5-5802ea3f965b", "comment": "Malware payload (LummaStealer)", "value": "84d834dc90ec0ca090e4be1fbc407b797c1d10ca5fe190828bcdf761859a56eb49a2b3767e5ea9789d2f7073a659f6e3", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022824, "uuid": "69a77d6f-4731-40a7-8180-ab17477186f4", "value": "T1B1A522AD303221F8E7ED44F92B59171307D38775DE0E66295A3C28AD7E17A8A098DD0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022824, "uuid": "0587aa0f-8f84-4d5f-a17e-c289676cca71", "value": "49152:fY95uQ4tebK3dZ7JXG2SKVBsaPQtyZlTHV28ILBuZcc:mSebKjdXFfdP4yTzIlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774022824, "uuid": "15e98a33-9116-43a7-b296-87d74ea2d574", "value": 2099917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774022824, "uuid": "87674bd2-c370-4207-b59a-daa3b9b257c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774022824, "uuid": "8c69169c-68bc-4a23-9978-88025558877d", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b020d0c-245d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774011933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011933, "uuid": "c806a479-d6db-4081-9647-2c583cc863b0", "comment": "Malware payload", "value": "08cea46df64f5071a2661e18c259dc38", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011933, "uuid": "730a0356-39b2-4ec8-bc20-cccec4605e55", "comment": "Malware payload", "value": "5dbb46d0d8c0d5eaab40d620ce2636ab2a8da5575eef4ae80f91b4318f0e8e0d", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011933, "uuid": "0ee2b9cf-b826-4215-a3b6-b6b7966c38a1", "comment": "Malware payload", "value": "30501327448768af61fea2089824a4f2b220307b", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011933, "uuid": "4335dee6-2fe2-4e74-8c77-1ccefabd9635", "comment": "Malware payload", "value": "a46f663f4e455303cdba59e020f29940602530e0a802495fa4698eac1fcb96c4072bb9a46dfe2dbf340141e0b73914f8", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011933, "uuid": "0987bb23-1be6-4304-8015-d6d5c97e5d3a", "value": "T15AA02208E0000E0E8FCA232E02330282CEC00800C23000F03020C00C8FC8008C20000C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011933, "uuid": "dd0ef3d6-460c-417c-9dc8-85a88f1214d5", "value": "3:eGAjGJmFSJJFISFXZWIF1HOZG:ZuGJm88SFXZGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774011933, "uuid": "c3c7ed9a-552d-4e8c-a01f-b8df8060b730", "value": 65, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774011933, "uuid": "4576d796-1c09-45eb-845c-f7899ea20be4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011933, "uuid": "b4adabaa-e793-45b3-9514-aa430803053f", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d8ae09-240a-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773976221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976221, "uuid": "5212208b-1453-47e6-8dd5-1bd7a22d66ea", "comment": "Malware payload (CountLoader)", "value": "c781922357c22ddd3ad9914a33d40aa9", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976221, "uuid": "62769a0a-64fe-4482-bd1a-d32d51171ec9", "comment": "Malware payload (CountLoader)", "value": "5dd5f4daa6191c67cd19180fc8c930bbef74f36642f7a08ed9e954abee733bca", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976221, "uuid": "d67e99e5-d968-4ce9-b9c3-02aa91c8bddb", "comment": "Malware payload (CountLoader)", "value": "4c55e66245db528ce5aacbc6f26ac867f4c7eb76", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976221, "uuid": "d92bc9d8-5d78-4ca9-ae7b-98c784d23e3c", "comment": "Malware payload (CountLoader)", "value": "667c384d82d2c9469826511ad60c6263054df7b38f361564a0fb611534cb7aae3c21d70678e63f68d7b69a0de673891a", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976221, "uuid": "c4bd93cf-9312-40ac-8e74-02ea4eac3181", "value": "T140B302CA4A8A84729F5F7824850F4C479EEC9513061DC5A0BEEDAF843F02DB471B9DE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976221, "uuid": "19eeefad-aab7-4ca4-b8d1-6167975623bd", "value": "1536:9J3rpaF1PTd9AMIqEm6OAYOAPRArrCA61fv/F3pE586wv:9OApApAqAwH/xWdwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976221, "uuid": "74280071-7942-4a9d-8b7f-6c6aa8ea0b24", "value": 114824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976221, "uuid": "6c6d25ed-09b4-446f-a05f-cf2c18d67ba5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976221, "uuid": "e74b2eaa-9e08-4126-91b9-590190bbba37", "value": "Nova_Invoice_Canada_6649.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf67d907-24a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774042569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042569, "uuid": "a18442ec-e1c1-46d8-95ff-0372ede322a5", "comment": "Malware payload", "value": "f2ba55a1202806abd3d0ec6781221ae0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042569, "uuid": "899b5e7e-47a5-4cbb-a668-14ba919304e2", "comment": "Malware payload", "value": "5df0de498faf4f98e608e4ef86474e8b706551aaf386ff85e9ab7613d11f36b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042569, "uuid": "82879346-ff3c-458c-bf1a-c005001cf9e1", "comment": "Malware payload", "value": "159def61b5878ce1b5eceb2e8422be62a1901afa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042569, "uuid": "7235d4cb-9675-41de-932b-f9171d9f2cef", "comment": "Malware payload", "value": "1d3ac078ea4b72b6d3ff2999bcbc4ab0dfa56e40b0352576c53f02fb65b7b151330720511b50a9ad279928c46c62affc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042569, "uuid": "69951323-3935-44f8-811a-2b7450e1b7d5", "value": "T167A31945FC919B1786D122BBFB5E428C372A1768D2EF7203D9256F25378A85F0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042569, "uuid": "296e1dc8-73c2-4bee-b742-790f19aa23a6", "value": "1536:7d9J6Sf4tsuHSoxVKW4QFBRAjNj4V9Y0THOo0ZiCyCLbdcr84JD1lDDwyw2sYOXI:7dfWtsuHLbKW4sBRS4M0LOo0wcBcrNbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042569, "uuid": "581b38d4-eae4-430a-92e9-8b625da1f4c6", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042569, "uuid": "96c0408b-ea68-45ea-bea9-1655d8a672c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042569, "uuid": "018dfa83-db94-495e-af4a-1f8d994181ad", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67310f4a-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040676, "uuid": "29069de9-9331-4f38-8776-306ca2febc37", "comment": "Malware payload", "value": "c76548c0fd8aa920a4e71a2ae22acc3d", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040676, "uuid": "27732ffc-790d-4dd3-99c6-c896408e9f46", "comment": "Malware payload", "value": "5e7548aec911b788bec7ebf0557c93445b0c901b621e3cf2ecfb0da4b5a676a0", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040676, "uuid": "b8b30e5d-f547-4ce4-9bd2-c4d44d921dd6", "comment": "Malware payload", "value": "2c67116ef6552739dd2ca9368eab0ab6557522d8", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040676, "uuid": "8cb5ccc2-ca36-4329-96bb-1d45df9d8d8c", "comment": "Malware payload", "value": "ff83f06549779eeb634d7fe34926d643a871754c073b1cea93a0d77164bfc3c047382c800bb6b8a68ff4c32337d63feb", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040676, "uuid": "854924c4-0cb9-49a0-ae45-2aafd3702e59", "value": "T1BF069E17BCA02950C626523A49EA59C62B7CFE4B2F3217C73E50B3B91F726D658F8314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040676, "uuid": "4ff84c56-43bc-4730-b70e-2e6f91c202e9", "value": "49152:hgsuz4mvz/cjOlD9f9Anl8lw6nxB3cmzap4tE/4/Sfh:hgTp/Cm9A+FnxBi+XKfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040676, "uuid": "3059bf87-55bc-47b3-b9d0-c97c705b859d", "value": 3851776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040676, "uuid": "6c6eb54b-51ed-4a55-90d2-2be5cc0a699e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040676, "uuid": "07c60bc2-b223-4265-bc6f-1a2dd3bb02d8", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d54713e-2463-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774014487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774014487, "uuid": "09ed35c2-512c-4304-9fac-68cebde74fbb", "comment": "Malware payload", "value": "74177f3b736d2d879548927e919e058c", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774014487, "uuid": "702665c6-3154-4c9a-88ef-8667a56ea7ca", "comment": "Malware payload", "value": "5ef1ac71ab40e2ff87dbef0912a18d0c31901939af7b59bc24a5921e39a48293", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774014487, "uuid": "917eb581-4b04-4604-8a7b-42d9f256faab", "comment": "Malware payload", "value": "39c9bed1ee1d946c96d56cafbe9130652f95e331", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774014487, "uuid": "b4c69f6b-cf8c-4326-ba22-708b4931da75", "comment": "Malware payload", "value": "2aca915861b33856c0ca532ac52c183b8deca2af39caa1cd46e9447f6929cfc2f9f228cf59bcf7d922b37a21b24ebf03", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774014487, "uuid": "fb6fe57b-a492-4429-a094-fa42b6a229f0", "value": "T11DC733496EA83195F83AA97DE2E11620D6B4000F4B73FAE26A2D31912DC37C557E533F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774014487, "uuid": "a3591c6b-47bf-4c49-89f6-3e077e51ec3f", "value": "1572864:WYxSpDnxIFcFQt8OSQhWWJoygFw8dlmKLh6vfVM:WKSpLCcG5SQh9O5TjmKLUS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774014487, "uuid": "6476c3c2-1066-44c4-b3ee-9b0e432c644c", "value": 53214282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774014487, "uuid": "b1ea7b63-f44b-4d9d-bb04-0a0ff34db75c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774014487, "uuid": "7093b469-7368-4e71-8f01-4cda8b970063", "value": "document", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b032eb9a-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040799, "uuid": "8b984a73-7ac6-4083-8023-dc79a279aeb3", "comment": "Malware payload", "value": "fdf96618558419073c89643ad258c2ca", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040799, "uuid": "3aaf9d28-c2c7-4363-b4b2-78a9a0cc5ef6", "comment": "Malware payload", "value": "5feaa121ea76f9d5c440a822e17cdb627376c8e0d57877c2a470f4af1e0dfbdb", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040799, "uuid": "27c9cd9f-63ec-4a2c-836d-221599fd95f1", "comment": "Malware payload", "value": "e4f7ff0ed1c469bdc9cd8e0305763e5210235fd2", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040799, "uuid": "2b0f4a78-393d-4621-8418-3596da316589", "comment": "Malware payload", "value": "9732e711918eacfae92a5fd8d7ceba3fe2de9b5663034c4bb8ce30abfaa1fe238a6a84e87e9c1574d41e5bf4003acc2a", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040799, "uuid": "3f966645-da5d-4867-aa61-9b5d8867470e", "value": "T10C06AE9ABD683940D659663E5FEE47C11B3CFF4B3F1287173904B7AE1AF221A49D1220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040799, "uuid": "80963adc-5903-40b8-a427-fc82add0f5ae", "value": "98304:QzoycKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+zW:ot2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040799, "uuid": "58f351ca-e5c9-4643-9765-d7a7dbc8965d", "value": 3844482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040799, "uuid": "5e221e44-0bd1-4ae8-a7db-482f1a94a98f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040799, "uuid": "a549940e-0791-449a-bbc8-20ae585dda61", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ea808d-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040731, "uuid": "41400961-6f4f-4679-897f-d1b9113adc61", "comment": "Malware payload", "value": "e62b8567cf6926596200325266041022", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040731, "uuid": "c156273b-95cf-46dc-a3d3-350aa35530ad", "comment": "Malware payload", "value": "6031fcb6ab2e1e4f6b7aaec9ab5acda5805c0533a1d7d9e37280cda4b66c8288", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040731, "uuid": "3dfb5dc3-affa-464f-81cc-56ac134fdf9c", "comment": "Malware payload", "value": "6c4cd08ed2d8f299a2f037f7fa3ffcdfa3a41227", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040731, "uuid": "6afa9139-d9f0-4c69-b993-9c6f5d5ed4a0", "comment": "Malware payload", "value": "6cd8d77760e7eaba71673c211c4f3f31d29944045e1a330b3f802d1849e94d6b03f3be11cc6e5ecd2ecb97d3b2f0858d", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040731, "uuid": "af0704f1-d690-4caf-b69d-a6f629a402f3", "value": "T1DCB6D04062DD046DD6AF0E79906202324B35761A579A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040731, "uuid": "c1f7fc01-01ba-4a0d-a5d8-5f21f3edf474", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040731, "uuid": "26ccadf7-e807-40cd-b89c-e9b2eae779e9", "value": "98304:/oKcJJdhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Q7:APzdVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040731, "uuid": "96f8e8f2-9cd5-4604-ac93-1783869fa623", "value": 10959872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040731, "uuid": "bc49ed09-218f-4f5b-8ab4-ef7a57adf46b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040731, "uuid": "74644b99-39fe-422e-9785-3420cdab0460", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7535283-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050367, "uuid": "cfac894a-f4eb-4675-a588-ab61ce218372", "comment": "Malware payload", "value": "7dd241eb90062f22e6cf50ba999b6321", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050367, "uuid": "ac7632be-e3ee-437c-bc59-d10e9b35cb6b", "comment": "Malware payload", "value": "6115af67c7833e44bc70f7b9bb110c2108eddd70778db90f0feddc924c2aa505", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050367, "uuid": "ab7673dc-b5c7-4eb1-ada4-80928f79ed2d", "comment": "Malware payload", "value": "b16a550300429e8fdbe76e4e11b63a1d93657d7b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050367, "uuid": "b0223cf8-af3e-4e67-8af5-6be8253c9261", "comment": "Malware payload", "value": "47b56108f0c6b2a75a92baeb993051dcd509fe9b3aa485c0862282ec7e2a3b77968aeeda1168afd32cce99b93c71613a", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050367, "uuid": "29dd4fd0-0f04-4615-9a94-d567909398c0", "value": "T190C68E55B92D78A6E9C9B5347F7242943238BC059F81C3272618BF7DEAF23588F23251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050367, "uuid": "99b48d73-83fa-4770-94de-b8b195f953dd", "value": "98304:7GCOiVaq6aIO1h/lz7MTUGn50zyUVacI7umITA5DVtlWyq15tNpE7:7giVaq6LchtEUKxUVaGy5hq1PNq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050367, "uuid": "76a7f636-71f6-4f6e-97bb-be86b77ede40", "value": 12452024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050367, "uuid": "65b3eb37-aeb5-423c-bca1-e34799eb3f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050367, "uuid": "93e080b4-f0e6-4f36-8c08-eefe942b0442", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99ecce7c-2446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774002107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002107, "uuid": "533f9e5c-fa4d-4620-8895-f1d783ee5a32", "comment": "Malware payload", "value": "a23532a947a25fcf548b761d93646651", "object_relation": "md5", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002107, "uuid": "5ae19757-fa20-42f2-a855-4560b77053d5", "comment": "Malware payload", "value": "61162228dafc652dfbf1799edbb53e479e969bd97aba9d72e2113029cdb4f460", "object_relation": "sha256", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002107, "uuid": "f7c0d6b0-8002-4012-a237-75ccf991be7d", "comment": "Malware payload", "value": "484e7250f64e4338012b54ce57d9586c2365e252", "object_relation": "sha1", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002107, "uuid": "ca575dc9-753d-4cd9-ad78-254c890e3ff5", "comment": "Malware payload", "value": "84bb98152cf00fe8ea211d09b91bc563965ae6a5db74b78a52c415cae6b418e211e85e74e291a1d37f44b7983758310a", "object_relation": "sha3-384", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002107, "uuid": "023af7bd-cb89-45b5-aa3d-cb8fa97630c2", "value": "T1E49633FFE0CD1E22DC9FC231D2091D3278989BEDE70B626F64B04512599788A4FA578D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002107, "uuid": "eb5b6222-f074-40dd-9115-1009318082eb", "value": "196608:A/8Lmn2EhJzy0iEz3pA5UhRioIUdIV5qD718vdmxg+B4:oRhNpsypWKyOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002107, "uuid": "08f9d8ae-387a-4243-bb3e-c6b6252fe1d0", "value": 9166662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002107, "uuid": "a34c6a57-6d4d-4fbd-a77d-bee173a2d53a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002107, "uuid": "636229eb-52b4-4831-b8f5-cc5db30cae96", "value": "Radium Client.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d1f3e5-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040964, "uuid": "46608559-4ca2-4dea-bd9a-cfe691b4e80d", "comment": "Malware payload", "value": "1bba14d94d5ce71fd43af570977b3aa2", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040964, "uuid": "24d363d8-df0a-4d48-a942-07927b9a775b", "comment": "Malware payload", "value": "61865a9197396ba4056aec3a0ea4e739d3865987275f461f27c078c27c14e8c9", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040964, "uuid": "2c30ff0d-ee23-4b71-bb2d-76b990bf04b1", "comment": "Malware payload", "value": "e8c5431c75aa082c1125f34f14d0c3a2f1096d26", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040964, "uuid": "44a5193a-2ae8-41ed-bc8e-af6a6c222f34", "comment": "Malware payload", "value": "4b9f83ad1e0aa7e2bb86dc8566d6b333f1993b0ea7b4e406cbd24e79198e897f5ce4c5db1815dffb76527245fc2b0873", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040964, "uuid": "77eda3a8-7a0e-44e2-bc18-3b5d46dd6b19", "value": "T16BB6D14062DD046DD6AF0E79906102334A35761A179A8BC7FBCC81AC0F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040964, "uuid": "61adcea2-dc2e-4f13-b9b3-899394004957", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040964, "uuid": "ed182689-e8d3-4f9d-a23d-baf17c2b216a", "value": "98304:/wcEhhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Q0:IPhVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040964, "uuid": "fd1a387d-7ac3-41f7-ae82-e17b064e752e", "value": 10954752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040964, "uuid": "ce83bc00-4c84-4cec-be6f-1b8809534567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040964, "uuid": "50ed3ff1-039a-461b-8dcf-210c13ab6ca6", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b69eaf9-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1773989573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989573, "uuid": "3ae0b7f5-b684-4ac1-a915-afae3e15d61e", "comment": "Malware payload (DiscordRAT)", "value": "515698188265ae6d47ccf44f2030cf8a", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989573, "uuid": "bcae1bed-2099-4b98-8299-e787ba11456c", "comment": "Malware payload (DiscordRAT)", "value": "61a14ca5c1653edf7cad4ee0e1a0a4c93e2fb7dc3b244d3f7bf6dc2b82a6d0d1", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989573, "uuid": "485f3257-0b3a-4cb7-9c3c-97896bce2e77", "comment": "Malware payload (DiscordRAT)", "value": "7f99c349af2d99661a5ecdddd403059693984512", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989573, "uuid": "6836ca65-658f-4f4b-8885-4d6aeb1a4535", "comment": "Malware payload (DiscordRAT)", "value": "6b33fe4722b7ecbff3e1b630b2d7e76612689a722aa60ea3b3dc987375b8473363984a8ba6e258d34e53a32e822034d4", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989573, "uuid": "25357c46-2799-4d52-b919-2a6b324043f4", "value": "T1D473B8C877AD8903FBBF5EFD147141524B72BB17E935F68D088C54E611A2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989573, "uuid": "a8e8a7d4-1b1d-42b6-870c-e2945facb4de", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIC:5Zv5PDwbjNrmAE+mIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989573, "uuid": "4617087f-e8fc-462d-a172-003e1f282468", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989573, "uuid": "c45c8238-a8d8-48e1-a07c-6cb3b3cddd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989573, "uuid": "19610719-b1c1-41bc-bc0c-2835924fdf06", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8af46f-2472-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774021014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021014, "uuid": "c53f2176-02da-4eef-beb0-0fbbd741519d", "comment": "Malware payload (Mirai)", "value": "412fd356f09d718046cb94085759e160", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021014, "uuid": "bc8553a3-ef0f-443a-ae86-3bd6be04a285", "comment": "Malware payload (Mirai)", "value": "62590cf0a7da7f06cb3ed3bad11e90fdff9547eac6a15007bd9b16427867819d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021014, "uuid": "5eadad32-8f23-4b6f-b26a-e3fc0f69cac3", "comment": "Malware payload (Mirai)", "value": "e519700ad64a18857501cb9baa6578105e7611c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021014, "uuid": "f6fab97c-c48a-4fba-8724-ef52cb4aacc1", "comment": "Malware payload (Mirai)", "value": "ef6a15a6d21a4a82a304e20b9516c3b3f8535e9e023142a9c267107d17b780564412f6ec3c1334ba1b8524dc871779b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021014, "uuid": "86c31e6f-ff46-4790-ac9f-28cb3a09cdb7", "value": "T1F7B3EA56F8819B12D5D012BEFE1E128E37131B78E2DE72029D246F747B8A97F0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021014, "uuid": "e086c778-a7f4-4a77-8bb2-79c252a9da0e", "value": "3072:vfKtnMwIMUYehT8XKkzG3j+aVLXM6WDgyji:nKtbbu8XfzG3SadHyji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774021014, "uuid": "0b04152b-5dc8-41e4-9fa7-568b99fc4f86", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774021014, "uuid": "d3f80d1c-1a1e-40cc-9c55-bb8de2897e21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021014, "uuid": "e32f769a-cfef-476d-8c7c-782e9e072425", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb89c67-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046784, "uuid": "e1a58d29-9b85-45fb-b05a-13fbc8e5bef6", "comment": "Malware payload", "value": "4a4a2890bff231b19706dc29fc7e936b", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046784, "uuid": "b8d2ec02-b8fc-43e3-8b7f-5a7547c26cd7", "comment": "Malware payload", "value": "6267e0e3299f74c45e985b151777a4c89175fb3217c9c1673e27fa7f9464f34d", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046784, "uuid": "1d6f9e86-0720-48d1-a6d2-dcc4da03d3ac", "comment": "Malware payload", "value": "f6ced507e4cc5b61aed19b126d66d20eedd6621d", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046784, "uuid": "b2fdd162-ef74-450c-9bea-c6f8024173ee", "comment": "Malware payload", "value": "c2e0e5643557c9d095216155ec902d85142e119fcc23733bbc5e03d5fa335448964651d5e7b654586bebef814a140515", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046784, "uuid": "eb5c19fe-646a-4c24-8652-5443e20f24df", "value": "T1347533307FE62D290B744335A1EF9F1D86B2C997804DC9B7BAEE18871F63684481785E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046784, "uuid": "0c72f297-b306-49e8-b932-367002f92931", "value": "24576:wN9gZXeNIzjmpk7WySEpy5INgcjfzMFPOtwtAEKJA+8iY+2d7S369u7ZVWIADiFB:2+3mpDxgXvvJ32utwIAesASoLKHry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046784, "uuid": "6397446a-9872-4962-9980-03e628372484", "value": 1591977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046784, "uuid": "9282a4d4-dc79-42f6-ae85-c92c8c535a6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046784, "uuid": "1607cd4c-7f55-46df-b1f3-1e5cd19ea838", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed57134-240b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773976614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976614, "uuid": "9f0fe707-5f75-4b52-93ae-7c601d5d3fe0", "comment": "Malware payload (ValleyRAT)", "value": "751e6a5b45decb45ac656d1c98c86dcc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976614, "uuid": "e8d78dcc-524f-4e03-9c25-96a48ff68b72", "comment": "Malware payload (ValleyRAT)", "value": "62fc71ef3910327f477c715df96e70ada9455a1b3da3187cbd585ad9ef07a7f5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976614, "uuid": "39b1ff7c-6396-4086-b37b-9fbb94ac5f40", "comment": "Malware payload (ValleyRAT)", "value": "d4b3ea8a27aa7ceebec7762b806d0d4e5d4be9c0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976614, "uuid": "81236778-bca3-4e63-b98c-1afcf73cb5c9", "comment": "Malware payload (ValleyRAT)", "value": "0a310b38476b0eea8fecb65a6ad0f041ecfcd2a7981b861393ad31d3e72f5180e213d92fa1248a7bd3b86c90a3e804c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976614, "uuid": "6649d9c4-3a9c-4b9a-a286-ec7cd5ed90a7", "value": "T12EC47C56A6E148FCD867C278CE975252EBF6B8190360BAEB07D099661F27BF1433D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976614, "uuid": "01ead737-86d1-4233-9138-71f81630c38e", "value": "0917732f0e5310ae388f37234828aa79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976614, "uuid": "0b4305c3-8ca9-48fc-9bfa-497ec1a41ae8", "value": "6144:Ob13rKXL4Xk98XDiuZFcjR17W+LZQLL2VoLluHUnWWqvQGLcnV5UrlhnHUmd:yMMk6qR1FLZdoxu0HdXmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976614, "uuid": "6019ea41-c17a-4ed2-a85c-710232bd920b", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976614, "uuid": "24dc2a03-1aa5-4ce2-9648-786ef3c68555", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976614, "uuid": "1d15bdc6-23f7-4da6-bc37-4a00243f8cfa", "value": "62fc71ef3910327f477c715df96e70ada9455a1b3da31.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572dae1c-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989110, "uuid": "630b1b20-4c96-4c0a-a3a2-08de74524bdc", "comment": "Malware payload (SmartLoader)", "value": "3b8f1ca5a8c9c00e6bbe9853d2b29466", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989110, "uuid": "e630c8c9-8ed4-44d4-87a0-da168f6a1aac", "comment": "Malware payload (SmartLoader)", "value": "63a0b6a05d0e3eab785ac6c1c23da3b2665009932575fe15fd99688c1832309c", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989110, "uuid": "685f4f4f-7437-4a93-9357-602cb486b92c", "comment": "Malware payload (SmartLoader)", "value": "e9a895763b738a3dfebc825dfc66a4eceb3ad0b5", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989110, "uuid": "bfd48d60-2e97-47a6-8c70-29a0eb311585", "comment": "Malware payload (SmartLoader)", "value": "3d30451503dff20bd7dcd2f2235e01e59738ccd13e64d429b4b99e8978a84e14451e80d4f1cdbe1e2ad3c380e66b7086", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989110, "uuid": "4160cf97-12c0-4b9d-829d-0beac8481145", "value": "T16CC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989110, "uuid": "da14316b-98d9-4b36-883a-e88c2f6b6a9d", "value": "12288:j+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2by0H9I1P0QKw6FE+:j+QqldA/TSO713u7xn0H9IaQKH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989110, "uuid": "8687d551-aea1-4553-b5b5-c1054db20ade", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989110, "uuid": "d9dc0bb1-13fa-4dc4-8e79-af2257efbd3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989110, "uuid": "34402ff0-109e-4f79-ad5c-a55ae2bf57b8", "value": "Software_v3.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36ec3508-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001082, "uuid": "bf34f30d-977a-40f9-947b-e4fa6c54da77", "comment": "Malware payload (Mirai)", "value": "099f5d6f2c7ebb9e391bed3ad88fa487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001082, "uuid": "9215c0be-604a-438d-afbe-a8b96b3b56a4", "comment": "Malware payload (Mirai)", "value": "64095c7b4b55bea93dbe1b008e5d4a946ab991b2e01f7e7378be6fd94effe728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001082, "uuid": "5674a9af-4cc5-4d27-9698-04660c4d036f", "comment": "Malware payload (Mirai)", "value": "f65ce9fac98958de4bd3363e38afadcbd035eb77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001082, "uuid": "e69a9f9e-83a0-470e-ac9b-1c02d991b80e", "comment": "Malware payload (Mirai)", "value": "b4644ca497bd29193160fc190cdbb99e39001c25b398dec78455f3ddc2c13723c595370c6db845bb59e6d3e8aace4978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001082, "uuid": "aeced142-01f9-45bf-8ae5-b5193e0a75c2", "value": "T1C5E33A05B30C0947D1932EF43A3F6BE1D3AF9AD121E8F640295FAA8991B1E335585ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001082, "uuid": "088bc9b4-d884-4041-bac9-3a4def4a2945", "value": "1536:DLRN5A4rhT4HGwuB0EUEyxbuyeP1DIVUWnLyXebpijFd2CvA0xPi6UZuuHqQegmp:DLRk+J4lEyxbeDpzewjFo7KYL47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001082, "uuid": "f73d3c51-a11b-4d59-99f0-e61b95593195", "value": 146192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001082, "uuid": "d84bac5e-5cf7-43cc-9576-fba67252b5c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001082, "uuid": "17d0c228-0fe3-4140-b978-2dacaf33a451", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ccf076-2448-11f1-a769-42010a9c0008", "comment": "Malware payload (BumbleBee)", "timestamp": 1774002900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002900, "uuid": "a77e34f0-1a01-4c76-bd9a-264ced63f8a1", "comment": "Malware payload (BumbleBee)", "value": "04f0e89e8d568d05d4876faccaf078f7", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002900, "uuid": "d514d303-9fa8-4fe3-94a5-93782027f1e4", "comment": "Malware payload (BumbleBee)", "value": "640c518ff312e024c1e3bb198a2240c59b2205ab562053a1e644276592a5c07d", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002900, "uuid": "193e3f00-08c7-4783-9553-f4edac8bc48d", "comment": "Malware payload (BumbleBee)", "value": "f0982a541376190a31fd08a4abd6b28a15b2168c", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002900, "uuid": "3ec4aea4-6d70-455b-bc15-948fd6a3e6a5", "comment": "Malware payload (BumbleBee)", "value": "04b63d5a6f6694eed7e711a57bee43df64226d5d77be55dbe20df4ccb4acbe552e4f21b36c705352d56c4b4a2349047f", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002900, "uuid": "e6eb9d17-8fea-4a0c-8d58-9e9c224d3edb", "value": "T156E7331B382C8FA5D59BE970D2B1725D45327EC6C5A32AF4F02DFEA404B2153A0FAD94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002900, "uuid": "2b8c1356-f97e-482b-a5e0-3cc6a7e4eaed", "value": "1572864:QkDIr6MAacXf7WEGHJJEBWjwb/SJmztzHULWWOEwC2s+2v:Qk0rlDVpO+wb9zJ0SWOGT+2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002900, "uuid": "5fcbe6a1-8749-4932-a35b-ecfdf3ef56b6", "value": 67723264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002900, "uuid": "ee81c0b1-4b31-4110-a57b-23b2b3f79093", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002900, "uuid": "780f2f44-3670-4d6a-82bb-f97be66a880c", "value": "C__Users_user_AppData_Local_Temp_zblcbgle.qc3_Azure-CLI.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7d9a65-242a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989871, "uuid": "01124d52-0436-42d6-bf78-788891a7154d", "comment": "Malware payload (SmartLoader)", "value": "d486b7b7ac9e3719e15de35fa1d63032", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989871, "uuid": "df56ae4d-4d58-45bd-b602-07fbf7ee7349", "comment": "Malware payload (SmartLoader)", "value": "64f1ee5d0f97d687d5e92666e3005472c45fadc6dd774260b6bf3f7f5e1f0ce6", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989871, "uuid": "6f2ad7b1-6f01-42c5-a43f-50c0a5e62fd1", "comment": "Malware payload (SmartLoader)", "value": "435ff5a19104f90cde1aa77d30d7cf8e35878ba6", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989871, "uuid": "e800513b-8e4d-474d-a237-ae0b75f8a7e4", "comment": "Malware payload (SmartLoader)", "value": "debaf4fb33312aca810e9b31cce00a314b7012bb4546e9492bb6821ff071490c3e4183a39f96f7530f814d4f864fe1ae", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989871, "uuid": "c88c816b-e60b-4ec1-8f01-0e01f359524d", "value": "T134C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989871, "uuid": "bd633453-ea85-4f4c-a642-67a737738ef5", "value": "12288:6A7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWWSFyorOIic/7MPX:Nm6Jj6ESfUxZ91kmY/99z8HFXicTo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989871, "uuid": "a31b0254-a0e9-4df9-8d23-d119fab78d25", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989871, "uuid": "581b5f3c-fb9f-448c-bb1b-c8c227d1ad87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989871, "uuid": "70fbcd79-9492-4ae8-92e2-7417a87832a7", "value": "mrl_2.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10795a0-2425-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773988053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988053, "uuid": "14c05d1e-a1ce-48f4-9c83-2000e0c3b8fc", "comment": "Malware payload (Mirai)", "value": "9de8506ce2cc10ce450ab66e39548859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988053, "uuid": "dba6ef1e-a1ae-47e7-8d5a-7952962b06ca", "comment": "Malware payload (Mirai)", "value": "6564da54b7f8f3565a43d3c18ac22ee3d79b978e03861d5521e78dbe2a15ffd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988053, "uuid": "69dc6854-1253-4e52-aebe-3b1326070f95", "comment": "Malware payload (Mirai)", "value": "0b836724e39c1b3aefda46466ba15a7f98e14947", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988053, "uuid": "e94f3931-b57d-4884-94e1-4b1c738049d7", "comment": "Malware payload (Mirai)", "value": "9ee40027c97172c776116c3ac3ee38e03967b544ad008439e07b04688b4c854ba54d0eee05907d293304a489dbd879ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988053, "uuid": "4302c12f-7df1-4be7-9889-72fe3a32d267", "value": "T1D0F33B46E6418B13C0D6277AF69F42453323AB64D3EB73059928BFB43F8679E4E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988053, "uuid": "19dcb713-54dd-4016-9893-19254c4a3b43", "value": "3072:az5bEb526aXjOa651xN9KnPenrE27GRCZfDq372M/9YOL650SY6:YbEbwjOa651xN9KnWnn7QCFDq3yM/9vc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988053, "uuid": "36647a0d-b331-421c-825b-e9c6983c47b7", "value": 157906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988053, "uuid": "0837a527-b7cf-4d0a-b7b2-3734ae8b8bc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988053, "uuid": "86ff5dbc-3e68-44dd-b098-1365aaec9a17", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dddc5920-2499-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774037869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037869, "uuid": "3f7e67ca-db75-453f-8094-2bba1cedeb35", "comment": "Malware payload (ACRStealer)", "value": "95cbe1656049d0ce73240bf766667ba7", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037869, "uuid": "b1e11c23-178d-4849-898e-07f19610c32d", "comment": "Malware payload (ACRStealer)", "value": "6657e66a20def1f0b3f4c152081c313c7ba560c7a78eb0b129067451adc3f7fb", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037869, "uuid": "665f641c-c50f-4d9c-ac53-228a2389394f", "comment": "Malware payload (ACRStealer)", "value": "d5dd17816025ceef1aa54d5adcc420e6fa866564", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774037869, "uuid": "793753c4-cec4-41b5-9540-065734d373bd", "comment": "Malware payload (ACRStealer)", "value": "92c46988458c31bbfc28967278d91c288ea654db4e37ea0da74a2c94eaba5ffd5ccd77d67c07d541b479c0f0726e62c9", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037869, "uuid": "277cbd54-94b6-4fb0-89fc-f014694fc405", "value": "T118363A15F8650EF9C3A06172CEEFA6467334E4041B63B3972E067B3879B31DA99353A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037869, "uuid": "3f367fd6-168c-4526-8edc-c50c2a8ffca9", "value": "e1cfd71a2ac1e1ab37b3be2f2e2b8496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037869, "uuid": "9a91f2f0-5133-4101-a9e8-7dc4561f53b3", "value": "49152:sLCPulcdND28BOkB0JE1gjHCUEQye3fZ2XtQNkZCDYNSMTNIpVyftCBm:sLbIa+Dle3fZ2dQcCiTNIpVgABm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774037869, "uuid": "0d1a56dd-4f35-4a38-9c91-4917979be612", "value": 5305729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774037869, "uuid": "7e920b40-e755-4759-91ac-9b00589493d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774037869, "uuid": "1cf7c8c3-1657-4bd8-b185-b5bdae75abb5", "value": "20260320_190105_loc3dev_telemetryinterface_in_net_6657e66a20.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a5492d-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040973, "uuid": "2344ee76-8d2b-459f-833c-9981d68d0bc5", "comment": "Malware payload", "value": "ac1f8a5fa579e1554b50db34d8503306", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040973, "uuid": "e4e7b3ef-6e3a-48e8-b958-05ec718f6a73", "comment": "Malware payload", "value": "674e506a7ca0a67658ef3dadb1a8f4440d6df071cd9965f8d36221c18eef0ab2", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040973, "uuid": "e63994e4-7beb-4b12-a281-1058ead24fa8", "comment": "Malware payload", "value": "0b49f8ff53dd1df5e704aa26190c70e68e1f4ef6", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040973, "uuid": "776c77bd-d448-44ee-8f64-9c0b38bff846", "comment": "Malware payload", "value": "a3f8607b7531d70948e75f7b2fed7767b9b049b97712ca668e25d13cc35b1fad612deaf62074cdede96fb5c1f827dd09", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040973, "uuid": "bd6bfd02-de97-4b9e-9526-17246be21811", "value": "T111B6D14062DD046DD6AF0E79906102334A35761A179A8BC7FBCC81AC0F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040973, "uuid": "0481c9e0-ca71-4570-b028-cd693b79cdfd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040973, "uuid": "c3b4ce38-18f4-49ec-bde2-19124a08126c", "value": "98304:ZwcEhhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Q0:6PhVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040973, "uuid": "77ca80a2-7510-4448-b736-46a0f3c596e7", "value": 10954752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040973, "uuid": "7e6cdaa3-0c6d-4d01-858b-c857ce99a31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040973, "uuid": "6a8988cf-4c78-462e-923e-241da3a47727", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3d61e8-249c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774039133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039133, "uuid": "5a9492d9-ace7-43e8-ae76-331d4b3a91cf", "comment": "Malware payload", "value": "db36fe29ed4054a4c998cc4b90a4d5d8", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039133, "uuid": "6d02deca-af2c-44c5-8ae5-bc553339feda", "comment": "Malware payload", "value": "68b0bccf6e3176fd187267baa753498cf95055fde2154b4a8607e4e29da5ef2f", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039133, "uuid": "87be168b-1f4b-4602-af16-50b079296241", "comment": "Malware payload", "value": "53bad0ec73449bc668d218bb0688c6abb4fd7f5e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039133, "uuid": "34958ba3-9dd9-4cfb-8d53-009b7ba0f429", "comment": "Malware payload", "value": "ea61a4b8d84b819464c2373c680204f3b8f5db8023e2076f0501c7fc2e72dc03a937e751144b075eb211fd5813c13e83", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774039133, "uuid": "211150fb-5284-4cbb-a9b4-844f6ea6c608", "value": "T177B3F08C499A98B49F5F3025862E5D4F9E9DA112021DC8807EDF6F883F12CB571FA9E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774039133, "uuid": "095db6ea-559a-4a06-9ccb-d23fe0695888", "value": "1536:DJ3rpaohc2S7RYTgYOE/VSs+txIpigMy+H/hZaj0nD7FvP3:Og3Ss+PH/hZnD7FvP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774039133, "uuid": "ecb4fdfa-8b4a-49e9-9afe-af17bf777a5b", "value": 113296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774039133, "uuid": "80a5b739-4312-4c14-9adf-70be043c11ef", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774039133, "uuid": "dd1f8594-cca1-45bc-bef7-9b36712ded96", "value": "Security_Document_Alpha_5195.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be02a4cb-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050701, "uuid": "76117191-a9f0-4622-9ea2-3c909460d67c", "comment": "Malware payload", "value": "5f5403f292d76daf385cfb52ef4e16e4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050701, "uuid": "efddaa3e-3305-4127-8962-53cef984f5e3", "comment": "Malware payload", "value": "6a11656d8a285f986e28ac96b899f0410ddaf7528f47ac4b68d469af425023ff", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050701, "uuid": "f144af4e-ef3d-49b1-b31b-06a9a2ec937f", "comment": "Malware payload", "value": "0e122ec9f66f9a9dca388651095cd6fc485cb105", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050701, "uuid": "93f1e770-0624-4419-981a-9f79c48e76a3", "comment": "Malware payload", "value": "7fe25e323a780acc3882843604dd7a0158f99d8761e091d35c7d6a195286eb48caf9555231799d608dd300464eee8707", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050701, "uuid": "b0e15ebb-0390-4a90-b4d7-ac749d544509", "value": "T1FBD68C45BC2D7462DAC8B5746F6653A43338BC449F81C32A2614BB7CBEF2358CB67261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050701, "uuid": "c99d265b-1c44-41d1-a37d-adbd51b92d23", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050701, "uuid": "89cd0f13-6115-4761-9512-d9073853ac09", "value": "98304:sdVsQwB5rgbwe9VD97uU0OXjMeHYSbh3+xDBSKXjExt6GMv6hnsE:sDsQwBpreLZnjMcx+xFVv6hnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050701, "uuid": "a19389ea-e206-47f6-b64c-398b217c146a", "value": 12656128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050701, "uuid": "4f40c468-316c-41b3-9d8c-49c60aa0b02f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050701, "uuid": "0f5a6a05-c0be-438e-872d-cb47e84f059d", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4857c45c-242c-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773990803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990803, "uuid": "e47e37bc-88d3-43f2-b7a6-29932d25d501", "comment": "Malware payload (AgentTesla)", "value": "31a9259e00e3f8f1f32907420dd27857", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990803, "uuid": "18fb18ec-4280-4c16-a474-3ad7f7190081", "comment": "Malware payload (AgentTesla)", "value": "6a3368fb5ffab1283df539c6f17cb1244b563f5a3ad94d96adcde2dcadab66ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990803, "uuid": "9a269182-df6d-4dd4-bfb1-8f4dd1239645", "comment": "Malware payload (AgentTesla)", "value": "10f6de17ec866bcc91e2b66f1f310cb441168541", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990803, "uuid": "6011d429-e223-47f0-a801-1171884c38f6", "comment": "Malware payload (AgentTesla)", "value": "5cf8493f2df4a85b93ab90e295183898bb52b5c4fe2686cae035842d51dbf37d239c40a6a5af556a20e3e9c286c9aaed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990803, "uuid": "9501e8ad-82ae-46c9-b630-29d4ec8451a6", "value": "T1F92501153A58EF02D8FB2FF85962E17413BA6EADD422C7068FDD2EDB3961B410509393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990803, "uuid": "c54a54a8-f442-4668-ae6d-f52210a34bb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990803, "uuid": "d2add6f2-c0d3-4904-b212-9ef0266d45e1", "value": "24576:D2MJXqq9VJf1WIH1KfMCXTO2eEeWd1OgmSC:D2MJJ9v1KI2ehgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773990803, "uuid": "e4c73172-722b-427d-a48b-231c7acb3789", "value": 970240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773990803, "uuid": "016cad08-7086-4439-9fbd-aaa9dc05924c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990803, "uuid": "61f53d9f-4019-4f15-abdd-088d8173d64d", "value": "Payment_Advice065789456.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c855fb0-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001064, "uuid": "d177ee8b-e1cd-4d3a-b361-b666d0080c3d", "comment": "Malware payload (Mirai)", "value": "110f88f56468b8787a41b19fa58d8969", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001064, "uuid": "f9cb997b-c092-4743-bb44-ec6b223363ba", "comment": "Malware payload (Mirai)", "value": "6a86cc8a48f3466f55bb73533ad3c44f555575505a7fb9b4142dd6df3a336404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001064, "uuid": "35b82ecc-33d5-4b88-a0f7-bb4cdef2eb87", "comment": "Malware payload (Mirai)", "value": "c5abc186d714c7b5461ea860f83c4407f34fa5ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001064, "uuid": "5087d13b-5914-44b7-8ee7-ffd7ff1c7a11", "comment": "Malware payload (Mirai)", "value": "b93385aecf13bc442ec678332bcfa55dfa5d58f88f8d92acf2e25700446a08e082b3cf441eb83041e21afb6413bfa509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001064, "uuid": "5235c5ff-8d16-4bd9-8487-a151ed78ac82", "value": "T11E733A89F343D1F1D94706B0109BFB3E5B349AA11210ED2FEBA4FA76AC725526027E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001064, "uuid": "3027b3e6-ba15-4725-948b-6960e4a9aff5", "value": "1536:IF/+ykrzYfExxD1XlnJq87Pu4rcauUc31gGHgRRuQ2OrqXqQr:IFWBAmlJLPYKGerqXqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001064, "uuid": "1019a86d-6949-4ca0-bc01-1643d012b356", "value": 74856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001064, "uuid": "d8567e1b-2c2c-4c30-9f44-e11b95cad5bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001064, "uuid": "ec703bc3-6176-488b-a518-f0d9bae5f04b", "value": "h", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20c1a10-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040829, "uuid": "c570ebfb-537a-4b14-9a6c-15443ec2a977", "comment": "Malware payload", "value": "c7347320bc4020f36c373f8fdf1681a1", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040829, "uuid": "edba7a1e-5577-4828-924a-1ac5df9051e8", "comment": "Malware payload", "value": "6c6bce0a9abbf7e6e395337ae61307b1dec3e4aa69dcaa46f63f26b8c42aefcd", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040829, "uuid": "1ff2ada2-6a29-4e32-99dc-6cc1f34eb845", "comment": "Malware payload", "value": "b111335a71bc6d79c23ef7ae545507f47c09a388", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040829, "uuid": "7ab9a34b-780d-429f-92ed-f52a6c7827ce", "comment": "Malware payload", "value": "a9c51ee259ba3e0d83c1c8568559782c04d1fb9d97f0b437c80e15dd6fc898406810e0f8ba30783345d017e9d243b377", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040829, "uuid": "7ca7cf84-8ec3-4d20-a218-e070c2219420", "value": "T154068D4B7C922A05C5D4263BACEE45C4376DAFBB3B9252063D05FA7936BF09E08B5314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040829, "uuid": "46e15cec-08ae-44fb-995a-aee68b327b43", "value": "24576:6C+Yf62KBYbmiOlxy1xejYCWle6FFgod5zH9p1huOnneSwUcgn1Wvx/QZbQMRT4B:E2SujDx16EQ+hghWIl8YNXpmxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040829, "uuid": "6c2ac011-85c8-4445-82dc-946ec21b6f42", "value": 3856497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040829, "uuid": "5d7d90db-fbc9-43d1-823f-a58171c63109", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040829, "uuid": "95830aa7-2beb-4ccc-964b-575342db4c37", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e84e93-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977911, "uuid": "85f49acf-5c71-437c-af80-fb11f64b8013", "comment": "Malware payload (SharpHound)", "value": "24c0d7f5a26969a902f5757af463e45a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977911, "uuid": "36c6a551-e568-4241-88ea-65ac832b2a04", "comment": "Malware payload (SharpHound)", "value": "6ce9c626cf61d0b7fa900dd19e688f41f3d3cd5bb7192f423a6cd454b494cec3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977911, "uuid": "479fa7e4-d290-4977-bb25-4ea3c4467f10", "comment": "Malware payload (SharpHound)", "value": "77465e4c43fde044c31cc7ac12ec7b4a9d333aae", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977911, "uuid": "22908c97-c52c-4921-ac5e-34929438454b", "comment": "Malware payload (SharpHound)", "value": "9c703583f1141bb73804a68ab01f9b0d0819bad60092bb878da5ee2ced6ea2ce888c99afbf2eca063eead95062276e70", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977911, "uuid": "5d715d47-0223-4d84-b8a3-15189b1b8a36", "value": "T1E17533309EF27A6B4FB58338601B7E5FE37187538458579A75DE90CBAB06B11086B02F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977911, "uuid": "e121ce5c-a539-4e9b-8fe5-bb89e42592fe", "value": "24576:aOaRwbSApXrpJvRPFUagcNf4MSIkiUIC2GfOgODFOlD1h0VwvR1AANiBb9g8PozA:HaEpI1M1kj2hQDhDHAAsBBap+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977911, "uuid": "6838eb07-1693-4f34-acd0-591937b19af1", "value": 1618193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977911, "uuid": "457a3e72-fac6-4d52-bf62-fa091719b306", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977911, "uuid": "12969329-c19b-4cad-9bf9-d3a6f349ddf7", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379206f8-2432-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1773993352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993352, "uuid": "de709df6-3454-43f7-b580-d1a6b0abd274", "comment": "Malware payload (CryptOne)", "value": "9952cd8e9a8d2386da057477922a99ca", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993352, "uuid": "c1d6f6d5-1845-405b-8898-c2d883051db9", "comment": "Malware payload (CryptOne)", "value": "6d5359da2ccc35100a8dc1b873551246d6234aee95c36471f103dd1a1eea99ea", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993352, "uuid": "14b3eb39-f355-4e63-a0ba-73e8bbb19297", "comment": "Malware payload (CryptOne)", "value": "f76c7ea8a4e3772e05f86e2d31f65b1e0b4561cf", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993352, "uuid": "ce6e4c93-e215-45fa-b865-7a624360cca2", "comment": "Malware payload (CryptOne)", "value": "81d71391ad7a54b5035b296c746cf09c28a416ac08a964a2607ead7d2a43d4ca4dcf72cc886453460a9a53e361c5ab4a", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993352, "uuid": "f9c44a26-5be3-4be2-a46b-6d5482d07894", "value": "T1F136F117E181B927C372B5BCBD05AE7B7B46BC148E2884857ED3DE4C1A3E6072660973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993352, "uuid": "c5746d4a-5af1-4c2e-b118-801ed1796b7b", "value": "bf8d88fb7815175dd959fe045f668096", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993352, "uuid": "48ea94cc-6d4e-433e-9882-85e040801cad", "value": "98304:Ai86KFAmh0GvtqWTCcNL3TPTYKtKr5RHbvw+F:AiKFHNvx3LDPTYKtKT4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993352, "uuid": "2394a1d9-7720-428f-8831-c6bb86b927b4", "value": 5119488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993352, "uuid": "96a156a3-4b59-4554-aae6-8406587729bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993352, "uuid": "1f18729c-8d1f-4c00-b077-82fddc90aa5e", "value": "9952cd8e9a8d2386da057477922a99ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f594411b-240b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773976920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976920, "uuid": "6bdcba0b-d4b6-47e2-99d2-f557a64016f8", "comment": "Malware payload", "value": "75fc282f667b70e61af582c926f0fb03", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976920, "uuid": "2d7542c4-8467-4e64-9ead-6861b15fa901", "comment": "Malware payload", "value": "6e4026affd522138e53dd2fd4a9a6741b00d5183c315cd75df5bde9f6259db3c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976920, "uuid": "34ed617c-7acf-4f11-a0f9-e90633f30a09", "comment": "Malware payload", "value": "bf8576826a7846acbe6ffd3b71591ac300930da7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976920, "uuid": "617f131e-5db1-41c4-942e-2d1e52dbf762", "comment": "Malware payload", "value": "6da4b25add332f68f24c38d74d7b941435e317047d014a34268f8aa944d3c03cd734aaa6917a646723e310efee049cc9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976920, "uuid": "61b53747-cc7d-47a9-b764-1931eff70594", "value": "T141F098DE71193828F804BE4634D28B942210F2971E5F4F49148D2961FC566783037F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976920, "uuid": "e563152c-1891-45a2-bf02-809e90aa7550", "value": "6:SVX5UCuyU4IUrUgcVX5Uh0yU1BFIURcUGVX5U4LyU4IIU4QyU4hLVX5UeGLyUeGx:oDIsSHFI1nIK0edIIeQpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976920, "uuid": "d5d1b3fa-b5f3-4e5b-b021-aeaadd3b2a9a", "value": 468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976920, "uuid": "12dd1791-66af-42f6-89c6-1ffe09bc23c9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976920, "uuid": "905d6b5d-84b2-4fe7-b0d1-23af89f51e72", "value": "t.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd4e925-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040684, "uuid": "8681cee9-2446-4235-9c4e-d47797c8973d", "comment": "Malware payload", "value": "493a2d5389f48eaab1fb04668538a12b", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040684, "uuid": "373a7cab-55d5-4a26-87b2-459e9a5348f7", "comment": "Malware payload", "value": "6f9d05e3f06e51269f27372d8ffd1614d823cae637733e021706ae464b3e2cba", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040684, "uuid": "5b2f73f8-4c85-404f-bdee-6a3d85afbcaa", "comment": "Malware payload", "value": "ce1fc5c823b60f10b9a6c320cffb06484cb3c938", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040684, "uuid": "cc2d52d8-a020-4d21-8c8b-8abfd1e7ff07", "comment": "Malware payload", "value": "4ab2477556afb4e698ffec44553725c94596a8dea50d00a0feff9ec868651a7f9af4989433d0726248a7c587b6cbba67", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040684, "uuid": "ad82fd12-835e-421d-b49e-d29b3a0b7b2a", "value": "T13006BE9ABDA83940D649263E5FED07C1177DFF4B2F5287173904B7AE1EF221A4AD1220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040684, "uuid": "eb8914e3-bc8c-4ad7-82df-9ed963c993f5", "value": "98304:BlF2Fc9KKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIxk:x2c05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040684, "uuid": "3234b023-9d83-4e9a-a364-25c7d594a737", "value": 3860994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040684, "uuid": "cd80bf23-075d-455d-9440-8acf0cafbbf7", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040684, "uuid": "4434d436-cd9b-47e5-b23d-089e4367971b", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a692e32-2467-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774016254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016254, "uuid": "1110dfcf-f80a-43a0-9267-166ef9271a85", "comment": "Malware payload", "value": "afa0d148b42a88dd00fcb14ba54593fb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016254, "uuid": "9f73a1e1-a8b2-4698-8979-abdffb6370df", "comment": "Malware payload", "value": "70248962c3eeee9d74c4637c46b0356689c21315910d746894cd8e8086c7192a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016254, "uuid": "a361c8f6-15a7-4082-94d2-96c3e82b0c2c", "comment": "Malware payload", "value": "0d26bca6915ba68d7c25f98a68de56590afe876f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016254, "uuid": "27444627-548e-45c7-b5c7-e5d3abf9d3a5", "comment": "Malware payload", "value": "c80db0c9a4e859701612b0110fa09a4378215137097fe3038e3030c5c9821ce31f8bc787fe44a1a2af838a53e2e3c8fd", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016254, "uuid": "e6f8be39-b1c3-4392-889f-597efbfdd3c8", "value": "T1E4C26C725113BCE8BB7E1EC8F44428410C51BC37D3659A94FBCA04AE78E7810DD6A9AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016254, "uuid": "3fcc71ab-33d7-42c5-9f4b-505e5cae2ee3", "value": "768:qQcroI/T0GFgxnmMKSa8AgJAQq1T6C0If:T0oIb0GFgxnmMK7wJARh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774016254, "uuid": "a5a1e5d0-602a-4969-885d-4a72cd40c928", "value": 27318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774016254, "uuid": "b30c21e0-6985-462c-bab2-37244ec71368", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016254, "uuid": "5ac1ecf6-2972-41a2-a738-8e11a667ca44", "value": "70248962c3eeee9d74c4637c46b0356689c21315910d746894cd8e8086c7192a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0590a941-2409-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773975659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773975659, "uuid": "50e67ba8-1181-4c86-9b2d-aab466073bed", "comment": "Malware payload", "value": "7519851b628724c7b9ef8df72506dbe2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773975659, "uuid": "17e9a4d6-51b2-4431-b0b3-d6508164f146", "comment": "Malware payload", "value": "71e5c6a426a753a5a6e2b5cdf1567f7a68be74b96aa66bfb569fe31179a9c42f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773975659, "uuid": "91fb76cf-b663-4c4a-a951-dff9bc62ec3e", "comment": "Malware payload", "value": "f508aee3b44424933be52b649f2a524f0048b747", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773975659, "uuid": "2756df66-864d-4c53-9a47-e8d620bcc351", "comment": "Malware payload", "value": "326cdd00e514b34126f251ad9a7e109336d17c9e3d3d1f393a984421857bd2ef1a15d16f279bb71575adcbeb97b90e25", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773975659, "uuid": "e38c9eb7-4f28-46cd-9849-a1128f9346b6", "value": "T116925DB512896C79FBD1CE39AF3C7F4CADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773975659, "uuid": "6271dd23-ee83-486f-88d8-1d1ccf9749bc", "value": "384:HNFcuQpWx+BL0SWL0gAzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:HNF8i+BL0SI0DzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773975659, "uuid": "f60538f3-fb74-4601-b647-73bfb3a9e96a", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773975659, "uuid": "8b98cd95-126a-4d6e-8290-fdcf14736cfe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773975659, "uuid": "bec9d685-4c27-47a2-8408-dbb60a20ff89", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7991100f-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040707, "uuid": "b40cb034-d1b6-4a8c-8965-e62ba9dfe993", "comment": "Malware payload", "value": "0fd649e4c333996866f30cb99253964a", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040707, "uuid": "3f442cfe-f676-4fa6-a6fb-310cc80f7826", "comment": "Malware payload", "value": "720075fff885a45734c2752ff17f01f2f26340113bf1fc0df99c0ec48c6e20b7", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040707, "uuid": "aa5e8b87-8a38-4155-8017-3116d0325297", "comment": "Malware payload", "value": "1260bfa8ff2112e9b6497e739760cf4f66aa6463", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040707, "uuid": "80efc33d-5df0-432e-a76b-bbd0a12705a9", "comment": "Malware payload", "value": "98e440ed042f6aa8b46d468e2d0f1ab8158cd1c90caf5e92f18ff6de01a382513b17f7cb738d1b21094caaaf3ee574ab", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040707, "uuid": "ebfe7495-ec22-46d9-87a2-c0de2d110fd1", "value": "T130069D477CD22A45C6D0263FACEE45C537ADAFBB2A9252063D05FA7935BF09E08B4314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040707, "uuid": "edee6151-224d-4e0e-8e7c-f2296720dfc2", "value": "24576:at4Y5R2XBAJmJvXVy1oojjC/tQ69uk+ENV5q0ohuOPjf+W3Ugn1WvxdyCy91h+TK:w2zRYxtlDihAghWIl8YNXpmoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040707, "uuid": "4ad81dc8-ad72-4832-8ec4-c778836d7ace", "value": 3856497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040707, "uuid": "30f9ac6b-92d1-4fa3-bda6-895fde2c2e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040707, "uuid": "c2827864-f993-440e-951c-b17687b87a99", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1644b4-2444-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774001117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001117, "uuid": "ecf403ed-3713-4579-af1d-94fa4bc04f2f", "comment": "Malware payload", "value": "1eed03f16019d7f1b4adc16c1bc4276a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001117, "uuid": "4ba54f0a-bed6-4c20-bfe8-7576d2702fd2", "comment": "Malware payload", "value": "7257e6c62b97a4903ddb86f0bd4acbda04c9dfbb7e00c7f8ccc165ee6ac6cbbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001117, "uuid": "7b7c8ebe-e2be-4b69-b846-272d5efabff6", "comment": "Malware payload", "value": "e416c678763bf2198085e7d38e451d3227a450c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001117, "uuid": "8e80a4ae-8f0e-4132-a9b6-dbdd7ca38d23", "comment": "Malware payload", "value": "1777f16ec6b9baed1bd6f3c2c290e69439cd26e43767bf44b4f3ed84990435cfacf92de594b8a6be127014278e18e270", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001117, "uuid": "a8a6a1b7-4447-420f-a798-162178e14c10", "value": "T111A37C34774F7C86E3CBD378DF1A4E61302B39E6C666D1657D12232DC5C2EA68AE0990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001117, "uuid": "87eb37fd-cec4-423b-add4-bc4a4b394c7c", "value": "1536:xbL7HuR8BlCGEnNi98Qjmw6NzQPfGIngsMoLv2F5E4PiBT5jHyH:xbL7HueljEnqjmw6nGSnfST5j8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001117, "uuid": "08e3af01-1db8-4166-9f99-b29fca0c88af", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001117, "uuid": "8e491e40-e237-4189-bc78-379b351bf26c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001117, "uuid": "16874b70-48e9-4775-a382-1e1871c43be7", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04b38426-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040941, "uuid": "173d7e42-ed74-4763-8a77-971e70014c0e", "comment": "Malware payload", "value": "4517f451789dfaa1a770a7e4f619a536", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040941, "uuid": "0c995e7f-6897-4aed-8519-7be2dfb21ce4", "comment": "Malware payload", "value": "73b939e5fddc0da512b9a500fe08a9510c1b766009afd15562a2fc95f4034591", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040941, "uuid": "efcd52bd-a6cc-42d6-a216-2b94a94ec199", "comment": "Malware payload", "value": "a4c9e93940d65ed4ba6bec2753b58d6a25d4f51b", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040941, "uuid": "306a2e2f-448d-4ca1-9dcd-ac2364176a64", "comment": "Malware payload", "value": "13734649526e8fe87138bf8e17d7b19fcf33fa0b5f305d143f7f1e7dfd7dda15f826757288aa96f3b8c52f5cdc1a4bbf", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040941, "uuid": "e27abfda-2f0d-4e07-bc9a-aea8eed95809", "value": "T16906BE4BBDA03994C626523B89EA59C22F7DFD4B2B3113C73E40737A2A725D618F5324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040941, "uuid": "21eca01f-3b9b-4369-918b-383d7fba28af", "value": "49152:aTd/9pe9ffsW2+6E6FHw9oBQNslIqk48dSKaA:a/qCCoBePdSKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040941, "uuid": "0437ef00-c1e5-400b-87ea-290f5772a44c", "value": 3907160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040941, "uuid": "fa59c5e2-3e9d-439a-accc-f012f2983337", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040941, "uuid": "73d83a44-2dcf-4291-85e0-38716c003437", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e5965b0-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989122, "uuid": "9078b16d-2d00-4381-93a5-f30191c0ad5b", "comment": "Malware payload (SmartLoader)", "value": "187ace6d9c3a191c736b4c8e62c78e6a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989122, "uuid": "8cc5588f-8095-42a7-b608-ede04bc09730", "comment": "Malware payload (SmartLoader)", "value": "73c129765c2dfc61c60bc137b3b7cab1d5e1d16cb01bdfa821d296f457679093", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989122, "uuid": "a4ceccb5-9ab2-4718-8207-bb83a23fe587", "comment": "Malware payload (SmartLoader)", "value": "6b23c0b046d5719dd17386c8ee5c7da230ddb73b", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989122, "uuid": "5724caf4-eeff-4fd6-90ca-685dcfd837b7", "comment": "Malware payload (SmartLoader)", "value": "0b63586aa7d443c6346677339f013d7932179f433d83dbfef51fcf73d0deec285314afec2912524528553753ec9cad84", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989122, "uuid": "bd3d8fe6-8a1b-4b2a-9e02-3de159950dd8", "value": "T148C42304340651D5835A2B1EAEC4E6E0BEB5B0DBFA1CF940AADD7ED06DE52A173C1837", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989122, "uuid": "2d7dca76-ad92-4683-a351-508e0e4d6d3a", "value": "12288:L6wlOMWROC/FTeHo22Qm7NzofOr68mWeA924EwC0:z4MQOC/gHozN7NzomW84A9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989122, "uuid": "39c32756-0df4-4bad-af6d-6bdf26d293a5", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989122, "uuid": "6354744a-5e99-4c91-9da2-0737ba32cdf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989122, "uuid": "a4ebbcd2-a15f-461c-8bc5-7f4210d3303f", "value": "kit_Drum_website_v2.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d1893b-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978097, "uuid": "f8a468f5-4ca8-4170-8ad8-ff27d0e3038d", "comment": "Malware payload (SharpHound)", "value": "e0ac0b3f1e0eae7238e6935487673a31", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978097, "uuid": "9aaa05d1-6a26-4361-a341-9d3d03612c5b", "comment": "Malware payload (SharpHound)", "value": "73c16c32709ab97a3d66b244542d9474639b582757446ef633aabd602912a1e2", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978097, "uuid": "ebb7d7db-e19e-408d-80f5-328fda0ff38a", "comment": "Malware payload (SharpHound)", "value": "45769c49fe34944717d59d63207256b17b97a091", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978097, "uuid": "3c3bafaf-5e6c-4a41-a3d7-4a8577416c2f", "comment": "Malware payload (SharpHound)", "value": "ed5958fe38f37f0c620dbce7a5422cb98af24273208e9d39ba773fdf14f4c47cffe78a0373cfaeb5142e077b39d8dd16", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978097, "uuid": "95f18487-2df4-4f3a-9cf8-a1f7e3733d82", "value": "T1DC55131563F88B95E6AF1FB9A03142258BBBA707F9AEEBCD584CB4DD1482704D851333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978097, "uuid": "57f2cb9f-5eb1-4d31-b913-b5283823c571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978097, "uuid": "28d28617-0c82-4a58-a83f-f5047018a1bd", "value": "24576:bLIGEDwgrRvNuXoVIa09WmPstYX38SXDNodEssEkong/iN9WCZ:QzRvNE9WmPDXP2ZsEFK4Wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978097, "uuid": "fcae1881-42ba-41cc-94c5-c541219dc948", "value": 1311232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978097, "uuid": "24c89708-4897-47e4-a5b1-ad46c0ab81dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978097, "uuid": "cda54022-1aec-4626-93d8-f838c6771b54", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1831dafd-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046986, "uuid": "e680c490-7b0b-4dc3-adc9-5389e87a3cde", "comment": "Malware payload", "value": "853ae75184e245b50e1ea235e53d7a42", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046986, "uuid": "0e19c307-2fbf-4226-9a9d-d5c87f904574", "comment": "Malware payload", "value": "73c81b1209f7db1f099cfe44a6996249de5262a6cc651878262da6c06e27bd76", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046986, "uuid": "8323726c-338d-433b-9f05-387a37a183a4", "comment": "Malware payload", "value": "15826919a5cb8639fcd4d89a4b17100b4e6484b5", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046986, "uuid": "cc4ccd98-cb1d-4628-8a0f-76b894f0ad43", "comment": "Malware payload", "value": "6505d469adcc518cbb9409ad44277ed8baeaeb69436c58b8c2935f4e1ec6d5de8279abbe29add3425734c347294572b7", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046986, "uuid": "02122798-9728-40d3-97b4-35a531a800cb", "value": "T1979523208B570E7E057CC23A30AB6D2ECBF45EF3948496C377DE30C61779A52912796A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046986, "uuid": "e0cd7b0f-7926-49c5-a530-4390f6f7b586", "value": "24576:+2dxzbVjbtHMvIDPRjsCC/QgUcOOJUytngFXO5xvCd/sAUxBL7ZST/DN/cV8Hx6C:hdFJjbSvDxV5UACOtST/VR9Mce9qiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046986, "uuid": "ac6c1316-91b8-42be-a5ca-43e9c0ba10f2", "value": 1951985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046986, "uuid": "b1e429d1-c479-4774-894a-17cc6f167cfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046986, "uuid": "37f040d6-71ef-4916-b4f3-667db99e442b", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a413778f-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046792, "uuid": "fcc9fc4d-1056-4ae3-b54c-baf175fe5fbf", "comment": "Malware payload", "value": "0b7d653befa8ae84940118965a7ec9ca", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046792, "uuid": "c6d210c4-28af-47f3-bf3a-3a29bc45c241", "comment": "Malware payload", "value": "73ccea435e12299acf2f835b63215802edb5896306bfad5beef8f0e1ee1ef8a0", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046792, "uuid": "3556f191-a675-485e-b9ca-7b347efc41a3", "comment": "Malware payload", "value": "28df08d46e1449320442f1debbcc2584b37afda0", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046792, "uuid": "756d0df0-502b-4063-8776-c7c84a87ec00", "comment": "Malware payload", "value": "f09839de4c8cbd239ff6e52f45c6d0bb579b6dc2f61c55846aec94504affc73477aedd9865e16e9cce5c445d5c23e5ec", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046792, "uuid": "95bd80ac-3301-49b1-824a-7eac9d0da3eb", "value": "T18D55122963F88F95E5AF1F79603142198BFB7717F9ADEB8E684C70ED24823049851237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046792, "uuid": "c2dde4fe-0697-4c25-9fd9-4f20a97ebaef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046792, "uuid": "e59774b6-42be-474a-bd6a-bc27e8be7459", "value": "24576:ZjLIGEDwgrRvNuXoVIa09WmPstYX3vg8Wi9yclJxkong/iN9WC:ZIzRvNE9WmPDXDWHcbxFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046792, "uuid": "08f19c9e-1e80-4205-8d1d-9ee3dd187e48", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046792, "uuid": "4b2e284e-a667-4e94-9013-9de6e12b62fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046792, "uuid": "045ab241-5b1d-43aa-9cb2-3f8ead5afdb3", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c5ef63-242a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989884, "uuid": "a4783dfe-0d35-48d5-b812-951dfba81e25", "comment": "Malware payload (SmartLoader)", "value": "bf83f2c93e77bc1069a3bfb0293d13eb", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989884, "uuid": "6d3250f7-4d93-465f-a4a5-79d25dafd47f", "comment": "Malware payload (SmartLoader)", "value": "73ef3ec27bbfa00ea7cdf1aae7f69de6b284eb246ba915e1483c8dd0e627aced", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989884, "uuid": "e0dbbd09-31da-4a2f-a01c-4659275af1e6", "comment": "Malware payload (SmartLoader)", "value": "32d807810b22ff2d6207280c168e063d65e5a7ed", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989884, "uuid": "83be35e8-ff01-4ad1-819a-640d338b0f10", "comment": "Malware payload (SmartLoader)", "value": "6cef5ce8aaadb20fdd2b5cc15594b8679b000d4faa32dbafe3c39427c1821a4f50c23808b519992168097f34e637c25b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989884, "uuid": "eea1a251-38bc-4cea-b147-31feabab7c95", "value": "T14CC423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989884, "uuid": "e69d3a85-80f5-42c3-8944-1a7e83ce4c63", "value": "12288:aA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpWySFyorOIic/7MPD:tm6Jj6ESfUxZ91kmY/99z8zFXicTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989884, "uuid": "54347046-e711-425a-af82-7bb26fc1b466", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989884, "uuid": "abbc77ee-b78c-4e79-8062-009959c389ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989884, "uuid": "a55a2e1c-cb14-4bed-952b-b4a1741c5231", "value": "Software-v1.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00e5b6d-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040852, "uuid": "97c036db-22da-45ed-91da-e6b9826dd93f", "comment": "Malware payload", "value": "7265f570cbbd81a6afa8647aecf719c8", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040852, "uuid": "41c9997d-d6df-42b9-a30a-824b17b7e2fb", "comment": "Malware payload", "value": "7408fd4b1b6a634690548f4b330839a5071f46242a7106c2051fb127935e7532", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040852, "uuid": "c2043e97-ebd9-40bd-a1b6-359cd27befc3", "comment": "Malware payload", "value": "686cdc6304b45a7d5ab6c4da6f663a81ba5a5283", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040852, "uuid": "d157cd5d-3c8c-48bc-8607-fcd71bde68be", "comment": "Malware payload", "value": "5e954bf8a2bf1a421567feb76c3c6c88e1c5d3ed1bea16520253c06a7a66883fe557958f0497d0d78dbc51d373a71ff5", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040852, "uuid": "ded1e627-44b3-4c42-87d1-337b4fbc19bd", "value": "T100B6D04062DD046DD6AF0E79906202324B35761A579A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040852, "uuid": "5642b312-32f6-42d5-ad97-cde76c2e5076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040852, "uuid": "0c0651ac-0689-4b15-8aa2-2010e86b2456", "value": "98304:2oKcJJBhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Qz:RPzBVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040852, "uuid": "9c8bf500-358f-4b67-a13f-6f13d2731694", "value": 10955264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040852, "uuid": "9dc49173-dae8-4b2d-949e-93c99c63e1f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040852, "uuid": "15fa575d-91c8-4179-8d08-603d3fb64ce1", "value": "winPEASany_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36619f9a-2424-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773987337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987337, "uuid": "58bf4829-6d59-46cd-96b2-03d032d3ab88", "comment": "Malware payload (Mirai)", "value": "527427eaf0ddf5aadb2b42db4593475b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987337, "uuid": "b95dbea0-93fd-4932-9fea-6170f7bd906d", "comment": "Malware payload (Mirai)", "value": "755f65247a4ed412cd6aeedbb26b955e05edac368e419109cf19fc4aa8a9207e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987337, "uuid": "24274c81-ef27-4d59-8962-9f3015adaf2c", "comment": "Malware payload (Mirai)", "value": "d63629e6ab07e6821c5a469e124be41392c75a49", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987337, "uuid": "449ed81c-6654-497b-b474-f357b3789ee4", "comment": "Malware payload (Mirai)", "value": "d9134499557629d23baf822752c539387b0dd685bff9b0795fab47e1cc8e4cfc25b1827dd4a66f01c41fa065348bfba8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987337, "uuid": "b618d1e2-c071-4abe-9e40-53331af2d9c6", "value": "T194264A43F95191E8C1AED230C6669293BA707C885B3027D36B50FBB92F36BD46E79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987337, "uuid": "13055fd0-49c3-4985-96f6-24cd64e2cd29", "value": "49152:oPTYVrb/TivO90dL3BmAFd4A64nsfJpA9wnnM0ilS5YcAWL+f3VEeRvhYK+YvK5R:cgA9w5w5jR5wkAE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987337, "uuid": "cc670301-590f-4456-9c39-d031f39184f6", "value": 4677632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987337, "uuid": "d1218d26-cec0-40e4-9c6e-8829a57c6fa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987337, "uuid": "691fd005-36ec-418a-b588-846277357ae2", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb3a685-2471-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1774020689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020689, "uuid": "a817ef03-053a-4b9e-96c6-cb1e5571016d", "comment": "Malware payload (Gh0stRAT)", "value": "79171156a0c53de208bfed225a48cd3e", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020689, "uuid": "9afb8f74-f61b-4d27-9ac9-9b2e1bf29b9d", "comment": "Malware payload (Gh0stRAT)", "value": "75a5384d05ffc4e0e4deb4c55e0bc09d9edf32a346e4bc95716aa853eadc0d59", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020689, "uuid": "fff30e8e-0728-4e0f-8cf8-32e6a3f8f25e", "comment": "Malware payload (Gh0stRAT)", "value": "5074b5d97fb42fe9ca70c723065228ecfef3bf86", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020689, "uuid": "0844f4f9-36ca-44b7-bdba-eaa6d4849f93", "comment": "Malware payload (Gh0stRAT)", "value": "b1a4acb1283181f4fcb5fd7654aa7ace8bfe10a03c65eead58223abb3a54b3020a41412f132abacca76252c200c5984e", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020689, "uuid": "cf75a422-efb9-4ec5-bb1f-501fc97b0281", "value": "T1CB573315B6CBC132E52E0177E968FE2E05B9BD73073045D7B7E479AE84B88C19274782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020689, "uuid": "f8e8c9fe-3928-417f-bf38-17d96eceed4a", "value": "786432:cCm2UoHad51O0rf5cqm/4gOgaDdMitigFHPkNqI+NdipEi:cCmPdL5feax77cNqvbi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774020689, "uuid": "06bb8d8a-f65c-42b2-8fd3-dccb43a53618", "value": 27923456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774020689, "uuid": "90f8a056-008f-45c4-9341-6b61328c1e36", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020689, "uuid": "5ed9c9bf-787c-4473-a339-ad8ce9164c12", "value": "5a5175.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee6baec-24b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1774049843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049843, "uuid": "b00c2f74-c3ea-4178-ba8f-0c7c2076449c", "comment": "Malware payload (Stealc)", "value": "1f231b64292c9253b50c292471823cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049843, "uuid": "94e78360-1037-4d83-b02b-a58054999d39", "comment": "Malware payload (Stealc)", "value": "764adefbf141f0d492793bc9eb509864fffce59611f20592d905e554ed67ee74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049843, "uuid": "c94a4e09-9cfd-4402-88fd-5c4e5a46549d", "comment": "Malware payload (Stealc)", "value": "a2434d14f28c13083093480cfbde2615fbf35b29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049843, "uuid": "0e4afda3-c593-409e-88b6-8dd69692db87", "comment": "Malware payload (Stealc)", "value": "59b36014b98c416e667c27ee11af4defb37629a4f8ee050efaf58555093e8b4d18c1d7212391a78467262ccb5136ee2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049843, "uuid": "2a89410d-28da-4c41-9f94-aad879eaf2b2", "value": "T1BBC58D1BBCA409EAC06AA77288B659927BB5BC0E0B3363D31E81B6343F767D15C74744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049843, "uuid": "15a4318a-aeed-4ea8-b181-a73c6c124b66", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049843, "uuid": "5ca9417b-cde9-48e5-b3b3-e25c8f887167", "value": "49152:QwCM8G/u6z9Ba90o+bnLN7Z/A+dPF3EUT0P:Qwb2AVRtEUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774049843, "uuid": "9220d186-6e06-4046-897f-97fdad1ea6b8", "value": 2517680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774049843, "uuid": "4a69953f-d857-47ef-a526-c421716b7741", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049843, "uuid": "6516b3e6-772d-4038-9fdf-50b3c07ef076", "value": "SecuriteInfo.com.Win64.Evo-gen.42732565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39816288-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977893, "uuid": "5e4ad536-db08-4115-b4ee-885e35c8d1d9", "comment": "Malware payload (SharpHound)", "value": "c706fb1129a15beb6407d830ae77ce8f", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977893, "uuid": "da404ffa-d672-4123-b125-bca9b334a1c7", "comment": "Malware payload (SharpHound)", "value": "76d9e4966e91cc80e126d26586a9df1e831f5fe6efc9a3e0f900768e40dd3e61", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977893, "uuid": "eac277a2-c299-48bd-b2f6-7437c29490cd", "comment": "Malware payload (SharpHound)", "value": "d59089192fe1c95070e8f6636f85a216479217de", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977893, "uuid": "30a60308-98f4-4aa4-8812-f94fd0cc69b5", "comment": "Malware payload (SharpHound)", "value": "23037855f59274a358b3d7be1a828eaa1fdcb7344e36ebc55d573e2dfe97fba6741d9fa302d792a0c7f7eb14c5466f9a", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977893, "uuid": "f8d3c158-4f61-4293-adab-bb45e6f19b99", "value": "T1C77523304E572D1F0BA8C739723E6A2EC660064394BADD9BB7ED95872B6DF40405B87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977893, "uuid": "71f50e4a-018a-4cf8-8385-15359d5d3d83", "value": "24576:eSgS/C0gpBl35l2BpPEOXZuB3vlcFkq6E3cnmu/m/Xw3YVmwUEJNqPGz/K0WciQa:eWgpXqZOQkgZ5EwU8w7Sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977893, "uuid": "6d37ed26-5ef2-4e66-9d7f-37c22aa22dde", "value": 1629465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977893, "uuid": "717968cf-f602-4808-ad0d-f54fa3a3f009", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977893, "uuid": "4897fe40-50dd-49a9-9315-ae602c8fddc6", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef664cd7-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978198, "uuid": "4edf4f48-76a4-4404-bb54-c56fbd04bcc0", "comment": "Malware payload (SharpHound)", "value": "0e6cb847faff3cceaea91832752d3255", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978198, "uuid": "0e1fb72c-eb5f-46c4-8ab7-0893d745bd63", "comment": "Malware payload (SharpHound)", "value": "77e5580484f460540845da3d622cc2ca8f36c95d2df83f59140ac1b0eae555d5", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978198, "uuid": "e8b246b1-a595-487c-8e58-d5c30d59c61f", "comment": "Malware payload (SharpHound)", "value": "4f6edeed0ca2236b5149f79df3e8986ee097af1f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978198, "uuid": "3c0415de-98e1-49a0-a1d6-0dd46736f590", "comment": "Malware payload (SharpHound)", "value": "1e120ed7c7ca728985897ffeffe5bfa13ca3710d44f7317e917011bdafa19dd0563e2b67774e7d3b6e4dd6d398d3a0fa", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978198, "uuid": "d9bdce3d-2e45-4013-a120-3b3d29a32484", "value": "T16E7523107A2B1A3D06BD8529743E5E2EC7B14EC7C48DE846B9BE51A71B3FB5002278DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978198, "uuid": "735ddf94-3ec6-4892-8204-4a707c63d9c2", "value": "24576:q2Ow7bHc8upE1sa4GVnDXousiJEAAYJz+b+IjUbGgg1zYBmcuHdYnZG4k0Kgzt8y:VfOpDtijo6JFMVgdoke0BGT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978198, "uuid": "315ec6d9-c93b-4af0-a7fd-c2117b5860da", "value": 1614937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978198, "uuid": "d135b40e-e349-4f27-9905-1ee8781eef7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978198, "uuid": "9cd2c729-03f3-4033-b336-3445c130a82a", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65634c4d-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989134, "uuid": "60081465-3ce4-4674-9a86-b66ac40bae4e", "comment": "Malware payload (SmartLoader)", "value": "bc5c2c29a1825b72215ab2843e8dbb0f", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989134, "uuid": "55384ed6-aca6-4470-a448-a69b792b3b18", "comment": "Malware payload (SmartLoader)", "value": "78cea79b79be76e51dcff9e133b468710a4bf81de7857d59ef1d32794a4cf841", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989134, "uuid": "e1a5c30c-4777-4c55-8ae4-c6242ee0319d", "comment": "Malware payload (SmartLoader)", "value": "2ec6330f020fefd482da8a61ecc3b03b0da5b071", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989134, "uuid": "6b063624-5076-40d6-a315-922a371b690a", "comment": "Malware payload (SmartLoader)", "value": "a4034b9401524830e1eb542ffb11efbb5ac3b51f5649760c08fec9c829808f5a3d0f00003eaec454032c3ea3cf37d986", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989134, "uuid": "99f6ba59-e7aa-41f2-9654-515d91051ad3", "value": "T1EFC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989134, "uuid": "3f088ba0-d1b8-4f22-a266-10604b48ed9b", "value": "12288:7+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byFH9I1P0QKw6FEV:7+QqldA/TSO713u7xnFH9IaQKHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989134, "uuid": "3a1935df-d75d-4e09-829d-c60754a1e9cf", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989134, "uuid": "714c1d71-160b-4da1-92a3-0dc478a139ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989134, "uuid": "0a51f5cb-698c-41c1-a84b-d82e8914fed5", "value": "jam_py_v_1.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcfe171-242a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989930, "uuid": "ef54fc9e-d2c4-463c-8083-708bbea900b2", "comment": "Malware payload (SmartLoader)", "value": "596d67a9e2a5f111a074fcdfb2c03525", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989930, "uuid": "ba886112-be4c-4a9a-a98e-ee98a5b5db1d", "comment": "Malware payload (SmartLoader)", "value": "790568a9875ce37719c50249738e282d3e5a9dbf1e37199cbe86c65ca15ad980", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989930, "uuid": "94f0ace1-be21-432c-9d5c-87c0d257703e", "comment": "Malware payload (SmartLoader)", "value": "bbcbc6dc49d2a17b01944e8f638026873b7b45f0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989930, "uuid": "ca7918d6-f7ff-4cc2-a2ae-8505a677ac81", "comment": "Malware payload (SmartLoader)", "value": "193ecb1839fe063b2780d68a882a8b32f707860da8ced7121687fef003364876b449931c3efbd6fc6d441b70b872795b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989930, "uuid": "17b06045-7da7-48cf-9913-757ac74e3e3c", "value": "T1D7B423F5AB506BCC9D20122F2F4A2BCE19274B41B403C54A1AD2875A421F6FF4E7AD9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989930, "uuid": "b8455477-f77d-45f0-b907-3a69db035621", "value": "12288:uBRdpQ73iBVYWGCwvEXgbvM0a4OTHiQIIFzuK9Gd9IUZ:uHUw2W39XgbM0azTHiQIouD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989930, "uuid": "46633dbc-b308-4dc4-9fe7-5d919d462bb0", "value": 542317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989930, "uuid": "85c216b5-cf86-4412-a3e2-d79f406ccee8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989930, "uuid": "82a253cd-fc77-44a6-b033-57f8d8e16f77", "value": "Software_3.7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a99ca1-2439-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773996330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996330, "uuid": "285431d8-7248-4e0a-b302-4655c47795aa", "comment": "Malware payload (SalatStealer)", "value": "ae89201e56e7dc1f54d7d873d6cd6bc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996330, "uuid": "93a0bc93-ceee-4912-a16b-742a3f417e98", "comment": "Malware payload (SalatStealer)", "value": "79f994387f765567940cd3a23504170bbf78c7e3bbb50f79dc590a70090ab8d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996330, "uuid": "9079b4dc-45e1-478f-93e9-e4fc668dd4c2", "comment": "Malware payload (SalatStealer)", "value": "1d39944bc5ddb8cf412fb4b2fe3ee8bb541e209e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996330, "uuid": "3a87cb75-8cb9-440c-8d17-49db8969bcc8", "comment": "Malware payload (SalatStealer)", "value": "cce4709d85c491f85dcef83f6b453dbc09f508a1ae87ea541c5494c21731705c10c966c6981bdebe683a3fb5c3b353b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996330, "uuid": "069f4f43-1257-48c6-927c-ac5b8975453f", "value": "T182F53320755E8479FA80A07495E99481A7BBB91F9CC3048FFD08C2E2FB797805B3D967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996330, "uuid": "aae0d367-3092-4b66-badb-615148396563", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996330, "uuid": "4ae65132-5730-4a1a-8585-021035a42cf0", "value": "49152:vOfpP27aWNndYeaeM5mxMkyXj3gLxbi5lLhoBlpuNLhLPnd5AtzBN6GUvmak1Wde:6lLWNdYYM4iXj9dwpuNBP6zaFmTWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773996330, "uuid": "05c73065-a623-4151-a66c-11629477d242", "value": 3595776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773996330, "uuid": "f3d94ee7-3373-4418-ba6f-be313a7e4e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996330, "uuid": "25f64d3a-e548-4aff-b097-223fca155f2d", "value": "arpattack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500d59a8-2433-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773993823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993823, "uuid": "404a8720-d6a1-4b74-a25f-90808f1dbae0", "comment": "Malware payload (Vidar)", "value": "be4032d83a4cb43055ecf79e7fc9de9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993823, "uuid": "92d9289d-2875-4aca-b117-b54bb5b75270", "comment": "Malware payload (Vidar)", "value": "79fe831995cdc284c8bdc502bad81ba6e781208f56e94aa08ead94e8c90381eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993823, "uuid": "f0ce7824-d1dc-469d-a4d7-6798c7ae1ca4", "comment": "Malware payload (Vidar)", "value": "6356822dc69359cfd9cc38a9eb64f8de341fe7d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993823, "uuid": "e869c3d7-6c00-403e-98f1-c589fed12f6e", "comment": "Malware payload (Vidar)", "value": "a4dd9fb1cc52f8e6377ad2f1b736258cd268204075c8c8755721ebf5fbd8cdfccbe14e60052b155dfb7fa6c4746320db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993823, "uuid": "9a57a45c-0c6f-434e-95a8-991cd9056ab6", "value": "T1E896F76B62A48179C26AC23EC0A2CB0096F371760737C2EB659707F95B069D5DE3E770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993823, "uuid": "58d9da42-b43b-4d3b-a7b6-9e1bd208a35f", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993823, "uuid": "ac8a67ba-9f8a-4e84-ae83-aa0446f51494", "value": "49152:mZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+92r9AqZECEWQleu7z6:mPOkz7Mn7ZdrQcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993823, "uuid": "3262f8ec-29ef-4615-a8c0-bce21f5811a5", "value": 8738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993823, "uuid": "6737e12c-e790-4214-abb7-7b204c912f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993823, "uuid": "1095c3e7-3db4-4cf1-8d91-84b6a8697bc7", "value": "79fe831995cdc284c8bdc502bad81ba6e781208f56e94aa08ead94e8c90381eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d982f54b-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040868, "uuid": "5233bff0-60ec-4d48-bb4d-5fc0579afd42", "comment": "Malware payload", "value": "420cdf47678b6c5fecc53b3dd54d4d4d", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040868, "uuid": "13212349-f28a-456f-b932-668b877ebb7a", "comment": "Malware payload", "value": "7a5e37b84367cdab39239ef5cc6403e9ec1af88422cb4f049721aae73ec20982", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040868, "uuid": "59411e76-fae8-4fa7-badc-c9adb37ce09a", "comment": "Malware payload", "value": "49018c5edd0a2606f44ff09a6fba66d80fc09ca7", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040868, "uuid": "99b419e1-8dd1-4d12-9a39-7eb486df1516", "comment": "Malware payload", "value": "d88f6651cb9f2bae7b1f54a16ff166e3b0762afd068191c1b6feafbed8396ec04c65b3c32cbc07aefbe5a28873c9e02c", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040868, "uuid": "e5363ae6-1ca0-47f3-ab16-dd97d17eb688", "value": "T16CB6D14062DD046DD6AF1E79906202324B35761A179A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040868, "uuid": "8f2b68cf-d556-483a-a05e-1b4a9aead179", "value": "196608:+PzBVBFUcwti7TQlyVN8iNISRTRmW5QC:I1HwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040868, "uuid": "1b1394cb-7da9-41aa-b578-c762eacbe6da", "value": 10954752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040868, "uuid": "a38b5118-ef34-4d50-a9ba-836aab463b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040868, "uuid": "bd517f49-2421-462a-b9c8-709832d38682", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba22a08b-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989276, "uuid": "7666a711-7157-42ba-94ad-a0fc5484d671", "comment": "Malware payload (SmartLoader)", "value": "64de61c716a156b25ebb7df67441c903", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989276, "uuid": "1a3c1208-a553-47f6-8975-196b5209d3cc", "comment": "Malware payload (SmartLoader)", "value": "7b6f11774b08aa4931d3398701d459c9ddfd0293f840e749fd89371af2da3ae7", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989276, "uuid": "4214b29b-a687-4340-b77c-5c204793ed1d", "comment": "Malware payload (SmartLoader)", "value": "e653d61b9a69cf9a3bb24d4ea4996fa8dd4af0dc", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989276, "uuid": "ad999e2d-3810-4193-ba2a-75466acc5a72", "comment": "Malware payload (SmartLoader)", "value": "a9c55985ca4b6e342e405b033c1a82fcbc4380f4ccd8fa429447f738fb9b7ab282563dc8fccfa9bc20f59dfe5ea3d946", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989276, "uuid": "03c8731c-6ba0-478a-b649-6a1260247bf0", "value": "T1C4C4238BA3FE845390BF1F58AA57B48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989276, "uuid": "464de23f-5715-4e77-907f-396c4bc92cd7", "value": "12288:H+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bykH9I1P0QKw6FEe:H+QqldA/TSO713u7xnkH9IaQKHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989276, "uuid": "8437d290-4114-4737-ae5a-5bcf2c9bb3df", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989276, "uuid": "8c24fd42-7575-433b-b54c-53a0ca6625f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989276, "uuid": "388acf32-5037-49c4-9a5a-8b071599ec4e", "value": "Extension_Assembly_PI_VS_2.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5630ceae-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047090, "uuid": "23f5b3db-c8e6-494e-bd52-a11932a6c572", "comment": "Malware payload", "value": "3fc3c623c7c16eeb01dff0cf07c6b732", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047090, "uuid": "d61465c4-1a3f-42c0-aa52-5b6a20106160", "comment": "Malware payload", "value": "7c3b75a4525dee64eb1e3605bbac9d78321a6bbbbeb780eb09d87f14bb0d7764", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047090, "uuid": "e376e729-d596-4d04-af40-fc62bfa7fb3b", "comment": "Malware payload", "value": "62750679a2527d67c86e68ec2f0596a1a05704cf", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047090, "uuid": "1ee52e66-4f1d-4cfe-aec4-5797b1fcf4d3", "comment": "Malware payload", "value": "119c7057e3691b6761fbef54c16a82e5563bc767dd8261e358b11ea2d53dc22acfb3cd0f1401a4db09778cda64b41c98", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047090, "uuid": "cef4d63e-f704-4237-9d89-72d2dd28af4d", "value": "T13275122853F89A56D7AF1F7DA03052584BBA660BFDAEEF5D694CB4ED1893300D520233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047090, "uuid": "13cafcf6-86cd-47fd-916b-910475c653ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047090, "uuid": "a8331be0-6923-4862-b1f0-2a225c47c34d", "value": "24576:nWLIGEDwgrRvNuXoVIa0xdBSWmPstYX3foVSVC1WuPdkoZ1g/28DDghy1pBN94T8:n5zRvNExdBSWmPDXvo6C1zVX1K2yDghl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047090, "uuid": "0f903678-9b1c-48f8-82d0-c866e64f8495", "value": 1556992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047090, "uuid": "4a1c978f-89ed-4c0e-97dd-ff84aafc3f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047090, "uuid": "c76641cf-0d73-4194-8a5e-0fd4151a4cc4", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b5bf74-246c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774018575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018575, "uuid": "d9ae6d57-1bce-4442-bab1-b460c92d45bc", "comment": "Malware payload (Mirai)", "value": "f3f2fc22dd82463f9e4b76e613d82eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018575, "uuid": "b36c7274-40cc-48cf-ae8e-ce4d4fa075ab", "comment": "Malware payload (Mirai)", "value": "7c4970bcfa5e69e3056b3e8bb4d199a529e1591afbd45e41db3c809085a8f620", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018575, "uuid": "e429f183-17b3-443b-94ad-e61d437b7f2e", "comment": "Malware payload (Mirai)", "value": "c7e8e9ad33eb2b688b8181895bba00ee5d1973f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018575, "uuid": "e03ef42b-0497-4a13-ba2c-98b59dd65270", "comment": "Malware payload (Mirai)", "value": "5aedee96df890db6ab478fce4d42eb68c00a8e2c21663cc715512406d33d752a1f94d1470b731dd3ebab6a6a6151efff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018575, "uuid": "4d5c98e2-6677-4efe-abc0-a6f3149644cc", "value": "T124A31905730C0947D2633EF43B3F67E193EF9A9121E4F644294FAA899271E325586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018575, "uuid": "bcdebc6f-36c0-4acd-b984-c6af1cef30d9", "value": "1536:DLRN5A4rhT4HGwuB0EUEyxbuyeP1DIVUWnLyXebpijFd2CvA0xPi6UZuuHqQegu:DLRk+J4lEyxbeDpzewjFo7KYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018575, "uuid": "ce5389b3-aff0-4df0-95d1-93a47d83a975", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018575, "uuid": "01175c8f-9c6d-4038-861d-28d748525354", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018575, "uuid": "c37e52ed-45f8-4094-a3dd-daa668eeee1b", "value": "e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d925886e-2480-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774027124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774027124, "uuid": "fc7fc397-d4ca-4e5b-a66e-7ccb454afc71", "comment": "Malware payload", "value": "061c7104cf527d15704e47177b95e1ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774027124, "uuid": "20eb905e-9042-4d93-aa82-6d79c5d3b383", "comment": "Malware payload", "value": "7c9279815946443e6414dc671ebeab5bcb9b31a141d1619af156dc0b7bbf89b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774027124, "uuid": "90944604-fa5f-4e1e-9bd9-783e34a82c68", "comment": "Malware payload", "value": "dd87c29052fdbd4f1d056be9e48a37176c4202a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774027124, "uuid": "69ed71e5-6a85-4550-a5b4-a991a45fa2a9", "comment": "Malware payload", "value": "6ad2dd6e3a1ac90e81eb3581d56a32f298c3ad7da23b92f054cdbaaf4a3ca03a78e9a7897087b1d37954dad660be55a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774027124, "uuid": "6c8bf70f-bc09-478b-89cf-7987ce3920a2", "value": "T17396296B2254B2ECC5ADB13AC0938A0CB8F371751F33F2E75154F3654AC29C65E3A662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774027124, "uuid": "949949dd-e243-4c83-b6ac-fa7a1332f698", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774027124, "uuid": "fcf77714-f82d-4f47-8fca-e9b6fd9096af", "value": "49152:OEC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0PpZ/MiAyfd/Pyjlqd7:+YCp2Jk/dfdYqPAQChpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774027124, "uuid": "e419ec8c-1fb4-4414-b638-2bd4791634c0", "value": 8629248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774027124, "uuid": "8aef8c04-9f36-4539-a99b-917d3cc1a364", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774027124, "uuid": "b943f7b6-62a4-4cce-aa58-c14d6db36394", "value": "SecuriteInfo.com.Win64.Evo-gen.25595265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c6ce2e-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050412, "uuid": "c199576f-175a-435e-9687-f8cf430cebe6", "comment": "Malware payload", "value": "44ecde80f2e01c312eb164fdc894ea12", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050412, "uuid": "c7f287fb-d3aa-47ac-a88b-8b9cf86c4f58", "comment": "Malware payload", "value": "7d088f6e7d2f578ab211092502edc4396558960262deca60715ab99657003577", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050412, "uuid": "9aeacb6e-af63-4fbc-8840-4b221bd91560", "comment": "Malware payload", "value": "82b2be831c27e9c5242446c438d35bd920588949", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050412, "uuid": "77880975-a2f7-48c2-8ad1-0c4fac29586c", "comment": "Malware payload", "value": "84bd324ebc5cfc8da36a4fe8db55e37cde15333dc42afa5a83faab9c6144b620f93925ccfb72f240af35341ad4c5d364", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050412, "uuid": "801c1392-8a0e-4a5a-af80-ec3a0fdb0a0c", "value": "T1A5D63A13EC5541E9C1AED530CA629262BB717C499B3033E76F60F7242F76BD0A6BA740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050412, "uuid": "2c589c8f-944b-49c9-bfce-fb7e682fa577", "value": "98304:50bnq5deB8OdWLcLb9GGnvGBlQNIxHz+KyAWi0SpcMrJeaoEH:5gwbLcP9GevGByIxT+KHlBxeaBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050412, "uuid": "e050018f-4498-4b26-bcc7-1b0ce0b08f25", "value": 13181220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050412, "uuid": "44350fe1-d9bd-4cfe-8715-93d8a774e907", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050412, "uuid": "222f1216-c291-4640-ac8b-a980f4e79e6a", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb44cf34-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046830, "uuid": "46f1b1ee-232b-49f9-9154-2d556620e2cb", "comment": "Malware payload", "value": "3a9549655321028ad88de20a069f92e7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046830, "uuid": "1c01b36f-3c04-489a-b06f-76ec85d58655", "comment": "Malware payload", "value": "7d93e0c67a840955a9e7603afb0c4c6ddc0124cc271457550b48b45caccfefe0", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046830, "uuid": "3e0e8c4b-6c3f-45e9-bfb2-92ac7be40346", "comment": "Malware payload", "value": "d1a45a3a3425b30d73747ec5e5ee9745c52b9acb", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046830, "uuid": "504c1d84-8e50-4c59-acc2-8effb48af06d", "comment": "Malware payload", "value": "1f50889d5b4bf2f4f7d81121d76246d1e31b56788e31cf5ddcefb5b41747b7aabd51883de3bbf2767744d94ac2d8f9ff", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046830, "uuid": "4acd695a-ef35-4aab-815b-28fe4fcfd35a", "value": "T1277533209F239DBD0F74C33820AEBE99DB141A53949EC2EBB9AD11E92733D414593C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046830, "uuid": "b53660e7-e803-4416-aaac-ee253150ba64", "value": "24576:7QMXyDm2ynwAs6+CDpiGNjnAqiQfIdjsNnIhDaZx8LOAxu+DVkyAoX4EBPzJA8aO:7QYxd6jsRbxq6yAoIyRMOQjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046830, "uuid": "bd5bd2a8-c1b1-4c77-9f82-e13a5e8685bc", "value": 1580041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046830, "uuid": "1de5d7c8-1bc6-42f0-8419-8789bbcc292e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046830, "uuid": "d28352d9-02b9-41a8-bdfd-563769d013cc", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c5f1e7-24b2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774048533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774048533, "uuid": "4706d507-3fa0-4894-a219-7b18b2484b67", "comment": "Malware payload", "value": "c671005d5576a0dba7faf6b291fd53b2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774048533, "uuid": "124d7aa9-72b8-4182-994d-5dfd373c63aa", "comment": "Malware payload", "value": "7da0c5c21653bcb2e37a9862079ac57f86d0027ed7841b3d6e91bcfbaaefd8fe", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774048533, "uuid": "5af481ea-f29c-4989-b2a5-8c21f50e5ecd", "comment": "Malware payload", "value": "34e27871ac26293e51a1167ec36e4ea946b91aec", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774048533, "uuid": "eb027a33-43e3-41fd-bf16-ec011e3e9ecb", "comment": "Malware payload", "value": "0437b8f5a74be563187c472e0fe66b2d6f4214a24b2043032c5eba423042031e4fca64bc72339a5254d5b97ce0c52c3a", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774048533, "uuid": "ef1c4c6c-873b-4860-bd6e-dc1ac4b5dd13", "value": "T1AFC56B217586C032D56F0370DA29C7FA46796E60FB7384D763E8BE2E3EB19C14231A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774048533, "uuid": "fa45cddc-5a3f-4d0c-89b5-8b9d9af2aade", "value": "49152:k54vLNgmUESIEjPMN2lv+oBUYyqYaZrf5jSTUialNMV3eVougT9AFJrMf+7UVZDM:C4veHjPMNaQYpjSTBuMV39rAXq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774048533, "uuid": "3d9b03c5-8231-44ca-994d-5dd06efe6b84", "value": 2622976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774048533, "uuid": "a2148784-0308-43fc-be4c-e7b6863538e1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774048533, "uuid": "3a6b4bef-1978-4133-880a-8cb13db6ef18", "value": "error.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35978aa-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050307, "uuid": "a9c724fe-0ddd-406f-a783-bf37623895ee", "comment": "Malware payload", "value": "a63b851635c723ba34db3d2c5ec3a17e", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050307, "uuid": "06d702d2-3a89-4ad6-98db-f3afe1642839", "comment": "Malware payload", "value": "7e7f6ecbebb85e380aec00fd5a353d960d0f6cf21ea3541d5039980b60737a75", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050307, "uuid": "be11d824-dc75-4948-88f9-172cefe35812", "comment": "Malware payload", "value": "9e65614bd487caaab41ae7a5dc26390be9913b5c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050307, "uuid": "f133d5c3-7e0e-4df3-a0a8-54df3ef82727", "comment": "Malware payload", "value": "65372bf7dee2190e2ff3ee9f2218756f4f40ed9c48b6ef92d623ff828956109077b4db3886ea0626ef12351b44ddb9cd", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050307, "uuid": "c5a87a16-79d7-42cc-8518-2445a5d4e611", "value": "T136D63A03EC6541E8C1AED634CA629262BB717C495B3037D76F60F7242F76BD06ABA740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050307, "uuid": "0cc84a8d-6440-4b0c-9250-0a27d621cc05", "value": "98304:19xdkJDtkRNFdoYCzc/ADW5AG/XX8luxCdlsiJQB0t8pcqr13+Z9iE9:1B8MoY4c/ADQAG/XQuxeGiuyyRuZ9v9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050307, "uuid": "440b3474-e5b6-4553-bb7b-f8b51a1c3986", "value": 13181220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050307, "uuid": "bae58b56-ff83-4e89-a4b1-7d2f94022dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050307, "uuid": "c4e2e71c-994c-4301-82cd-f146d6536cae", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806cf56e-245d-11f1-a769-42010a9c0008", "comment": "Malware payload (HijackLoader)", "timestamp": 1774011943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011943, "uuid": "98c72e89-45ed-43be-8bff-14333f967663", "comment": "Malware payload (HijackLoader)", "value": "dd0f0ba2c1c3a7032aa3ecb98135c9ad", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011943, "uuid": "0117d2a9-0d1c-465a-80fc-22b2581c3c4f", "comment": "Malware payload (HijackLoader)", "value": "7e9171fa04a9019727f31dfb23e735cfc63daf01788cfaeb809705e926173ac4", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011943, "uuid": "5837549a-6d82-4ec5-b50b-f26a1657870f", "comment": "Malware payload (HijackLoader)", "value": "1bc130fccdd2d6387aa6cc840049b91860ca7969", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011943, "uuid": "446c8932-e649-44f7-a7cc-20ee3c015a0d", "comment": "Malware payload (HijackLoader)", "value": "26f10074f99833fbdd6a08e296371adc5fbf5fc4b3c7ea7c89c85f1707c23a8a4cfa3e6cff67f59c5e42de6bb436e910", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "fix-bkg-com", "colour": "#66E306", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011943, "uuid": "52d21138-419f-4ba4-a64b-497ec8b15b60", "value": "T19292A61A7D05D13868F2173A9987A148F96B416B421749107AFC81C83F7066FCBE9FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011943, "uuid": "0b651e58-385b-4156-a8f0-41e77d895487", "value": "384:8DkzDmXLEN80Wuabs9Y3p+mOxpOso4PfLLkV:eXLE60Wxb7+Jxp7o4HLLkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774011943, "uuid": "3b5dba78-5625-4825-b838-859655f68494", "value": 20263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774011943, "uuid": "cb89d8e8-6d9d-42c9-b649-aeb1c8267091", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011943, "uuid": "7d755e8a-e411-49a1-b6aa-ea6e86bf2e29", "value": "fix-bkg.com.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddb050f-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046969, "uuid": "8e86b955-3e1a-4f75-9142-8e6a81eeea55", "comment": "Malware payload", "value": "63e214f01f386b9ce384c660c927bd33", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046969, "uuid": "f688b4fb-9d6e-4fbd-962f-b06ade35f951", "comment": "Malware payload", "value": "7f9350c5432ac9bcd75a172558a87722bebb95dcd28131edf868ded9c28df602", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046969, "uuid": "5883c579-fc56-42b4-9813-0a97139487f2", "comment": "Malware payload", "value": "0e295b82a056821b14c0574d700069818c3b40ba", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046969, "uuid": "96300d9c-da78-4b38-9d79-b5c705f7f865", "comment": "Malware payload", "value": "eafeb270a55962d08ebfa1d75ccc8d93873e862bfeec0166e87e419a2dcf0d005b26bd78c35a4d6736ff319f5d8f93b6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046969, "uuid": "3ba1287b-303e-4f63-9f97-32509916d6b4", "value": "T11F753330AF4259BE0FF44165215F3F2CCE514B63204883E772ED60DAABA6F685943D6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046969, "uuid": "4b6d0a15-8cc1-47cc-8fc1-28d88cf2b2b9", "value": "24576:026Ti7cC1urBvEXk8sjA4SC2psZNv+/ZYkS3sBXSC2d1oUJ8vbaqwrAniV5Vmk5a:7n1OJO+Ji+ows0rAiISRoVWSIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046969, "uuid": "8edc7c98-5de1-499d-ac78-534520e738d5", "value": 1568465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046969, "uuid": "edfcae24-ed15-497f-bb12-e6d2d8c0d8a9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046969, "uuid": "b99951de-4872-4f55-9749-f67108211fef", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c8862f7-24a4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774042403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042403, "uuid": "ff304c7b-784f-4b40-b02f-7ec9c44f7021", "comment": "Malware payload", "value": "fc8d1e8c57b7f7c09efd1d857561c64f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042403, "uuid": "95fdb7ea-1366-4580-931d-540840628ccf", "comment": "Malware payload", "value": "80c16135a33e213bfa1cb8bb6cdbfdec0a654ba143b9377b7372f851a4841e1e", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042403, "uuid": "8af345fb-6467-46f8-93fe-cb62c4cf432d", "comment": "Malware payload", "value": "4611bc14acee1976fd5e0a4f37f8b6e812370f38", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042403, "uuid": "2f670c17-7da9-4510-9fef-1663973abc78", "comment": "Malware payload", "value": "56a2424446879555feb2d70693abd65d8f54bbc4b11689db18d0003b851c0de726f464173a6c8378b70ddcb0ccd28769", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042403, "uuid": "43ca259c-25bd-45e1-9654-3a8d3ef4742e", "value": "T1B0B56B37FCA315F9D4AAA2318933A1517A607C442F2153CB2A90F7782FB3BD49A79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042403, "uuid": "a04095fa-ab6d-42ea-bb10-cc543c505f73", "value": "3271ee162568f50a6810be9b8973807f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042403, "uuid": "a97240bc-3ae2-48f1-bca8-38603a19bae6", "value": "24576:NyYy0v3XKmyhBY4cF5Y2M5O+zOUpLEc0Zj904Qq+FD1k5V8ciD/QvUSgvjAcb+jr:Nyv0PKFhSl7Y4OLp10ZjakIQc3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042403, "uuid": "395e7e6b-c6ab-4819-b868-48c1db110e45", "value": 2433536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042403, "uuid": "5fd0f157-ad4e-4a47-a77d-071f4e4b32ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042403, "uuid": "84cd9084-78cb-43d9-84b8-7e1b5f4c7315", "value": "20260320_212147_loc4sat_distributednetwork_in_net_80c16135a3.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064be13d-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977807, "uuid": "b818cc9a-71ef-46fb-be3a-42956f5ab48f", "comment": "Malware payload (SharpHound)", "value": "01461cd9bb5993346c13e98c8409e596", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977807, "uuid": "1a3ebae2-1f60-4d5f-86b8-4a2f6e8e51e5", "comment": "Malware payload (SharpHound)", "value": "812be86914609ee61c9a8151555194ba4b79905e6de1bd161345e09f3f0b6e18", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977807, "uuid": "96e75466-9eea-4b52-88d1-a61e41741fda", "comment": "Malware payload (SharpHound)", "value": "54403ce48091097efe37b361badb9171ec5f31bd", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977807, "uuid": "7f0516a0-68d5-436d-83b5-11edc781169a", "comment": "Malware payload (SharpHound)", "value": "2d2394be1415a7965966357a48a635549fa476ecc143e71e1f1b223066ab8fdb9dfd90fb609c6fa94282c89f9be1f618", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977807, "uuid": "041a9deb-408b-477b-baed-7b1b034b5af0", "value": "T19C55125847F847A5F7AF0BF8A46281558BBA762BEA2DEB4D5D0CF4E91C92355C800333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977807, "uuid": "04a5e7f7-2b08-41c0-a196-40f4a087083a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977807, "uuid": "7d77dcf5-3e81-43bf-a84d-0304d4577be9", "value": "24576:e5quLIGEDwgrRvNuXoVIa09WmPstYX3rTbDcskong/iN9WCc:e6zRvNE9WmPDXbXQsFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977807, "uuid": "ba8bd596-7dae-4d99-a69d-c8bc861829e9", "value": 1341440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977807, "uuid": "7227dc5b-0a63-474e-b628-2e787b8be017", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977807, "uuid": "22f1d331-6a7a-405e-84dc-e95083a03294", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d022ee-2431-11f1-a769-42010a9c0008", "comment": "Malware payload (RustyStealer)", "timestamp": 1773993024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993024, "uuid": "f1f4a345-964e-4804-85ce-2848ecf05707", "comment": "Malware payload (RustyStealer)", "value": "c9e1f8b2d3e61bbda7d514a38f668c72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993024, "uuid": "9e6fc867-6e5d-402a-a136-8bb00f85e208", "comment": "Malware payload (RustyStealer)", "value": "812d2d8436985fc8531315970b2af6bcdd697f9033bc12841ce467e6fda94408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993024, "uuid": "ee1b9de6-fdf3-4e49-9726-99a805f81d5d", "comment": "Malware payload (RustyStealer)", "value": "ba88ed97c2cdc2397b2c3eedd7b33c922adf3cfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993024, "uuid": "a506c01c-ce72-461e-9233-5aa6ecc5cbfa", "comment": "Malware payload (RustyStealer)", "value": "aea005b1053ad1a6929252ce7e2daf748f7c3f9fa93381b60622ca359278ca3e7bbfb96fa7600b3dd3c7ed0e7a74e98b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993024, "uuid": "ec08394c-7f2a-47c5-9cf7-eb002db79b59", "value": "T14AF4122FB64DA0BED61AC074D3054563AA79B0DB1B32A9FF03E455342E6E5E52E3CB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993024, "uuid": "e7e4fc62-d15e-4f1e-848c-e292fac2b48b", "value": "032e2315c299adfc48c19ddbfb305f58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993024, "uuid": "31ba5211-689f-4b1a-9f83-922be37b6aef", "value": "12288:eSHgWvLrHUVFGN6pe0tDb0/PGkvKEI87lHshIK2KZSwbh+04t+NAD9IwPCDJVyKr:eug6UVFGT0tDbevdlHshITKZ3V+0Q5PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993024, "uuid": "e2f91d6b-4121-4779-908e-87e1cc1d7c8e", "value": 774656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993024, "uuid": "ff058aa9-cae8-4a86-a583-1183193b0a14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993024, "uuid": "d659b39b-2e51-439f-9f42-5baae86a153e", "value": "812d2d8436985fc8531315970b2af6bcdd697f9033bc12841ce467e6fda94408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfe15e4-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989145, "uuid": "e640b5e8-e6e5-4b14-a739-65d743c11e42", "comment": "Malware payload (SmartLoader)", "value": "701dd195b1b842df7d3cfc5ef02ce8c5", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989145, "uuid": "02a5cac1-fd49-40ed-9f9f-bfb97152f0bb", "comment": "Malware payload (SmartLoader)", "value": "816f338de549c788584c87d2c5e62d7f121e4609541273008edb538c97a8e490", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989145, "uuid": "b1467f92-3b44-4fd1-b54a-19da0971687e", "comment": "Malware payload (SmartLoader)", "value": "55c76aed7bcdfb64387f070f96956478b62ff14e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989145, "uuid": "558cc9dc-9503-48fe-906b-f68ed76f20eb", "comment": "Malware payload (SmartLoader)", "value": "82b0913197f553f67e46ca5c508c476be8ff577e5c29d627975f40339802882991396da7f23a962309c0f7c506e301ba", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989145, "uuid": "f40713f4-75d5-4908-a7d2-8e022cc5b347", "value": "T1C6C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989145, "uuid": "23948adb-b041-468a-9195-96c62efc73dc", "value": "12288:b+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2bybH9I1P0QKw6FEb:b+QqldA/TSO713u7xnbH9IaQKH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989145, "uuid": "c3912fee-24a2-48d1-b6e5-2f617d4de481", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989145, "uuid": "1b92ce0f-1f0e-4a72-b3c0-ec638064cd79", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989145, "uuid": "554b44d9-1133-48df-aee5-957ef2a13e1c", "value": "Software_2.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb26b21-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040926, "uuid": "85c3ab72-e7d7-4993-99dc-0babce64509b", "comment": "Malware payload", "value": "072d95cca050951f4dfeccb0a761218d", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040926, "uuid": "e745f8b7-4e5d-450b-bdad-792b5af1d01a", "comment": "Malware payload", "value": "81af84556b21041e1331485972ae6cb4c55d29d3a024014a57f29be4997bff66", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040926, "uuid": "1e6b67a6-8eb3-4260-85ec-24c1fe7b023b", "comment": "Malware payload", "value": "e7ea42f8c14f092d59a3d1a0dfded8233fbf8523", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040926, "uuid": "8e6b0746-3249-47cd-a53b-040cb65e77f3", "comment": "Malware payload", "value": "910f2c2fc1973850a55d23d7eb8921b34b74302f53ef2e0552267debe6010280e2f87a99be42453f1559092118500827", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040926, "uuid": "879efffc-5809-492a-9a4e-eea5cd3f4111", "value": "T1B625FA5C740CEFB25025C97C1C950E7D19A3AF1F2665182870ECB61C7FECCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040926, "uuid": "789edfb2-c08e-4544-9df0-79fd1d86296e", "value": "6144:hYcVs9yyGsyGmyG8yGWFqxy0jyGDyGQyG/yGSyGcyGAyG9ytey0HyGu2fU9HpGUt:jMsihTiCbA3n+LT5YDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040926, "uuid": "441b35af-2e35-459e-83d2-882ef4428a21", "value": 1005683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040926, "uuid": "ddd1194d-f12d-48d3-b931-38f7c4473117", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040926, "uuid": "673711e1-326b-419a-af3c-051b6eb7c393", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b308c8-2432-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1773993456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993456, "uuid": "c900f229-db49-41ed-b67d-885dc1bfab8d", "comment": "Malware payload (SantaStealer)", "value": "0da4ae48e2b47f62957a3c677bed80a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993456, "uuid": "453ec817-60c5-4545-aa1e-53cfc5b2c871", "comment": "Malware payload (SantaStealer)", "value": "825403678f778a98132341bfbac1c3c0da1ec2cc1ea1d637a253c2511c008022", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993456, "uuid": "7d0e0683-adb6-477e-916d-027b602971e5", "comment": "Malware payload (SantaStealer)", "value": "c28bc3bcf9dd0352f84e18b9114f0c8bba2bd9f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993456, "uuid": "36b6e67c-54fa-422c-b86b-a056109c6117", "comment": "Malware payload (SantaStealer)", "value": "7bf1cc267f1d8119b677238d55ffd1a9d36cadb93b6848c92ac0bdbfb16672ed71bcabd56d7c0e100de1a6d943e8d2a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993456, "uuid": "f9bae3ca-828b-45bb-8a67-053e7e3c29a2", "value": "T154267C47E19223ECC46AC1FCC3D7A232B6357C454524ADBB5170F6312F72E9C6A69E28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993456, "uuid": "9f99f67e-ddb1-47bd-a648-975dad2b8b5a", "value": "7af6699601abfecbe02cff5c7eb40506", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993456, "uuid": "93d2ec50-eb49-4b76-b5bc-f375a19afaee", "value": "98304:k6zcwgyzXje8kDSpOG7ZE78AGZA+0kvh:k2TgaOG7ZE78BW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993456, "uuid": "2ad585e2-2231-4463-85d1-c1ebbd0e7df9", "value": 4533248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993456, "uuid": "75b0edee-0620-407c-9790-32eabf20dc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993456, "uuid": "90c019c6-47db-4f75-9f08-39c8f7b32f23", "value": "4Ma9Ksk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfb4de0-2425-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773988017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988017, "uuid": "15cc4542-9dd8-41a8-ac75-de0729bac7e3", "comment": "Malware payload (Mirai)", "value": "91e42ffd877e35670b9a66d860e32444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988017, "uuid": "f678e7e4-1e83-47c7-a4a7-1ff832acc5d5", "comment": "Malware payload (Mirai)", "value": "8312e003c5507e87176ec819f9e08bba43bce3647ce19f21e842d744f5643e1f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988017, "uuid": "1ee0143f-6388-4b9b-92a9-6d8e44d04941", "comment": "Malware payload (Mirai)", "value": "d35f75aa35a6801d386d2bcb7530951c0ffeb5b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988017, "uuid": "71dd83d3-11c9-43f4-9f58-b5704197b756", "comment": "Malware payload (Mirai)", "value": "48f59cf676fc1c730c4e9f66cd4500617943a56e2a1872f58b903b9c89ae8c0b34b17c2f72cfb0d93172a9d6ae514338", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988017, "uuid": "000e1e9e-28c1-4e3e-ba09-9b843f002cad", "value": "T1B063027415C14940E807FF3A0F0DD6D6283C7A6EDA1A135204E62AE32BFC156FF588A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988017, "uuid": "fd833717-267b-4f9a-adc2-10a0d3c519a9", "value": "1536:ZfQlGKrby9b1ow9pH2y2A42Twj8aJfpbGgBcEuob8LU0mSWGh4q1QYITza20:el/Zw52A42ToJx6gBcZ9pmXGh1QYISz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988017, "uuid": "263dce87-edc1-46d3-ba23-bdb8b0fed4f7", "value": 69592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988017, "uuid": "23376a74-6d0a-45c4-a3e3-2882343b38c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988017, "uuid": "95220826-60af-43f8-afa4-1d425d872327", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0162f773-24a3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041794, "uuid": "291d6f83-93c8-4af7-9537-91379959d43a", "comment": "Malware payload", "value": "ac1cb4d9e06461266b14f06976a677a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041794, "uuid": "dde2ce34-9a07-435a-a4fc-1e36d618c1d7", "comment": "Malware payload", "value": "83182b60e42c3e5d1cbf82336fd6176a73807de47804ed531b0ab4277535f9f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041794, "uuid": "1b5265ff-c5da-45d1-ba01-a5c17ba19a1d", "comment": "Malware payload", "value": "6c18715969e630199f7764671e7d061f54fb635a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041794, "uuid": "98510bcc-c330-4769-96aa-a8925351e5ed", "comment": "Malware payload", "value": "3bf6e812a165607e0d96fece0473cf3a614432e571e6d723706b9b3a503e482654219eaa98dfeea39a6a5d352ac52898", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041794, "uuid": "024bd236-d5d2-4cd9-996b-99005599f59e", "value": "T13C53F226870091A4E2AD68F556C541942D704ED396CED8AA3CC5D601DE083BFF8D7FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041794, "uuid": "e9252fe8-ea90-484f-8fd9-d4316b5211cd", "value": "1536:YmBYqJ0rAqbk7NApNzgkKiwxFIMIIaQ+FxzW50VSK:Ypo0E+mKskKPxFXwi50Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041794, "uuid": "97a3b4c6-4e9d-4514-9b1c-5fa2fa9bd546", "value": 65732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041794, "uuid": "eeb6abb3-f918-4c4b-ac3a-36e339239f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041794, "uuid": "cc1463b9-2a3d-41d2-9531-a21a7fca39b9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0893b425-2428-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773988978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988978, "uuid": "6c74d170-bf1e-4702-b79f-30f95ffec636", "comment": "Malware payload", "value": "885d9c3abb99b5d1d7ba01bcc5fe3ced", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988978, "uuid": "e8bdfcb3-144a-4a56-87cb-562d4805cfac", "comment": "Malware payload", "value": "83b6f16ae2cd155f04717859c7b37605d1c1e14015de7a1c70f64e009dadea26", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988978, "uuid": "f45b88eb-b31e-4356-880f-49c4c97df4d4", "comment": "Malware payload", "value": "801e67b106970a8e18deb54a4a0093f4627dca3b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988978, "uuid": "d6218c4d-ee67-4e1a-a932-a36ccee9f7f4", "comment": "Malware payload", "value": "08a770282f9efcb030ab6268ff3889c6d223614f83ec1c38ffb13968488caf8156acf9753419d99d204d5c8caf2fd806", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988978, "uuid": "c7f83038-40af-4c80-bebe-d028cccf0434", "value": "T191925DB512896C79FBD0DE399F3C7F4DADE4C2C42124A3ACBA0F39215A1166DC70534A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988978, "uuid": "376ff47b-024d-40b3-bd89-5e4769162d38", "value": "384:LEFcuQpWx+BL0SWL0guzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:LEF8i+BL0SI0JzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988978, "uuid": "5dae0674-ed84-4c09-9220-ac1564cd7ef0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988978, "uuid": "93ed5c3f-8e83-4c2d-939a-444c9294f4e5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988978, "uuid": "04cdd170-2e90-45ae-b4dc-9abdd06a78f9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d99acb8-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (NetWire)", "timestamp": 1773989550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989550, "uuid": "5190c540-3b83-46cd-9b44-d6693fe19c9b", "comment": "Malware payload (NetWire)", "value": "1b513369a7453682ff6ca6f644b62580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989550, "uuid": "9b68c168-ae0f-4ddb-95c6-fb2cf69ce9f2", "comment": "Malware payload (NetWire)", "value": "848646e0d2c1752870258bf7cea0ce5651a7ca38e1901f83c9f4f07044ea4d46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989550, "uuid": "ad536206-1f56-4abb-8071-cc1b6c2f8fe0", "comment": "Malware payload (NetWire)", "value": "e02095b8bf99d29dbbe6488f9b0646b4509694e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989550, "uuid": "2eef484f-fc69-4402-8199-9249065fcb64", "comment": "Malware payload (NetWire)", "value": "e21b4f4524dd51502834d3dce14e9cd424cc8eb62e30f0282fe190412cd9b1c53fe01e2086614f32a21503f8d2618ce7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989550, "uuid": "a888ffef-5100-4cbe-9803-6eff7830c8a0", "value": "T14165BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989550, "uuid": "b86222fc-186f-41a8-8539-9119123fbed9", "value": "dcbf4f6f0a66c4ef804fdb68720c8682", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989550, "uuid": "529696f8-1ab6-4ddc-a376-766101d68072", "value": "24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYt:ho0c++OCokGs7Adgrd1f26RNYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989550, "uuid": "08ded6dd-99ae-4022-ac58-9e38a2272865", "value": 1461042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989550, "uuid": "e3e1800d-bd22-4bf5-807c-a118cbb16840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989550, "uuid": "9ff9ca7f-298f-4051-b90a-691474a9c7aa", "value": "57aq86p0g.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39398a40-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047042, "uuid": "7dd19913-5164-49fb-8dab-e90eb4a566f4", "comment": "Malware payload", "value": "b04002e6987f8f72ed6b6ef49ef66be6", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047042, "uuid": "d97df655-b487-4c67-abb3-a9df68c541d6", "comment": "Malware payload", "value": "84aa1c1d1ebdd4c469bcd56088ff28841eef807b7a5c4c3721c48730f2ce30f9", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047042, "uuid": "63859ea4-4ef9-4711-8918-f17643652f0e", "comment": "Malware payload", "value": "66de668653abeda388bc60fac9c6084d6e0a9605", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047042, "uuid": "5cec34f4-a1ed-4d5c-b19c-793d157a0718", "comment": "Malware payload", "value": "ebb01e01bc13208fc689b80e7e7006ad882e343cd70e3f360ddb222e983a5014e73499d9d918574e52995e7c93e4b299", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047042, "uuid": "54660bb3-75e2-49c3-8e5c-6cc355547934", "value": "T1A875121913F88BA6E7BF0FB8D021515887BA761BFE5DEB8E994CF0DD14827159920233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047042, "uuid": "8ce4c7e1-7aef-4a27-9316-2d3d0f041d51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047042, "uuid": "64938b66-b045-4bc1-ade4-5e7a765f0a32", "value": "49152:JzRvNExdBSWmPDXUeNuM7cX1K2yDghMP4T4KNx:Jz1qCWuDXUouMI1K2EP4Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047042, "uuid": "db9ede08-f126-48cb-bac6-92c0eb0002d4", "value": 1575424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047042, "uuid": "fd65a2af-e2ab-40fb-8b70-297232eb9946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047042, "uuid": "012a728f-9a7f-449c-9cdd-c43f87ebf797", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471f21e8-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047065, "uuid": "a454b9ba-b2cb-4126-8574-e53fa3fa2a95", "comment": "Malware payload", "value": "596347512b0246defdb250909ce3a30c", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047065, "uuid": "c06566dc-d8ef-4cfa-89d5-f4fd756100fb", "comment": "Malware payload", "value": "858f76a2b07d550e7ad434d936eb3c4ef67bc79d897ba131f78ae8db915cdd18", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047065, "uuid": "80b5633f-713b-44b3-86a0-e05885bf11da", "comment": "Malware payload", "value": "d7e2e486edc417763c557c40d25f65cc42c61a30", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047065, "uuid": "06e58d8d-4717-4073-b888-0dc3b01c9c30", "comment": "Malware payload", "value": "14d2d492e912261020e6fd820d271fdaa6ea30fac1102b75abb5ed8b26fea088f10566026dbc2d5909148ba0783cc77e", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047065, "uuid": "9ca261da-65c2-43a5-af1e-dcd4631a536a", "value": "T13D9533546E2B5EBF4FBC4438407B3D0CDA916AE2006CC09A77DE15867B76F86418FC66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047065, "uuid": "39520733-9344-41e4-b5db-47f322d2b9cc", "value": "24576:Xe4/853m9hnNwhpM4E41I3+KC0bgcyfGlJySzRODjSA4YJg8Zr5BoF/OqQzXQSlY:uH383whpM4s87VqCa/1iQSdbBYoAGtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047065, "uuid": "f4dbc60c-ab42-4808-b79c-612a0349f340", "value": 1942029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047065, "uuid": "5d1f448a-1659-47e8-b486-5474d7f1d8bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047065, "uuid": "f67b5590-c987-4ade-bf73-0b3527a78a68", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3145ff5-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040911, "uuid": "de421e81-c9ed-4438-84d2-4e07a5b9d248", "comment": "Malware payload", "value": "1625224899832aef4ac9b6f3ef57c468", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040911, "uuid": "25781ba9-5062-4d6f-b3a6-1ffbe0acaa92", "comment": "Malware payload", "value": "85dcb7951dd6f8e2383d5ac73649af13c245ecce2a3a33b78d2dde646be71ba1", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040911, "uuid": "4221749c-f91d-4e8c-a3d7-79a4acfbcd92", "comment": "Malware payload", "value": "c099aa90aa74080cdc59899ec3f0d99290a63169", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040911, "uuid": "3b649f09-9bd0-4a75-a7de-17433c78a834", "comment": "Malware payload", "value": "6e60e42fff4bd0168169036682d684be5a35d500691eacab7c151d3008cafedf1aefc20a00938c1da33f8722d6070a77", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040911, "uuid": "27499ec6-7f6d-49c6-ac53-887203e9bc69", "value": "T168069D0BBCA02550C626523A49EA59C62F7DFE4B2B3117C73E50B3B92F726D658F8314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040911, "uuid": "c57e310a-36e3-4248-86d8-76161dd873f4", "value": "49152:xCDrHlFvoW6vfa+6EPf9Anl8ls6nxDTHOv2etap4tE345Sfh:xCnoZnp9A+VnxDY2T+FMfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040911, "uuid": "94146860-dcc7-48c4-aa22-19221f9c65e5", "value": 3835392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040911, "uuid": "f9042127-7efe-4e46-bf61-fed450eac325", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040911, "uuid": "1a109cd7-f205-4a42-837e-73f229111d93", "value": "linpeas_darwin_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98700f90-242f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773992226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992226, "uuid": "2b5567a0-5136-4ce9-b00e-e0c8a772b093", "comment": "Malware payload", "value": "7f60703d03a4738a5e738f73217e6b5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992226, "uuid": "3d5165b9-0fc1-449e-92a2-bbda7fd1a821", "comment": "Malware payload", "value": "87bcfcd7e978dc58619b9ec918d47cc6ef8af704baa89fcd9eb0d3e49db86305", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992226, "uuid": "7c82a7ee-181a-4037-81d8-06f65628aaef", "comment": "Malware payload", "value": "0f64b7dc60169a2b97f4ebdaf59a8378706f27a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992226, "uuid": "b1313ae3-3d2c-4348-9d81-060f5d777415", "comment": "Malware payload", "value": "5908039187cc28d0f1dd35a1c4f1a7cfaa36b4b7bcaac07aa8d19aff699ddf898116af4159611a2a2d45d152f41345ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992226, "uuid": "ac623a42-7862-4988-8f00-78c405f170de", "value": "T1958533319772E397A6F87B512F740D62C04892AF1E5CB4C9D25F9C6DCAB8AB66300F44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992226, "uuid": "e47ab903-2e41-47dd-bce1-30e3df8be4b7", "value": "49152:HhGMZUz6NbEAKRJ3/A1fGynkrqskD54v3a:ZUWVDKRJ3I1fYBkDCvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992226, "uuid": "9fe7b4c4-1238-4b3e-8c6b-1978c55bb4df", "value": 1725180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992226, "uuid": "6e1ae1d8-dde4-493e-b95b-926d82737001", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992226, "uuid": "4cc2082d-d7c7-4e71-b7c9-a74d687e31f3", "value": "linux_mips_softfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16983a0-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989369, "uuid": "bf5e62bc-2b3e-46cd-8a26-d17c78d78afb", "comment": "Malware payload (SmartLoader)", "value": "f6ec4aa3c15c767ce3fbfb774ffcddf0", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989369, "uuid": "1b98584a-952c-42cd-9608-24d319f0f651", "comment": "Malware payload (SmartLoader)", "value": "8810d98ecffad5fc4e5edaa14f4c39f500fc5e70b6e9951e85b7ca287ce77467", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989369, "uuid": "2b9ef358-a776-47b0-9b42-85af7c8c21fb", "comment": "Malware payload (SmartLoader)", "value": "11864a65b8cd1f1c78a91f2a20e11712c9990fc7", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989369, "uuid": "4098ffa3-d67f-4cc1-83f3-53173ac54274", "comment": "Malware payload (SmartLoader)", "value": "f451a3b7f0f3cc3a45dc0af1030530c3d21456365bdfe2b96d8efeacde8dd5ec48bd180ea9345a98233d4cad0ab97cfc", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989369, "uuid": "eac1e118-c85f-4fa6-aeca-8bcb4f280c6d", "value": "T10BC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989369, "uuid": "318f0658-97be-4744-95b8-6a926d232640", "value": "12288:r+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byNH9I1P0QKw6FEN:r+QqldA/TSO713u7xnNH9IaQKHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989369, "uuid": "c34bf526-b06f-4700-9fcc-5581709871fe", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989369, "uuid": "7abba58f-0c1a-40d6-af53-db8318e44a51", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989369, "uuid": "f82c876c-7ee8-466c-8e0a-4342c766ef11", "value": "codex_mcp_go_v2.2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1698ed-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040956, "uuid": "d679fbd3-ade3-466d-b897-c7c16d0b6e56", "comment": "Malware payload", "value": "540322144b1abd309aca10816bbdad43", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040956, "uuid": "1537ec15-5123-46c0-92ff-51558d1fb5ef", "comment": "Malware payload", "value": "8879dd371071378a836adeca9c53b20d8b37af5adbd426abda679b939b06926f", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040956, "uuid": "2fa927cc-979f-4f9a-8442-b9298403a573", "comment": "Malware payload", "value": "24b47b2521c30c74117f33dbac16e2f94f1a11a7", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040956, "uuid": "dd189b6f-7524-48cf-9519-60bd6c87773f", "comment": "Malware payload", "value": "9e39f6299fcdc0f331f8c0f6666200e2891e16f7c2fc4a32d0fc065dad991811c95f53909b059fbbc26ab42ccc1bdaf6", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040956, "uuid": "1c450265-de17-4df2-9f5b-d19321adbbbf", "value": "T19906BF89BD9D3950DA856A3E5FF906C52B2CFE4F2F5287173910B3AE21F22095ED1234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040956, "uuid": "d0482b8c-9ec7-4b6c-8a7c-e2872c264682", "value": "24576:JFUB1DvoWAgd0OwCL88V5FLXn1WvxMQZbQ5RT4MwFDMJ6FA0+y3E2nm7VztxY2FC:JFUfDwew+6EaA0hngVpx3/ZXPImKiDLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040956, "uuid": "4ef2a3d4-044c-40d4-a906-177667fb3b22", "value": 3923737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040956, "uuid": "538e2264-c113-4c4d-8d1b-b6384a7f14bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040956, "uuid": "30b6d1df-acf6-46b3-8484-85b439224516", "value": "linpeas_linux_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9910d07e-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050639, "uuid": "a681988c-1ce7-49ca-8ba8-d5749c5ddd85", "comment": "Malware payload", "value": "1d68e0fab1bdc8771f0a14fb4e2504e0", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050639, "uuid": "fe6f1bd0-7081-4344-934f-7787a9e39bd8", "comment": "Malware payload", "value": "88aeb91728917d64b974e3d804aafbac7e006c5fada689fa484db93a89c57a77", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050639, "uuid": "0785c313-dc34-414e-892f-6613d31c1a94", "comment": "Malware payload", "value": "e436dc0efc2a113db7a31b5f34fce2b4575a5caa", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050639, "uuid": "1a563b7c-5bc9-491d-b04c-21b7f0327013", "comment": "Malware payload", "value": "70368459b20c2c2e5bd3eab58e6a5644ae11d4da6eaca40fd4657fb4b5241588e5ac4c2672ee15d87c7c7d40c4e2aaa6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050639, "uuid": "824900f9-a9f5-44de-b1f9-836d59f5516c", "value": "T1E5D64A07EDA595E9C0ADD13486629263BB317C499B3023E72F64F7282F77BD06A79304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050639, "uuid": "afaa30c5-5634-43b2-923e-8feae461ed14", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050639, "uuid": "2982e4fc-6488-44bb-a05e-518770f7817e", "value": "98304:S0BTQcabHuIdwfCi1fqmIeX3n7OF3iYcM6nNLiyq1gII/1YhrrlEW:SUMOJfr1fqdm3KF3iRf10W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050639, "uuid": "69b5aff0-4e09-482a-b702-fd368ef85def", "value": 13630976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050639, "uuid": "1f2cf80e-ce62-4ac4-80c3-2f24b7ce5325", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050639, "uuid": "0ec78874-6026-40da-936f-35cad00f637a", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de441e7b-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040876, "uuid": "343a5324-18e6-42e3-bb34-5f9d6497e720", "comment": "Malware payload", "value": "1b64cce382bcdadb66d3498fe6e497c2", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040876, "uuid": "e88cef27-accd-4ff2-b85e-5a29488c36a3", "comment": "Malware payload", "value": "88b2d9a66135374f8f2091331127d18eeb5aa856d09864daecfd3da0976dc976", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040876, "uuid": "7d6d11da-1078-415b-b544-cc38bbb7b8cf", "comment": "Malware payload", "value": "85bc1fe69b21a669a717934365da3ecaa92e8b23", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040876, "uuid": "e6f1aea3-9229-40ed-8965-a3113dba0e20", "comment": "Malware payload", "value": "eac05bc062f98cebdc0b142518beb031dab7088147e20694f5b33deaae62a443969fc337f31fa122edf2800d02cd1ab0", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040876, "uuid": "72157043-14ba-4888-b628-4f2e47795df1", "value": "T141B6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040876, "uuid": "ef52bac1-9241-44b2-a2aa-fb928a20a074", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040876, "uuid": "63ac3d84-f078-4fdc-9e8a-4f54af1a8d22", "value": "196608:GvyxUb/VBFUcwti7TQlyVN8iNISRTRmW5Qy:ncXHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040876, "uuid": "7144626f-8414-40f6-94ba-51e41b1be999", "value": 11109376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040876, "uuid": "45f6d4f0-04f5-4992-91f4-a8cdf69f8d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040876, "uuid": "5e8bba8c-fd0f-42df-9ab3-6789b4cd0baf", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e7d915-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989157, "uuid": "87adf982-c07c-4dc2-b5f1-1bc1b6715fe2", "comment": "Malware payload (SmartLoader)", "value": "5bd0f23b8ac61749c7faf8335f3ea5f3", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989157, "uuid": "1bcbd3a9-4913-4b4c-8bec-b3f94963f14d", "comment": "Malware payload (SmartLoader)", "value": "88c027ae91e1515064ccc75f6714ec326b5c3f3cc8266af841884b905df0f818", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989157, "uuid": "0abe9b0a-5fdd-451f-b957-2a1fb9ccfc89", "comment": "Malware payload (SmartLoader)", "value": "bd43d172905764b02ce2b64cdd2ef4fa39cbfd29", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989157, "uuid": "b5ea142a-de5c-4349-8fac-f049a9e4adac", "comment": "Malware payload (SmartLoader)", "value": "de047b78f29f9d7269c3d56b3d96e699a50b38fe8149c9a2d2994432be6b17633dfd7f342c8ba1ea81fc7b7d487db647", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989157, "uuid": "348ec749-a48f-4f47-a7bd-4c49a754a92c", "value": "T10DC42304340641D5835A2B1EAEC4E7E0BEB5A0DBFA1CF940AADE7ED06DE52A177C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989157, "uuid": "65391f3b-ccd0-4ab4-8da8-9cc732bafa31", "value": "12288:j6wlOMWROC/FTeHo22Qm7NzofOr68mQeA924EwCC:b4MQOC/gHozN7NzomW8uA9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989157, "uuid": "ffaf57e7-d0c8-4374-aa38-2d9f328c0acb", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989157, "uuid": "fa98847c-ba77-48f9-8a6b-7c556b0458b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989157, "uuid": "12694da3-61e9-45a4-94f7-04f35633e45b", "value": "space_game_v3.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2397a427-2400-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773971844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773971844, "uuid": "d678a59c-e85b-4539-9bf0-8ef8e80d09aa", "comment": "Malware payload", "value": "639733a046af6f259cc9498392f53697", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773971844, "uuid": "5145f9a9-b01d-439b-baea-4970b6458e48", "comment": "Malware payload", "value": "8945dd2ad1a94efcd8d2a4d905005a2b8d3650dfc61b00fd777328d2fbd5f086", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773971844, "uuid": "0233534a-ac1f-4631-80ec-f8e8c11ba966", "comment": "Malware payload", "value": "03f1e0bbed4eec6c8e34f03a329a76cb458febcf", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773971844, "uuid": "08c15bfb-710e-4046-bc37-5602ccf8e2f1", "comment": "Malware payload", "value": "be6f3f9c17a7a5762874cec4f38cb57bb90a44d6a6e729f2bf3e12e383d35478a253bb6e9a762b392b28845300e7ce3e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773971844, "uuid": "54bb8feb-36a6-4308-b8ef-1275160a7adf", "value": "T172B59D217686C136D56F03702A2DD7AA46797E703B7744DB63D86A2F1EB09C18232F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773971844, "uuid": "d910cbdc-8e06-411e-8418-5f25d5cebcbf", "value": "49152:JWuJrMf+7UVZDEFeHbPqYaZrf5jSTUiala4vLNgmUESIEjPMN2lv+oBgYEMV3eVx:Nq+a4jSTBd4veHjPMNacYEMV39qA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773971844, "uuid": "6d0addeb-4d24-4adc-ad6b-850de139e3eb", "value": 2447872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773971844, "uuid": "dde37fa8-1c2b-41db-b0b1-ae170c76e0ec", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773971844, "uuid": "1390b726-733c-468a-94fd-239e05cd3715", "value": "jsb_cocosbuilder.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0936d3b8-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040948, "uuid": "b091eb52-bacc-44a9-9203-de77bfc67595", "comment": "Malware payload", "value": "bcfe0509b8c10678c6e5d14e9dcb2ae7", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040948, "uuid": "2c2cf94d-1e5c-4bd3-a062-447f2b6cde83", "comment": "Malware payload", "value": "897c11ecc1b77ca60fe5e696f8bcc56bdffbc561e10f18c859575839622a1f46", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040948, "uuid": "86be0bd0-2940-4527-929c-6d10bcf03305", "comment": "Malware payload", "value": "db5d21142d9b631cd7b8a76a2896a181b94a0996", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040948, "uuid": "3f110887-1808-44ae-ab8e-3d55a512f742", "comment": "Malware payload", "value": "54d43a611168c3031cd88525077ca2e6435f627a03e144e93597bfd216bf4334d52b972914f6352fb6b04af26bd34fb4", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040948, "uuid": "bffa9d42-dc7a-4427-93f7-8a6d843591f1", "value": "T1D7068D4B7C912A05C9D4263BACEE45C4376DAFBB3B9252063D05FA7936BF09E08B5314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040948, "uuid": "76240e04-0d4f-41ec-a56d-c73d131ad07f", "value": "24576:iC+Yf62KBYbmiOlxy1xejYCWle6FFgod5zH9p1huOnneSwUcgn1WvxMQZbQ5RT4B:c2SujD8+6EQ+hghWIl8YNXpmxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040948, "uuid": "3e24db11-6f89-4535-b78e-a3621f8218c5", "value": 3856497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040948, "uuid": "cbc733c9-1183-4733-9d58-225638286c86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040948, "uuid": "fd85e1e9-bc95-4bd4-8f76-b8119a279dec", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b674e87-2428-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773988983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988983, "uuid": "64ecb367-012c-4c8c-ae52-bd3bea248187", "comment": "Malware payload", "value": "3c5e6a1defd68a8915602001ac0a33cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988983, "uuid": "ed107299-ec20-45a9-97aa-03409f272aaf", "comment": "Malware payload", "value": "8a18e3f3a41b64fa23d231fdc33a941b7b5f5252374c6180a3c63b4f6a99d68d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988983, "uuid": "53d22441-65d6-4fcb-974c-c4906e5a390c", "comment": "Malware payload", "value": "80abe839569a75863b370eb9b9f42f6b81e1e3b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988983, "uuid": "2fb839b9-88c5-4ec8-b0d5-5ebe813f5ea7", "comment": "Malware payload", "value": "989ba47b47ab8428abf2f876487ac0f5a42310136bbcbf8a49d61a6fb84fe059670adbf49915fdd848b0d9fc9caeee17", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988983, "uuid": "2594701c-c400-48a7-88e6-cd602fca5752", "value": "T1387533CDFC6E86219D2D6634861D2781B80D74DC887B2336B1B1E48B2DB5F24E6D253E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988983, "uuid": "c9d8559f-1f58-4fee-93f8-2028f2af103c", "value": "24576:xy/siaNzk4iNJeA1mCiQMiFv+nAN2+2rNItcdMTXXHBXy3zHOeFad8Qv6oY5lZrB:xYZ80iWFTN2AwaHHBCDu9d8YLYF3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988983, "uuid": "0dca7db5-a57d-406f-9078-ceac7182c4e6", "value": 1654332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988983, "uuid": "b1ceb50a-d7c2-449f-8b10-a2ae3393653b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988983, "uuid": "d091d0a1-699c-417e-a5fc-67e53e6f6476", "value": "linux_ppc64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1c8740-242a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989900, "uuid": "d5927fdb-b4a9-4eda-8dc0-a9c4dc035bf7", "comment": "Malware payload (SmartLoader)", "value": "ed328c96387c8ad646a3a69c40a353bc", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989900, "uuid": "f5071273-b1ee-4ff2-8898-9940198d07dd", "comment": "Malware payload (SmartLoader)", "value": "8b52035152e515f1b061b3e5b6290268035399f8b433506a43376a3b1f86d247", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989900, "uuid": "d9a600a2-99c2-4002-8302-70d5217baf69", "comment": "Malware payload (SmartLoader)", "value": "f22e0960d924d884af0a1f57e01bd04f31e93d6e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989900, "uuid": "66544de1-0e5a-4c60-a6b6-727ecdf756e4", "comment": "Malware payload (SmartLoader)", "value": "0ae7e394d4304847f3b7f39897ad6c76ca14c259c96374fc95e49250c6012e3cffa69f4d2030415b13518953ee01feb7", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989900, "uuid": "bc5531bf-79a8-4008-9e4d-07db08f1e5a3", "value": "T147C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989900, "uuid": "e2aada1f-3886-4da9-ab74-ccc17a67b3cf", "value": "12288:rA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpW6SFyorOIic/7MPU:Em6Jj6ESfUxZ91kmY/99z8LFXicTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989900, "uuid": "ce586e05-3306-4fd2-b5de-f6e84082b78a", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989900, "uuid": "24666c4a-d69d-4784-8b08-7adafd063762", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989900, "uuid": "2f8b2a17-4443-4cae-a533-28501ed7b4d8", "value": "programe-lenguage-2.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd712d8-2439-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773996342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996342, "uuid": "1f4f0671-614a-47fd-8f12-7f9f87d0e320", "comment": "Malware payload", "value": "628f782ba998dbe9ba5aa5a4028077d2", "object_relation": "md5", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996342, "uuid": "1d84fdc6-90eb-417b-9953-b15c52de90b9", "comment": "Malware payload", "value": "8b880a1c7e48ea0f5535268b7afd709f4378d06c964313301357944a744cf52c", "object_relation": "sha256", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996342, "uuid": "33f896f7-c942-4758-a015-dc6df11b3a96", "comment": "Malware payload", "value": "5e7a9b418405117b925bde3f635c083e5adf4f0f", "object_relation": "sha1", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996342, "uuid": "193b9ead-5e77-4c14-a69b-1b1f481f9760", "comment": "Malware payload", "value": "1131d94969b8b0f2c0198c36dc39d7aa533cbdda0dcb6537edaaf227c74b6234e6227ec96a2016347ba44a324a945a49", "object_relation": "sha3-384", "Tag": [ { "name": "Clipper", "colour": "#85AD93", "exportable": true, "hide_tag": false }, { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996342, "uuid": "ca405c90-d4d6-4846-a629-211a46cdc562", "value": "T1EC43FA3E77621BA9C69E8EBD8023127582359F03E506B66B4CBDC0B4358639DDE11CF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996342, "uuid": "3c7de223-0a33-4fa4-b90f-ac158c988ede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996342, "uuid": "bafdbb7e-5b57-4839-8014-619e462ec8db", "value": "768:3B/Uxm0e/hMfNqMkt+xQe0NeuBsBLbbNCXVkrAaq+XydMrIsOSLX2a41:xsm0XlvkgWtebBLbb+HavwMtOSLXP41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773996342, "uuid": "0449c471-173e-411a-9e8e-54fb2ee6dab0", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773996342, "uuid": "549a6eb3-4ee5-4af6-b764-c6794a83fc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996342, "uuid": "121db65b-d36a-4fbe-bad0-2ddaeb4ce28d", "value": "clipper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a2c081-2444-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774001137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001137, "uuid": "ade86180-09ff-409e-8167-0340498229e8", "comment": "Malware payload", "value": "534c93463737af3e9b1c9608c0d4d7b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001137, "uuid": "96775981-ee3e-4daa-9209-c15293cb653a", "comment": "Malware payload", "value": "8b9bab8ee7f102c24f82999027b4e0ae2e49c4bb3ee7b7cb620668e55c316feb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001137, "uuid": "95479661-89af-4786-9220-5075927508aa", "comment": "Malware payload", "value": "6d31786a7c2c7727b3454d7b79babc51a7a74a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001137, "uuid": "129f6aa4-0ade-4180-9a69-faa6e27adb45", "comment": "Malware payload", "value": "440c3f7e359d076b2f4033d4f1fc8d08b4df4587faf5c49454410e4f891ee48e57a29a3998c0d6e2697412e5e0cae2f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001137, "uuid": "5d24ee07-c981-4116-9841-8a1cb24ce468", "value": "T128A395096FA10FBBDCABDD3702A9070139CC651B22A43B7A7674D528F54F61B49E3878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001137, "uuid": "8061bcac-1ee1-4e59-8d9b-0f6d70527da9", "value": "1536:hR3ynCmOtuIjSdAR+B+1L6JePXxc20gw+nz+K5NbPHSxGZli/j:6CmOtuIjgBqLrVNToG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001137, "uuid": "d2f00767-2a40-43cb-844e-efa894e3ad3a", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001137, "uuid": "c49fef0d-fb0e-46cc-91a3-2dcf84a914e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001137, "uuid": "a9800eee-6baf-42d0-95c9-7ad21eb03ea6", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e1563b-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977991, "uuid": "43fe6131-dbc0-4fdb-b4cb-10f364c39fe2", "comment": "Malware payload (SharpHound)", "value": "cf8ce9d8486bdb4c188cd1b333d05319", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977991, "uuid": "60eeecaf-955d-4e08-9008-8759f9ca779b", "comment": "Malware payload (SharpHound)", "value": "8c6eaef7c47fc1a6ab887c912975d9de83cb1c8cf67c30d647fc691bf98e99b5", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977991, "uuid": "d4212470-2542-443a-b1ce-7052e3c2822e", "comment": "Malware payload (SharpHound)", "value": "96565673ceeb3584760a2d3d62d8c86a3951cfea", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977991, "uuid": "970d5788-ea86-4108-bc39-86a244e86237", "comment": "Malware payload (SharpHound)", "value": "4c323987bd978aa832d30c9786ce3f65145de917fc898c879f7686810023b975d784647307e4ea1be632d865b440734e", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977991, "uuid": "844ea2e7-f66b-40b2-8da1-7e59ccd17bd1", "value": "T1D57533B0A79664A44CB8861924FF3F4DDE90BB5384AC8696369D44825FED748C343EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977991, "uuid": "d40751bb-4fc2-4621-80f3-d063f9c551b0", "value": "24576:Ihr0xP2uUcKWGJMawlwCfzFNYn4RSn9w06gv6jYc7SAoL4MborrOieDrlPrz/19W:NhX2rwC4oi0aH7Svxzx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977991, "uuid": "692291b1-34b2-49e1-99f2-09b7b9208198", "value": 1618189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977991, "uuid": "131488d8-ec48-43c2-a0ca-47a4d9f0bbfa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977991, "uuid": "c7390888-dc26-4b31-92f7-0eabadf9c9a4", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccbdcb0-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046887, "uuid": "00755e6b-e94a-4e20-abcd-01900eb99d7b", "comment": "Malware payload", "value": "0bd621b8aa94c22bde268a3e5671c9d4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046887, "uuid": "050c2df0-1f22-4a14-b1ba-a319930fcc95", "comment": "Malware payload", "value": "8dea8a4c299af67f3548036dda534a7c3e1070bf70607452a2bcd7b55e4c3e08", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046887, "uuid": "fec74a8e-58ee-4978-9757-ae553aa4168a", "comment": "Malware payload", "value": "177746e7c4c77ee147623462afa1b8d04eca94fb", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046887, "uuid": "7423fb64-e944-4359-ac70-f192321bc4cd", "comment": "Malware payload", "value": "4917da6884f2675e25365d674048f9d88b84824a1acb74973e13f1ff340e8e2c4eeca420ccc8feb40fc9ff7824035d2d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046887, "uuid": "b7a3916d-ffdb-4221-ba5f-8327bbf433b7", "value": "T1927533306FA55E7A46F8423C26AB1B5C8BB05BAB5529D8DEB2DF51430B73A40412E87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046887, "uuid": "032e2cc3-43db-4787-9545-003e1f540858", "value": "24576:7rwvT9S6O5ykUvp2xGiGmqsgcGfMnTmQVArqJwgBdDE64sQaBUH0PUQEqOk05gnQ:avp/nS0mCQDNvlWb5lscbwXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046887, "uuid": "d69bcf68-90b6-4155-8f09-095b375f3a4c", "value": 1591609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046887, "uuid": "2f7b0b9e-03dd-4d5b-8ecc-58bc39fa240d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046887, "uuid": "409ac8d0-a05a-410c-8449-00cf536e5579", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f830a4e7-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989380, "uuid": "d9489c07-36ee-49ca-8f04-a155778e4964", "comment": "Malware payload (SmartLoader)", "value": "88d167c27db410ca98b27dcb27f0b2a9", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989380, "uuid": "78b95ccf-399b-465c-b5a3-2835f14725f7", "comment": "Malware payload (SmartLoader)", "value": "8e7d45f486c3438e2e6d855faeded6d6dad9561fdd36b08477a12a768a375fc4", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989380, "uuid": "0a88e77a-4c4e-4a7d-92bf-a747e6da6b04", "comment": "Malware payload (SmartLoader)", "value": "f13b9392b7ce14ba8850187333f52382703a2b7f", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989380, "uuid": "b168f0cd-9b11-4c5d-94ef-84f7b4948009", "comment": "Malware payload (SmartLoader)", "value": "3ad8a0920e9bbb462ef79e9fc3da29480df00e2cc2fe3f2a0f9372b5d4360d65139252b9b8ed2719e0ad97acefcadb79", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989380, "uuid": "e557be7d-d530-49cd-b432-4be7afaa49f4", "value": "T1E1C4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989380, "uuid": "c52604a4-ccdc-43c8-86df-ca7e930cf25e", "value": "12288:T+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byDH9I1P0QKw6FEX:T+QqldA/TSO713u7xnDH9IaQKHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989380, "uuid": "5723bee1-37d2-4a63-b45d-ceae1014f244", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989380, "uuid": "d17bea32-8765-482f-baf3-547e545dd65e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989380, "uuid": "0cf4330f-7b90-4882-981e-3c0c025c103d", "value": "NA_DE_presentably.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01062ffa-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050383, "uuid": "ad9d9eac-ace3-4ccd-b4ef-0995de0c50a2", "comment": "Malware payload", "value": "872ebef4a0b1bd1d850f18677e9956ef", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050383, "uuid": "4aa2f0be-01b5-4d37-8cd6-adf36835c0b2", "comment": "Malware payload", "value": "906bd9ab909bccf47e45e445368df2aa15049f4cdd8bcd1e2d7ea5d8ec81daff", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050383, "uuid": "9e75376c-0555-4121-aa86-655cc46346da", "comment": "Malware payload", "value": "b5add0aca58a5ebdcf219a9e00f1f635b2f077a0", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050383, "uuid": "39c7de23-0676-4b69-9ff8-115b4dc88007", "comment": "Malware payload", "value": "cbe00c19b454922da0dae58770c1ce726ca59a7bce69ce78f3acace7d18e25fcebf20e8495520030d1b8a00f7ae31e80", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050383, "uuid": "5ab025e1-cc90-401c-bf24-ba9669a6e507", "value": "T1DED66C55BC1E7462DAC979747F6653A43338BC489F81C3262514BF7CEEF23488B622A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050383, "uuid": "6f5a265a-8d94-4b03-831a-dc6ac0dc2f2c", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050383, "uuid": "52165653-7824-42cd-8fb8-be496927e320", "value": "98304:8TMdNlfPohRSwn7vOoUbktLKJwtQlNCiZTYmi8PWqt8bpz6E:8YdNlfPQvnqCeJwwTPwxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050383, "uuid": "fdd6c03c-b89d-435d-b0ab-d95b0a967519", "value": 12696576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050383, "uuid": "849cbb39-47af-4aa3-9782-61961397aa59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050383, "uuid": "90325025-7124-477d-9723-1ecc8b59dc84", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa985f5b-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046937, "uuid": "da6d265c-ae35-46e3-b515-466fd7ee9fbd", "comment": "Malware payload", "value": "e2b91ce4e7c831c48630f94cbc781491", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046937, "uuid": "5e342b1d-f57a-4bea-9134-c98fe67eee4f", "comment": "Malware payload", "value": "906f2797a17b63b9611f53825e028a215911f50a49a6997d2d33d3d826a3a664", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046937, "uuid": "3ad87227-9394-4d90-83b8-74f4a6ccdfc6", "comment": "Malware payload", "value": "f58f5e85329ec1ff0e75bd925a5627fa31966a7b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046937, "uuid": "9da0b82b-a100-44f6-967e-672899226e94", "comment": "Malware payload", "value": "0cfc460c57259e284fab2ec1367b93ee2291a33178aaa4523ebf9a48006478cf4c6cd3a5b8bad8c5129c8f7ef572f798", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046937, "uuid": "9cc3b17c-52c3-491e-bae1-f6b656aa77f4", "value": "T1B67523203F1FBEBD6DF88319116B2D3FDF808B13A40C86E6B68F90915F69910592697D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046937, "uuid": "f9368545-47e0-4b30-8651-76f21a60e69d", "value": "24576:3j7UAY6UTBkLR02AFtkgbCTpGvN6S3IIZnqUICrqVlaojnXmcuJen9FnqyoAsia0:zusj9gbZPr+dXoePqyoAjEY8Qom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046937, "uuid": "3d2233ff-2dae-4bf1-9f04-3d2bcf660dbe", "value": 1570261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046937, "uuid": "5c5367f2-bf12-413a-9c01-08058ed20b28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046937, "uuid": "22691066-cc6a-41b9-84f5-ea8ea9d9b489", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48def825-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989086, "uuid": "410f19c6-863a-4339-acfa-d7e373bc150b", "comment": "Malware payload (SmartLoader)", "value": "246df3b95fcb5562e6470dd705dba80c", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989086, "uuid": "4b233893-2879-4ab1-b370-1702bb5a1ffc", "comment": "Malware payload (SmartLoader)", "value": "9080a81295b61fd3483947881b97961979d7d87c3a551d1ff77db1345a62a7b2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989086, "uuid": "10112774-6f0c-4509-8981-94a79cf3f506", "comment": "Malware payload (SmartLoader)", "value": "152f40225f9dfc5ca377ac4b4759ba4a0debfcc5", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989086, "uuid": "9691d121-daed-43c7-8e62-9abcda2162ab", "comment": "Malware payload (SmartLoader)", "value": "8abe94e8b464735707e8612897ef2bbe171c26a65ee4d1e1b5d95bf4e929d29fd45a63c184407349dfaa2d73e6eeac08", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989086, "uuid": "0cc8cb92-8200-45dc-8a9e-c1ab1a4b0738", "value": "T10FC4239603689664787407B197BF9F8DC6028E1329921BFD9FC8BF0CA1356489D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989086, "uuid": "7a21cf4f-c5a5-4a4a-b74b-c002d955deca", "value": "12288:EOCBcIqByliubzqtYBpfsz4TKPozt4CTo4Pl/2Ar5V:EZ+hubzqyB9sz4TKPE1l/Zrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989086, "uuid": "ef58ecc7-be94-4bf9-bcfa-ecb064c7f741", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989086, "uuid": "64999aff-ed97-4d84-b342-ddcd0fec3c9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989086, "uuid": "c4b57a39-16ae-47a1-b3f2-f9803d1ab970", "value": "server-nats-3.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14df3eff-2429-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989428, "uuid": "0b17abbe-82fe-4938-9969-f7ceddc12a40", "comment": "Malware payload (SmartLoader)", "value": "2ca302831c75a889f3fa7376057adbb5", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989428, "uuid": "a3780354-af76-4370-8f50-082f2a5123e1", "comment": "Malware payload (SmartLoader)", "value": "909c91bbe018d96d60c6b9a3b7cb29bd0a5bb733f9f72846b8edcb8a332d4b7f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989428, "uuid": "9e828293-6ced-410d-99fc-9e70b67d35d6", "comment": "Malware payload (SmartLoader)", "value": "33ce2b144a4ba99ea17fac84a1aacd0d67b9acb2", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989428, "uuid": "a43636da-cb9f-4005-831f-7574614a2f36", "comment": "Malware payload (SmartLoader)", "value": "ae2ab576b862ed839aa1e3a51aa3c850cf5e31c856884ebb7b8dcc76e5755fb106ddd58fffae65ef8b234ff3ba0b4ff6", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989428, "uuid": "f73cf57a-1869-4fc5-b01d-27e665b1c169", "value": "T108B4231EF4D078CFD68ACDA394292C785F6C96C9CD126B7246C4EE9312442F627A44FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989428, "uuid": "6aaebe7d-26d2-476f-885e-24c89b1ed3b3", "value": "12288:RTibgSMFBOBSlqr2Ku7FxPbzJTVBU+8JM9hAC8Z3dVOBRkbKQDiUbpKK:YcSMFYUKkxpTKJM9mCw3dVOMWAPbpl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989428, "uuid": "bee08298-2212-4fe9-bac1-ffd21d91f93e", "value": 525573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989428, "uuid": "9420ccce-8af9-4cf1-a68d-55b6a38af2bb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989428, "uuid": "936573eb-66b0-41f2-b21e-9be2130cebee", "value": "Software_v3.4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e6844f-2471-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774020322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020322, "uuid": "ff4e9d58-e6b0-43da-b2c0-2a82cfb6e071", "comment": "Malware payload", "value": "6a6206f301294fbc4e47ae0c83566f84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020322, "uuid": "7c4be62e-c25d-48ab-a242-6f743bfc2634", "comment": "Malware payload", "value": "90aed2ace49f3bb17ef98db4174635b0f8a53a3dff359a3cf482de9b20f094ad", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020322, "uuid": "38948ac5-20db-49d2-95fa-bd28bd9960ac", "comment": "Malware payload", "value": "2cf84278e6a0a6bcabfdcc4763a73fe9a0526193", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020322, "uuid": "605e5ac3-fe5a-4c27-901d-9f170e868145", "comment": "Malware payload", "value": "f4dd06ee40dcf64a87119b4be0d28abd4b3c92fd50b2146f456ba4ec692d084706aaf3438458afa35e38043049072653", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020322, "uuid": "f6d399cb-d9f1-4a6e-bcb7-37893d82292a", "value": "T1C2A612E5152DED4D997C2201D3EF8A48B932CF98D1166EB9696F760F8B0E0B647360C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020322, "uuid": "1315573f-f3b3-402f-a9c4-a2de4e29d6c8", "value": "49152:FmMHf869Kh/wApHdRQjbeNU7E9IHYAzNaUymgG4yaUyRxUiuKUNu2JlNyltg7gds:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774020322, "uuid": "1b3192eb-a0c1-4527-b92e-789e67435ae3", "value": 9924430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774020322, "uuid": "8336a2ba-75c7-40bb-a7f1-afab8465ec97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020322, "uuid": "6356492d-1a66-45b1-a935-6c464eef2e2d", "value": "Michael_Williams_Taxdocs_2025.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5066f797-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977932, "uuid": "26b9e646-b054-411c-a179-2b515be64733", "comment": "Malware payload (SharpHound)", "value": "9ebc0d7d7c5a76506c96cebbb99b98b2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977932, "uuid": "14bd0a54-a36a-475a-b62a-e3e7b521bf50", "comment": "Malware payload (SharpHound)", "value": "910b927f2baceac0eb547f132731efee4a26dd687288e4a950fe8b298eca0d1d", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977932, "uuid": "d508986c-210c-43cb-99e2-aaaf9803ec9e", "comment": "Malware payload (SharpHound)", "value": "97317c5328d42a469d24b580ce3fc25908cd97b4", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977932, "uuid": "e61ac251-60ba-4383-bf51-d508065dab05", "comment": "Malware payload (SharpHound)", "value": "4aec4e20d5ef3e4ebaccc0fed7d106b12b2947c71ad0196dd454c4954e2325982e42091e370bc63e34d8647437f9c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977932, "uuid": "caf24aeb-4a93-478d-bbf7-dc0f6a0b855b", "value": "T111753320BF7E4ABE473D532A196F9E1E5EB20A4B10C4C6CF37DE24D91B296064537478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977932, "uuid": "1f817223-fd23-4711-8638-7c71da50065f", "value": "24576:6lAg0MQ2BUuqcUk3zczgcffB/kn7ufsqFGPjTHv6iuOGqlzJ+85QMzsim:690+oQ9HtjjtuOBlrXYim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977932, "uuid": "68a28aab-88f8-477d-a481-ee382290140a", "value": 1629473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977932, "uuid": "63d38124-d158-4614-9a33-784f75d3405a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977932, "uuid": "3164af0b-223e-4be9-b0bd-ed891051e059", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e0948a-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989168, "uuid": "f32a1b96-50cf-43cf-9f18-043609bd2403", "comment": "Malware payload (SmartLoader)", "value": "1ca91c048d10e87cc5d539d643018e95", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989168, "uuid": "4aa3fd60-e27a-4660-b4fe-b9f64733bb5e", "comment": "Malware payload (SmartLoader)", "value": "91db324b19ec00efcc424574a13760d448269fea9b516c7e51dc0ebdb01ccbd1", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989168, "uuid": "a7132ebc-6161-40a8-97d0-731cf7df64a1", "comment": "Malware payload (SmartLoader)", "value": "4f41ee1270c397a41ac120b066aebb7d7aab1114", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989168, "uuid": "073e4f44-084d-45d1-b2e8-cad8fd63ea1c", "comment": "Malware payload (SmartLoader)", "value": "7ac22b4c55d6ed4cace3d23f39daeb28aebd529f98a2d19e710664a84d02992c1b28437dfe6667df8bbb48d4deb3ff7a", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989168, "uuid": "1cc30e65-b6ff-4eaf-aedf-12e859b8761f", "value": "T1C8C42304340641D5835A2B1EAEC4E7E0BEB5A0DBFA1CF940AADD7ED06DE92A173C1537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989168, "uuid": "6f57d250-6035-48c7-a0e9-da0dd374d9bc", "value": "12288:r6wlOMWROC/FTeHo22Qm7NzofOr68mGeA924EwCk:T4MQOC/gHozN7NzomW8IA9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989168, "uuid": "bde92ef0-429c-444d-b06c-36c8f1f743d7", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989168, "uuid": "6e6d6618-bf68-4147-b668-061d61e822ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989168, "uuid": "a69c0aed-80b0-4271-a93e-180a7b0da82b", "value": "project_3.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3556af-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046914, "uuid": "b5f6dd49-9417-42d9-af2d-ea75996dead9", "comment": "Malware payload", "value": "26575db6cab777468681d71c3c766ef4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046914, "uuid": "ab7c62f4-9c2f-458d-ae68-a65144f97094", "comment": "Malware payload", "value": "93754e60f82b62e5c1da5b51476c28f3bef3d3d5f4a426a41f2c98f2e7327ca1", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046914, "uuid": "8a5d8644-5521-48c0-91d5-477991bf5425", "comment": "Malware payload", "value": "df0e52c867c5016b4734f92f0ca5cc4e0aacd278", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046914, "uuid": "75080962-5197-4938-bee7-25ed0c5c46ec", "comment": "Malware payload", "value": "558b46eff5e31913e3c61499c261625d1483c106be173ef53f4e8929b807f2396e8a525987a04c4d5756ea4543a17158", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046914, "uuid": "082b86ce-3f74-48b9-9e0f-438f300d91ba", "value": "T11755121943F88B96F6AF1BB9E0258055CBBA7627FD5DEB8D994CF0ED1482360D940323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046914, "uuid": "d42be585-0ccf-4100-b448-5afca26142fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046914, "uuid": "02b872dd-1f30-4ed2-8876-59602db5ddf7", "value": "24576:l8LIGEDwgrRvNuXoVIa09WmPstYX3BkR9nk4Bkong/iN9WCQY:lfzRvNE9WmPDXi9nRBFK4Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046914, "uuid": "823feabc-ae30-4132-a017-f0ea7968922f", "value": 1297408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046914, "uuid": "faf874f6-93a6-4c8b-aea4-dfa00a931fe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046914, "uuid": "6e6637c5-3a6c-44e1-8cd5-9aa02046b7ab", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5b4309-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040764, "uuid": "a0fa55ba-4e9b-4b39-a960-a57258626912", "comment": "Malware payload", "value": "595445e81810f27d77a71d0fbdc5d386", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040764, "uuid": "bd883060-5862-444b-a49d-ad6337385aef", "comment": "Malware payload", "value": "96454ec1752ee306ca5e2414cdb9d13510af995206c3af5fb461796f9f088d01", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040764, "uuid": "b4d5924d-ba3c-4f99-af6b-9285a424888a", "comment": "Malware payload", "value": "b3d9d44463502ab880b6b1d2d89be05aa7aa0be9", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040764, "uuid": "ee392bd2-882e-4256-8e90-2c4f1d4a83ba", "comment": "Malware payload", "value": "84061f0da49b16bb7c97e4500b74331b0c823d98c27478e1304c949092df644675ab60b21baa9047c11a11998e6867cb", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040764, "uuid": "a5f08f01-7e3c-4106-81fb-0f77649a2ba4", "value": "T1E5B6D04062DD046DD6AF0E79906202324B35761A579A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040764, "uuid": "6a152c0a-6743-498a-bea9-4d0c19002006", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040764, "uuid": "9c9e9802-06ec-4054-9614-fc3475ccba54", "value": "98304:HoKcJJdhz95dPy8um589OUcwti78OqJ7TPBVYVrsk9N8ivyhAdsPSQxDsTRmW5Q7:IPzdVBFUcwti7TQlyVN8iNISRTRmW5Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040764, "uuid": "c186133d-828a-4e63-96d4-a4ae36aad6f6", "value": 10959872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040764, "uuid": "620bf942-3878-4613-868c-e60ecfe61d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040764, "uuid": "a6966b1f-c9d0-4682-a382-f5028ed50fb0", "value": "winPEASx86_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c66790f-2441-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773999856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773999856, "uuid": "32982810-4cbd-4d82-9427-00a9f9d160b7", "comment": "Malware payload", "value": "cdea3d710b2c1d154e7e97af094d744e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773999856, "uuid": "4793f9ed-fc94-4786-a8fb-83ee916cf06f", "comment": "Malware payload", "value": "97b2b226fbf45e5f6c5503b396bd3a3442844cb9c5f272f5142e4a98636afe09", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773999856, "uuid": "73e7c8d6-fa66-4ed6-9b42-fa75a898db48", "comment": "Malware payload", "value": "8143b95578d6daba00757f762a9b3b64fe0946a0", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773999856, "uuid": "f8895d62-46fa-4b86-a9f5-3de20dce4a3b", "comment": "Malware payload", "value": "5e6f6ec0c57115a9d468e9c32b5840c5ef411ecccadd7c54f743c0eed4ec407a804268bbf7475209b880195716ced379", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773999856, "uuid": "5eb26015-38ac-49a0-b591-696d0d429b2d", "value": "T112C3128E5DEAD9FE8BBF3019892FAF03D55F15120C9DC2A0BA0DAE907F12C56B1655C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773999856, "uuid": "9d7bb53a-cbd2-4060-a697-38dd722baa71", "value": "1536:JmiqVa8f+ObgPwq9SylQWkP8KRfCy0yHflpIyz:4fpbAwCNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773999856, "uuid": "948cba04-ad23-40c5-a160-decffe9f906e", "value": 120634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773999856, "uuid": "2905ef26-53eb-4480-8db4-d552f5420ef7", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773999856, "uuid": "563746ce-7c2d-4e2b-96c6-03cb7c0d53e6", "value": "External_Y_Template_737.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea2b5f3-2424-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773987324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987324, "uuid": "4d6099cf-835d-426d-bc34-9f26012d4b9b", "comment": "Malware payload (Mirai)", "value": "e5bb3be384f5d873874b89bdc95f053d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987324, "uuid": "9949cdf1-f3ed-4612-a71e-440ba1d528b8", "comment": "Malware payload (Mirai)", "value": "97d8461a82d983b1abb40f410bc54faaa5a5af70586889ff491ab633138f83ca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987324, "uuid": "35592088-dec4-4867-b69d-4a5dc3eb7720", "comment": "Malware payload (Mirai)", "value": "2a9bf71f91f618db4c797907844503f17fde0d72", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987324, "uuid": "9a588d64-9cdf-44bf-a31a-3c71a3c6b123", "comment": "Malware payload (Mirai)", "value": "0d047e0d4eefa38171cdf393a1031566fc1ca40429b0b5d21bc6a721cf67dabbff5b3e1669d2697b851c59b58822629d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987324, "uuid": "433398ec-f159-40be-a4be-c245ea56459e", "value": "T184262941FACB94F6D5031E3040ABE2AF67306D094F25EB97EA507F1AE97B6920D3610D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987324, "uuid": "33c7b6f2-4bc0-4435-a453-c5a3570dc2f0", "value": "49152:DQ3U5qBIw2h33TFJYjiUJf1LnNba0kMozmTm7ZY5NyFBpU2TVPiLKZ2r0nb0VF1:DQ31i3TFJYrozmTmpBpZMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987324, "uuid": "d6283ba5-2c75-4c6b-897b-a33b4b17b884", "value": 4493312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987324, "uuid": "8d0bd95b-f46d-42e7-b071-8b21f9a3752d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987324, "uuid": "734e95ac-2e95-4faa-aee2-2efc0124eba6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882cdd35-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046745, "uuid": "ae54a48b-3115-4a56-8613-8fe4acff5228", "comment": "Malware payload", "value": "6c7be123d055bd0535c9a600915d5daa", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046745, "uuid": "1e30fef9-6b5b-42d1-9828-24c6d65fd56f", "comment": "Malware payload", "value": "9821a3b331585fe7626ebd4d291616695a0f7bf20b22de3b9e02cf5148864606", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046745, "uuid": "92848f10-d69d-4f38-ad5f-31a25961473c", "comment": "Malware payload", "value": "042bd3479f6e007ddd76bf3c6bde58f401753339", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046745, "uuid": "0043c173-ee29-47e7-accd-19cc898399d6", "comment": "Malware payload", "value": "401cd2b0a2c87dc6431804c7edaa4b4941b00a6a95adbc6e7bde3ea99cef040e7d9358a0988288ae9b80f499c2cc3e6f", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046745, "uuid": "6bd1f952-b1f1-48cf-bf48-ee5c7506635b", "value": "T1BB55125A43F88B95F2AF0BB8E025914987BF762BF96DE78D994CF4EC1482360D550323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046745, "uuid": "3b38386a-05bf-4fa7-b4d1-42521ad4bbde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046745, "uuid": "530ecdf8-d50f-4f76-9f75-7a8ea78aa2d0", "value": "24576:ypLIGEDwgrRvNuXoVIa09WmPstYX3H9iCuHITYsIkong/iN9WC:y2zRvNE9WmPDXXYCTYsIFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046745, "uuid": "e3a24d1d-d33b-4b45-8dc6-979e9f943778", "value": 1305600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046745, "uuid": "4098ad5e-0dc4-45e9-99d3-358a79cd722b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046745, "uuid": "1b91e78c-ec9d-45c5-a919-b873216ed179", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a759de97-246d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774018880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018880, "uuid": "0ea078f8-c5f4-423b-a0a9-7c2f80cd4d42", "comment": "Malware payload (Vidar)", "value": "1aaac4d45feab4085152053144c35644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018880, "uuid": "304f30cd-586d-42fc-8cc9-57b087298632", "comment": "Malware payload (Vidar)", "value": "986aa239e5d766f0f1e27bde816f80d4f6769dc62739752825841fabc0e94fbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018880, "uuid": "09d3b4d3-f7a2-4753-9d67-c88b1c30e59d", "comment": "Malware payload (Vidar)", "value": "d05cb5afc8b9d806e6bacb98796e00067ee29dbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018880, "uuid": "721deafb-8bf4-47ac-a0e9-12eba3fc4c33", "comment": "Malware payload (Vidar)", "value": "e250427cafda01de18040109df20c5aa65a92498dc2722d81c306ac7f17c189a0e70c1094d0bcae5c26cdeef8071d646", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018880, "uuid": "e8f054e8-f3dd-4d27-8333-0e08cb9648e2", "value": "T1D9B57C0BBC9918EAD06E977689B652923734BC090F3223D71E80B6782F73BD09D79744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018880, "uuid": "5336121a-4eec-4b12-891c-3002c7045ee6", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018880, "uuid": "9b21cb07-d4b2-4e0a-9da1-f147b4fe89ce", "value": "24576:1wgNesWdKfX65hRpHbCmGFX0AWg/HrIda1jxAoXPQ+7SjpdN0WtPYBgYxnPTcZP:1wgNsKfX65hnCZFXbLfjxxPQ+8n0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018880, "uuid": "1b42c299-b7f7-4983-8c7d-76659f21f855", "value": 2374832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018880, "uuid": "156cfc9b-ba0c-4846-8d17-cfa6930b1da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018880, "uuid": "aec8d9e6-e6db-4c05-b53f-94d2fa6a6e35", "value": "986aa239e5d766f0f1e27bde816f80d4f6769dc62739752825841fabc0e94fbe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6ddd20-243a-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1773997014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997014, "uuid": "4243ceb8-ce42-48f7-8855-da5b62562a08", "comment": "Malware payload (Stealc)", "value": "4ef2b95427f8e1948fbe4941cd81e9e2", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997014, "uuid": "c48830a5-b248-4aed-a1b4-833f84171b84", "comment": "Malware payload (Stealc)", "value": "98a0787160f52c10636796eb65d09747903c1d005a540b4e65e85d70ed793fef", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997014, "uuid": "b391b419-af11-4320-a020-b4e860765104", "comment": "Malware payload (Stealc)", "value": "d57d442c587541b9b96d527fb8af14cd47a9087f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773997014, "uuid": "bee7087b-acb0-4cbf-8b2f-a2568a730cc5", "comment": "Malware payload (Stealc)", "value": "af4aadb0426cc675c8aae086a7a1dffa151e908e46b8dc331be157c68ce70785ddf6429c130c66dcadfb370687d9149e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997014, "uuid": "609ca939-b6fd-4428-a7af-bcdf5f47b07b", "value": "T1E0B59E97ACC15175C466633689A262927B75F8488F3323D32F92AB382F77BC09E75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997014, "uuid": "dde6e78c-ec03-4897-8668-ddaa495d74eb", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997014, "uuid": "4bcb7a2f-be42-472a-b92a-fa8bfa9bdbb7", "value": "24576:Lp7sLAJG8/R+0gSve+j/g4BeAk61WXg+LcwKei/ardZUcHwdwwOGiWzAOhz4y:LpILAJxHgSvC4gAkrXZLcwKH/a3I1l0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773997014, "uuid": "22157627-90ee-4d64-88d0-e998f5704adf", "value": 2357384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773997014, "uuid": "fefbedd4-1c87-424f-8394-5c2a87413a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773997014, "uuid": "af7af341-9e04-42d1-85b6-12cfda57e8f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "825f77c5-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046735, "uuid": "247cdce7-7da7-491c-8769-59475175f876", "comment": "Malware payload", "value": "31ae1e16ebfa02a7beda05069a4a0135", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046735, "uuid": "5d716e58-20b4-4c8b-97c1-17ee6bf8592f", "comment": "Malware payload", "value": "994361fb9dbc42d03174be9f6550ce8fe3d339bd5da4f16636fdab0b5c7ff26b", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046735, "uuid": "d42f662b-59d2-48c6-a7e4-3d948d160424", "comment": "Malware payload", "value": "ef061ee809bf3294ee4ecb0248b790c843e5cb14", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046735, "uuid": "8b343e72-5021-4da5-893a-e18bfa864b73", "comment": "Malware payload", "value": "aaa61fdcd59a1fbf75f52e6f20bfa52cbc39380f74dfc179386f558dabd79edb174b057cac983bd52aaf92aace4a6bfc", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046735, "uuid": "3c58bda2-be86-4d63-a29d-538dd223746d", "value": "T14E752322AEEB0ABC07F40A35603BDB4D56100767E06E6D973BFDD4D7573BA8A42470A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046735, "uuid": "411b446d-1601-43fc-b4a2-1f102ede89cf", "value": "24576:OsLj9pL2OU1J3GX4XgMtktRVtW52JtaHwDG3Vbu6kpJfiSMLNlyoHy:RjFG57Typtaj37k/qbyoHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046735, "uuid": "061967b7-3c3b-4485-a01f-aebfbf5f59ae", "value": 1619757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046735, "uuid": "619b0269-d60d-4d33-89ba-7232fa8c0ca4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046735, "uuid": "e5e97746-6681-4f93-8249-cba58cdef40f", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "918e9e12-242f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773992214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992214, "uuid": "54d4dbbe-b44f-4025-a235-eda01a7db240", "comment": "Malware payload (Vidar)", "value": "a60296e876b53e8b28728942180c52e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992214, "uuid": "6ea3cf77-6cec-4259-9444-cae861ca6c42", "comment": "Malware payload (Vidar)", "value": "997a685645e23b7d857b05cb46e48831891bc196a601023071f5595a5b820186", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992214, "uuid": "8fd1ad18-0398-407d-9628-38674cd94b88", "comment": "Malware payload (Vidar)", "value": "aa9c529a4dc02596c262d98e28361a5af97d1747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992214, "uuid": "2b4dd900-9c5f-4cd8-b1df-4ed8d814d0f3", "comment": "Malware payload (Vidar)", "value": "732dde20bff161f75edab592c56f698060bbd0985773230d81a8464054893731cf76d81dd5e86e38cfc2e595a66f1762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992214, "uuid": "1c8942d7-4562-40f9-a2a1-f8ae851e701f", "value": "T192958B03BCD565B9D1AAC23289B112A27731F84E0B3037C76F95A6B92FBA3D41E35354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992214, "uuid": "253c2658-fe77-446b-809e-3b883660e163", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992214, "uuid": "12c1cde0-74f3-44d0-a14e-e3446e11542f", "value": "49152:BM8J6STo5UF0ZC6jfop2JK+VSsMYgt+qK11:VYoQJTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992214, "uuid": "3a4e4d16-81ae-4b70-acbf-a28ee8bce038", "value": 2005504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992214, "uuid": "4819c211-03e0-4865-a118-a48dbf21cbe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992214, "uuid": "6c945aca-9614-4a8d-8bf7-812072745c76", "value": "x997a685645e23b7d857b05cb46e48831891bc196a601023071f5595a5b820186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aafebfd-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977922, "uuid": "b55ad051-38ec-470d-b627-4b470e872891", "comment": "Malware payload (SharpHound)", "value": "453fb67e0bfa5e249f8d7489a01511af", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977922, "uuid": "77ac30eb-e6c3-448f-a2ab-b9601d04b9dc", "comment": "Malware payload (SharpHound)", "value": "99fc0e76a78a756c4c558c6cc82448b0000846af14388d929ea9107ac0484ddc", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977922, "uuid": "9a3d3a5b-ed69-4f54-a184-90e40f906b9f", "comment": "Malware payload (SharpHound)", "value": "3a8aa5a685b04bd7f5ed190bef543e7346fcf11b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977922, "uuid": "b93ed069-077b-4666-a95a-04710fea4a53", "comment": "Malware payload (SharpHound)", "value": "e7b22a9971e0c2027a77b0db57c9415f8ce5c74877112831e1949809d6e36cd4aa90ddf25d7602ab39068d08710399f3", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977922, "uuid": "09eaa79a-8af1-4fc2-8f53-124dcb1cf3b5", "value": "T13655125893F84795F6BF0FF9A42681598BBA7527ED1DEB8DAD4CB4EC28823548500333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977922, "uuid": "58c754ad-bc51-4c06-8f4d-3118a34ce661", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977922, "uuid": "fc1f7d42-d9ad-4846-847e-9c330ab60a47", "value": "24576:vyqgnLIGEDwgrRvNuXoVIa09WmPstYX3Afr3ppM4zH0CYzkong/iN9WC:vyyzRvNE9WmPDXur3pTazFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977922, "uuid": "fe6fb12e-16fd-4adc-9412-9cb2a605f19e", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977922, "uuid": "8cd7f282-90c7-4bbf-a0de-86b7771506b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977922, "uuid": "35c5e8fd-ae6c-423e-bd17-ec00ccb3bfa8", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a8662a-246c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774018562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018562, "uuid": "6cad409e-ec18-4b9e-91fd-b1b6c9ea71d9", "comment": "Malware payload (Mirai)", "value": "9effc042ea26f374b9bf9bb2824c7363", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018562, "uuid": "525aacfd-674d-4eae-9088-da3ece6af59f", "comment": "Malware payload (Mirai)", "value": "9a8fbed32ba36a659254f3808353ae31a3d95ee92f95360a908e386450939858", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018562, "uuid": "9cd7a733-d782-45b7-9300-5089893a1d89", "comment": "Malware payload (Mirai)", "value": "6cc034fdf80f53fbfa55474459f93cba177a0f6c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018562, "uuid": "994788d7-c231-4fca-855a-036dbda9d87b", "comment": "Malware payload (Mirai)", "value": "ed83cead1219f38145a9a35ad0cc34c25c56c02eb40bcdb9079aa196c204b4e47a5ad6fa6a18fe3104367395ceedd434", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018562, "uuid": "fb6a1a8f-ea54-4ec9-b592-adc0ef0b0c52", "value": "T1D4A308CBF900DDFDF81AE70A8853040AB130BBA644825B376257797BED3A1D91477E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018562, "uuid": "419dc909-9366-4050-b8ff-b954a2b15767", "value": "3072:6x3J1ZduMz15s2g1UiZOqARXG9qAHZVqjbiTLP:64c1klZOqWX9AHvLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018562, "uuid": "41bbc924-9fe5-402a-a346-7868d4a3a46d", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018562, "uuid": "738c23ed-7f08-4091-bbb7-f8c9566ffb08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018562, "uuid": "507b7332-ab1f-4577-9681-f4150f7a65d3", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1293c6ca-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978257, "uuid": "4c17487e-d44b-4ab3-b542-98e2fb69f217", "comment": "Malware payload (SharpHound)", "value": "5685a977b842b783933863cbe7791020", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978257, "uuid": "cd7006f1-3ced-4fc9-a005-69b5c8a2afd7", "comment": "Malware payload (SharpHound)", "value": "9ca88740bb1e84781382200f5d1891886995b826503efbdd335a6d9838488814", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978257, "uuid": "f7302c52-5e02-4cd8-8a2a-27a291d93f4b", "comment": "Malware payload (SharpHound)", "value": "733e9d35180aaee84bcf4f8fd3fc9076d98443f7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978257, "uuid": "5bc0791b-ecb0-4245-b4be-e94de5fd0b8e", "comment": "Malware payload (SharpHound)", "value": "dc1e851c3653a3d9728753d8124d553835f6a24851e2f029bad1ad6eafedaf5ec6087baf856476874c66836738aa9fb8", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978257, "uuid": "12727ee2-d3a7-42cd-9982-06a0e62f4614", "value": "T1D675331259196AFA27BC533820574F0D4EE0CFE3A85895AF70DD90C8EFEB75180679B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978257, "uuid": "a563786b-66fc-4917-926a-2ece7741d0b4", "value": "24576:hG+bNI/OB4sq6BHyXxhk1baqOkaIGqrMsPby6Bx6ZScOi/tCdapJZZMx6efA:eem0yqNjyVKvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978257, "uuid": "d7bd7085-fdba-4072-900a-e7bcf24a7e0a", "value": 1593297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978257, "uuid": "8a772ca6-c80c-461c-98a5-2f7c0ff5e141", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978257, "uuid": "269fc511-14db-4a3e-8f54-167d9dda7b35", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bdb706-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050396, "uuid": "2829b51b-c7c2-4fab-a3d7-39d7f234a353", "comment": "Malware payload", "value": "32419f9a19e1c19b4473f60f00aa27b6", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050396, "uuid": "c5264585-8ce9-43a9-812d-9a4e5382e631", "comment": "Malware payload", "value": "9d86dc61e9d19a16a20e896e2a7055c1dfa95b89124f4dd8ab2fcbff8c77546c", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050396, "uuid": "1d58d001-d186-4efb-8110-ec4279f63e26", "comment": "Malware payload", "value": "857c7d49bd948ae4f24b4060aa4e1fc2f3248e73", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050396, "uuid": "059165c9-29ab-4131-93eb-6fcff322de39", "comment": "Malware payload", "value": "0259170775dc5083431154cec5f484ce2a50d237e0471ebd54aef8579b73cf7aa60e49a84d236a21dfce2e13eff767bc", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050396, "uuid": "9370f599-a818-4550-9e4c-1952f7096b8e", "value": "T1CCD65B53E86551E9C0AED13486629313BB707C495B3137E72B60FB782F76BD0AAB9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050396, "uuid": "3235a867-addf-4ac3-84d9-becbb2ad6309", "value": "98304:HCn+ILv1sTj6mC2ktNaAnElYM8kwApv+g1SmYud7wvrVjgEl3EkBeK:HxTemCttNaAHvkd+g1NYI+l0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050396, "uuid": "00e19a41-b5b0-4b1e-85be-8dcbc46bb6f3", "value": 13474672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050396, "uuid": "a0a8ef56-237f-488d-9d11-c2f5bd6ff5e0", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050396, "uuid": "65188249-2566-4c13-ad1c-402d8799bc60", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9901e689-2427-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773988791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988791, "uuid": "1cc577d9-9534-47ee-bc2a-acd4362962b7", "comment": "Malware payload", "value": "1b2d333a7aeaf579b30c5132e2d344f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988791, "uuid": "5bc8f86d-0882-48bc-b73c-03ce6b91d936", "comment": "Malware payload", "value": "9ddb3ce1d5a6b94de8e55c093b20ff289872814d4d2f849407e08e87b6159650", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988791, "uuid": "c49e4e07-b95c-410f-9c91-1de860455972", "comment": "Malware payload", "value": "37601f3bb20ffbb7c8d6e8dcfa52e63fb12b4768", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988791, "uuid": "2460238f-9766-43c5-b3fb-69462043f3a3", "comment": "Malware payload", "value": "34be7486d23aa93ca3e3a6d2a09087031bf3f0727464563ab2bdc9e8f3e1ae1a674d51bf2b5102051f305c54eed70522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988791, "uuid": "6ae3877e-487b-4cfb-9132-7284d7e74b32", "value": "T1418533E45A065FE5938BB99ED67610C412F1D04327BDB0089FA74744F2BAAE7B01E4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988791, "uuid": "d71528c6-aa80-48a3-b856-81f9274b75ea", "value": "24576:Vdw7WEgzzothv2GBHvpK+UdYviu0hhav+lw30Q4KiQgDbISGT1W4ITOjTyuFKpmB:V6GKZzUdGkheN3hA81WlOHyWRU1vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988791, "uuid": "386cb1d0-d6c2-422d-9ef4-3e25125a42c9", "value": 1751696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988791, "uuid": "fd1e4697-b326-4814-991d-f21364035cbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988791, "uuid": "dab47eb6-57de-41c3-87a1-9c0b02009e72", "value": "linux_ppc64el", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6b7a75-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978004, "uuid": "98d2e124-43f9-48f0-9528-908079a55642", "comment": "Malware payload (SharpHound)", "value": "05c7db872809cebc5cdd2ba935d58822", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978004, "uuid": "aaf1d877-0569-4fd7-ac8d-e146b425ebcd", "comment": "Malware payload (SharpHound)", "value": "9e13e10fa5ebd8dbfebc0d0241ba3c5625571a3365c24cda3c53616c27dca5c9", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978004, "uuid": "b3ef3b8c-bfcd-4c95-bfb7-2709a11f1630", "comment": "Malware payload (SharpHound)", "value": "4f39ffc1522de3459990ce96dd5585f4598f605a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978004, "uuid": "4c74e0f8-7344-440a-8a53-6115a35c8d14", "comment": "Malware payload (SharpHound)", "value": "71643e0245a140cc8ae2a74a63584b9c1dde396e4ce8bd9753166d29e690d1e56dd75164b3b578b9a677bffe4ff65fbe", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978004, "uuid": "21bf48d6-59a7-4746-ac60-e487d3253acb", "value": "T11755121943FC87A5F6AF1BF8E4618195CBBA752BE92DEB4D6C4CF4E818923948510333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978004, "uuid": "ee1fce78-88a1-4877-a288-450461f8c1f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978004, "uuid": "7f9f2c9b-8e94-48c2-9e0d-272e618566e8", "value": "24576:eMjn2LIGEDwgrRvNuXoVIa09WmPstYX3eWKMFnLxXdjkong/iN9WC:eMNzRvNE9WmPDXuKXFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978004, "uuid": "ad7c1280-211f-43dd-9691-081a38813eeb", "value": 1336832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978004, "uuid": "03ee45e8-e6d0-45b2-bab2-9b9b4636187a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978004, "uuid": "7acd3e6e-e7f5-4a9a-bd43-a8569a640199", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddb78fe6-245b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774011240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011240, "uuid": "7a171a1f-0501-465a-92fc-40f41be8fd1d", "comment": "Malware payload", "value": "17698245ad475de06de44c38ad39cf4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011240, "uuid": "fb6fbc24-c05c-4f36-86cf-d1b5d346aaf2", "comment": "Malware payload", "value": "9ee28afc75d82838e07a0db2e9e5685eb008c12c4bef528d9af97670a562b155", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011240, "uuid": "09f5f191-88c9-4304-be8a-6cda772d8424", "comment": "Malware payload", "value": "a384277d7708330ec508178a24b2da529c38b661", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774011240, "uuid": "0329d0c7-df23-411a-965e-8eff05b6c2b6", "comment": "Malware payload", "value": "578f1367bbdb427d40bd042101a93b4066c21639333dd015dd04a4fb75032dfc4869ab38fbc75754a97067804d3d777d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011240, "uuid": "baceb98d-64a2-4264-9c76-4eea3ce09185", "value": "T1F3068B327850C075D3A20170ED6CAF666FADF52F0BF219EB77C00A6D5A70AD27936606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011240, "uuid": "afb60ae4-df05-4455-bfa3-04b1441be8c1", "value": "49152:ExwM9wJQyhacHVV5qVZ9Rvbu0gHSJEvIsar5nNQFDwPQdVCaQVgms19:iwM94tac1HqTO0wIAt0QiaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774011240, "uuid": "5283e679-7449-46d6-84bb-2d86c81a429c", "value": 3887104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774011240, "uuid": "d65e93a5-a065-4357-a523-d1822347e0b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774011240, "uuid": "9a63434d-5795-4a3c-b63c-bf594cfa9747", "value": "unk1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfe95db-249f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1774040310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040310, "uuid": "6ca53f27-c336-434b-8025-5b6f02db9add", "comment": "Malware payload (GCleaner)", "value": "ec0047471fd06927dcb6dad869f84231", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040310, "uuid": "50252d59-45df-4c59-989b-bddf797307c6", "comment": "Malware payload (GCleaner)", "value": "9f27adf5141ad1376a2d31bec739b0c464e4903e0afcd267abf380ff867a89e9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040310, "uuid": "dbead14d-8246-4f4e-9238-b76ea76e9790", "comment": "Malware payload (GCleaner)", "value": "812e1a9bf2b6a9d6c7b594cc67081c84a0ed037b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040310, "uuid": "198a243f-ebca-4b4b-906c-c53f009c8a61", "comment": "Malware payload (GCleaner)", "value": "bfec0e24690f1b7cbbe2ea32f972b21e55ab41a871492959ed803cdb6a311637534f7140507aef6b384cc3640c5654b6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040310, "uuid": "faf4b45d-aee2-4a3c-a826-57f18d134c9e", "value": "T1B715291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040310, "uuid": "00c10f11-e31e-425c-bda1-e7270f554c3f", "value": "62848721a0fe32270ffbda7abe4e1f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040310, "uuid": "94dae794-be40-46f6-8cb1-35f898221bd9", "value": "12288:7YEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988faN:7bJIJ4TiIaBYfTz9wC3pKqH8faN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040310, "uuid": "244e644c-fd28-44c5-972d-e62c939b5532", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040310, "uuid": "f0492222-cbab-4970-8d1c-77d7ee0bf2af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040310, "uuid": "56ac8440-37fb-45c1-b416-ca8a4f43d17d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeba2f00-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040904, "uuid": "b741c44b-6a5e-4db6-b2ca-0cca313d665e", "comment": "Malware payload", "value": "d463faff63ea801caffb17c60ec1f6ac", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040904, "uuid": "478a9ae9-847f-40dc-b498-b9ad7353cd6a", "comment": "Malware payload", "value": "9f4436b042e77bc4b24bf1457d9036db8d32f3c7aa1d400bf440c3bfad5fcca6", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040904, "uuid": "10547e00-0ccc-4a8c-bed0-6d9f7990708a", "comment": "Malware payload", "value": "264aced566245b22795f3e59aedf13065e7ad6f7", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040904, "uuid": "efccd24d-0ab1-422f-a1a1-0bcc8e50ae2c", "comment": "Malware payload", "value": "b117eedd64bad6db883bfb3807199b15e7fdf7d3f1e58bd69032a4c19d869043ac3a820b9bb85673c2e748c469661b8f", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040904, "uuid": "8861a8fc-4e5e-4b36-8d0b-a157a03ba49d", "value": "T1B625FA5C740CEFB25025C97C1C950E7E19A3AF1F2665182870ECB61C7FECCAD60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040904, "uuid": "4ba7d435-ae14-47ab-ac6f-0d2ea03ab671", "value": "6144:hYcdkxUExLExDExHExxRxiExgExbbxzExTbx3ExzExrExIbxbExLbxFopcbHpWQV:jC4ihTi2bY3n+LT5YDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040904, "uuid": "7489082e-4893-468b-8f53-82b670a91902", "value": 1005683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040904, "uuid": "9e380b23-760f-41b9-adc8-aef04540749a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040904, "uuid": "ebad447f-ab89-47ea-b08a-2470608cb5b2", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941951b3-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050630, "uuid": "55d33b2d-ab24-413a-9461-c8dd5c3aa412", "comment": "Malware payload", "value": "37350848a3336f6973dca8c38e7c1c68", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050630, "uuid": "b19bb571-b54f-49ab-b37e-ff956917bc96", "comment": "Malware payload", "value": "9f80da4e3bb62a9eeaa2dcd7fc72a0f1decfb7a10d5a637af651f8a4363ea6b3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050630, "uuid": "9d3bb822-08b0-45b1-af48-31354dec99cf", "comment": "Malware payload", "value": "8d832640768b3354e32d270d6b23aa22a9949be5", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050630, "uuid": "8613e3e4-37c7-4716-88bb-34591c93c0e3", "comment": "Malware payload", "value": "7fdfbbe93961b8640bd9d0c7c923c48638f26548c4e2370cedf6ad375e001ec7d8908819a1474df0c99f664b6e987843", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050630, "uuid": "8c1d1edd-968b-4ea7-b6ff-15d98a239f5d", "value": "T1F0C67D557D1DB262DAC979347F625294323CBC449F82C2272658BF7DAAF2348CF23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050630, "uuid": "2fef4963-c48f-4e7a-9ec4-4e2eca413a06", "value": "98304:S5MOMBrVyi4c+kD5QE97MRl2yuJOmdhUh2P7SqvOiamaYLoTeEafT4etlNLHtNKD:S+rVyiEc59JmhqLOiaOTZNtoqtL8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050630, "uuid": "bdbd6081-7bf5-427a-b472-aad29fce50f3", "value": 12320952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050630, "uuid": "752dc885-aa60-4ff0-b1bf-34e4e4daafd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050630, "uuid": "c60d8036-5f36-488f-9baf-335d2a8f2d25", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce34bcc-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001145, "uuid": "ee0f62a4-57d6-4fa6-bd67-f1395bf5212d", "comment": "Malware payload (Mirai)", "value": "785afd1b9e40b0a5488c217452aa8f3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001145, "uuid": "afce481d-dcdd-4707-ad6e-15742ebb9631", "comment": "Malware payload (Mirai)", "value": "9ff2f4873bbe69d63f49571a747c6d928ebd872c317b01486d94a845f9c0d0af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001145, "uuid": "0e23ec58-2927-45be-8730-4191561a835b", "comment": "Malware payload (Mirai)", "value": "a3c90bbe5e229ca1da9aa35b1944960d6ec58530", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001145, "uuid": "ee0673ed-9da2-49e4-bed7-cabe11c19c26", "comment": "Malware payload (Mirai)", "value": "20b58e2b4bf88b672fd47879be721b6f60f6691cf35e8fc93407b95768b96e44c085c9398c181e82f69c5db69d2e8a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001145, "uuid": "b41cc462-c132-4fd8-a229-a90eceb7193c", "value": "T1D5731988F70791F1DD0B0D30519BFB3F5A31AA908120EE6ADB94BE51EE33912551BF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001145, "uuid": "28b5c9fe-2ce6-457b-9f4d-bbe140af83da", "value": "1536:6Z//8rySd8DNw3fv40Fh1cUq31gGYyXBRQ2tUjr:vxENwPNmKG7Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001145, "uuid": "28fbf0d4-3412-4d2b-bf96-78652b3f5b9e", "value": 78952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001145, "uuid": "638e3bc3-29e3-4d06-86e1-b36737807a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001145, "uuid": "794e451f-6aa9-4ab3-a3ab-420c842523fd", "value": "j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6698cc07-2419-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1773982693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773982693, "uuid": "594d654b-536a-4f04-9ac2-48accd7a79e6", "comment": "Malware payload (SliverFox)", "value": "1bda8801aa730a2b01d0169d87694dec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773982693, "uuid": "4a2ce99f-8a61-4d14-b995-1eb752de1d06", "comment": "Malware payload (SliverFox)", "value": "a00ca25dc338e58587f4e260cc6d5bf59999cdfe71f575ed50c9c805dde18cf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773982693, "uuid": "952aaa5b-517f-49c9-a909-d3fdc56cc502", "comment": "Malware payload (SliverFox)", "value": "2fea4e61e2d73b8b63186cc682bf21458f00f985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773982693, "uuid": "4f1d336d-9b58-486f-bc38-dce42f84cc1e", "comment": "Malware payload (SliverFox)", "value": "f8d0272ff311f0384e042fe4c2fe6d60502f3885506ed75adff1b15d1aeb413187dc0140cca3f2687bab25aa89c358e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773982693, "uuid": "204989ea-54e9-46c3-8273-3a8a0232a4d0", "value": "T1E5559D1ED68792FEC51BD0F6A2268B7398317D08C374462753812B751EA326D9DBAF0C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773982693, "uuid": "8dcaac03-4590-45e2-8131-05fefded86bb", "value": "d2eddd6214e50b2840380d8e7836183d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773982693, "uuid": "2059f699-2420-473a-b510-1fd9575d8bd0", "value": "12288:Kwwi4hmuCfdAF00KC1w4Vz7TbieD37OuBM1JhjMctlgPYVQ:CiN/fdAF00Kuw4UeDuLdw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773982693, "uuid": "a7071287-7a52-47e6-90f6-e7361be55b67", "value": 1296896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773982693, "uuid": "c4d85037-8bd0-4eec-b603-cbdaf5abbb18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773982693, "uuid": "b07cd8d8-2621-4227-b10a-e16efe169c45", "value": "2026.03.18...\u4eba\u5458\u540d\u5355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a972d5f-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047098, "uuid": "a2daa105-c39a-475c-92a3-e0522fa87339", "comment": "Malware payload", "value": "a70239929cfb2ba579b046e49d95d3c5", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047098, "uuid": "673077ed-910b-4d8b-bc80-9e4b6944767d", "comment": "Malware payload", "value": "a10c4d3c16748585b16783d5bf1aa1485c47818dc6751c6fd7a19ed03b553bd7", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047098, "uuid": "6dd30160-3523-4f52-8060-4e429646b0d3", "comment": "Malware payload", "value": "8cc29dea2b89dbd4d2814e0b6a6dbe884a96dbd5", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047098, "uuid": "f73ca61e-74bc-4047-8b08-e194448c2fdf", "comment": "Malware payload", "value": "b4be92068ae37db620f28849c551f326498c1ac2a08a35391321f8a478b54acc101463a34579bf7c3ee95e435ecbd74b", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.8", "colour": "#B18BC1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047098, "uuid": "df7b9a88-8fe0-4f8d-8e13-558512b1df68", "value": "T1E595337019E7B8BD0E7C4730702B5A4BE6A00F8350CA92EBB2EE50C517BFBC65516979", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047098, "uuid": "0e4f1561-4a3c-44b0-93a4-344690cc418a", "value": "24576:Wmaj7nvA7Pq6BkcXWb7twf7rusCObzYA5jXMe34aD//Pr0LcOSGwAi8ruCgTD2f7:vBkcmPtwC68AP4abrbGG8ruVmTse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047098, "uuid": "59243555-62f8-4766-b773-8927f2dbb233", "value": 1941797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047098, "uuid": "94dac524-da95-4a73-8c5d-65305d7f3080", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047098, "uuid": "09acca6e-04d0-439b-898b-ef231116ca23", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003835c5-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040933, "uuid": "5cc3dcc1-7f6b-42cd-9152-527cc5115bd5", "comment": "Malware payload", "value": "65f2bfcb2fa35dd59f9c6dcb58971421", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040933, "uuid": "1254e02e-361e-42a5-88b5-7b490098c506", "comment": "Malware payload", "value": "a128e64d3ba6a1e153dc96bb19b685f4d7a9a3aa7ff86471ef4b2245aea21163", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040933, "uuid": "5879c88c-f78c-4820-804a-a3588fa80d1f", "comment": "Malware payload", "value": "3c878cf815d6589bba7eb2080ad3de3897e47540", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040933, "uuid": "6b65c3bd-5e17-4a4e-9d72-d74a3e1c9117", "comment": "Malware payload", "value": "e6bdb6363acff08a2ff5546fdf7e27c16308b3ef738dd4c71f8769165e2a933e31a58a7266be09567b4760fa46f8b914", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040933, "uuid": "6b0c9642-c030-45ba-8bc9-9a9ea92a3bd8", "value": "T17A06AF45ED8724B5D603163A49EF56DF0B2CBE0B2F31DB83B9443B6AA17749704B622C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040933, "uuid": "99c1048a-ca81-4c84-b182-3051826e7f04", "value": "24576:f8HerEUBLQlcAwC1hKYIA5oZQ0sGtaVJpddptySBO3n1WvxMQZbQ5RT4MwFDMJ6T:faiLb/Fmd+6EAumo/61cpxwLa+2E6Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040933, "uuid": "4a005e0a-865a-48ad-92f5-d334ccd08b84", "value": 3755184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040933, "uuid": "274ae78d-dbe1-4a57-b68c-dedd65bf0762", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040933, "uuid": "0af88fec-9eb9-4b02-b812-6083fbffc637", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8679f61-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046799, "uuid": "d557a6ea-ef9f-4155-bb84-b502233638b4", "comment": "Malware payload", "value": "705a54b72158dfeee8f938a6c18c4400", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046799, "uuid": "cc56091b-74ea-4c48-b61a-fdd4dd0c3308", "comment": "Malware payload", "value": "a1e04dcd6881671505c6a649d7331d6c1ac4f34aa2964ca69c44c0ba07e606c2", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046799, "uuid": "f911f1f0-266d-4060-8ab9-9ba440445330", "comment": "Malware payload", "value": "fcfecf967c49918f1c7cf24291c0f38e2328f612", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046799, "uuid": "2f12b455-4f39-4dae-b05a-d5b2b3877528", "comment": "Malware payload", "value": "9d69d3e26717d6657b9e3ba0d548646d5784ac51fdf9b17b8366d7d38b3afcf7c35d7740d4b31b4c3fe8b1125998f582", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046799, "uuid": "056aee2e-f29d-4fbb-bcf8-b01738660a72", "value": "T1447533112F5AA97D4FB19338606EFA18CB1A4F179059835B3FFEB0952B36A01C4A3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046799, "uuid": "a485e45c-95ef-4809-900c-2311cbf40b55", "value": "24576:v5L6TW2XABiNQ79Cwpc6NQDBiiXrIoN0c5u88+P9Lun+YVsDAn3E4GzJb8mAjenm:BL6l4OrN0Iu86ODAn36G8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046799, "uuid": "58d902c6-16af-463c-89d0-4fa35cc89fca", "value": 1580037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046799, "uuid": "8ca3e180-19b7-4656-8776-badc501cd103", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046799, "uuid": "c136a0c7-90e9-4cd7-9351-3c6e239ddd42", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3546a126-249d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774039304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039304, "uuid": "6ec1f79d-b350-4e47-9b9a-bd769b2f9466", "comment": "Malware payload", "value": "1ec5607bd9c37d6aabc43066fcb87ca6", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039304, "uuid": "216fe869-4b49-4c9d-b5eb-db983fb32708", "comment": "Malware payload", "value": "a2306445f6a9a9313ec3709c84bc3e932f75240fcaf2543bb1cdc3c362b64552", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039304, "uuid": "d67e8618-7105-440f-ab9a-b78b60addbbe", "comment": "Malware payload", "value": "694feb5c1f2b605eb58b4218fdc3d056f5d19aad", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774039304, "uuid": "e4244797-133d-41cb-a382-84551bacf33c", "comment": "Malware payload", "value": "68f19799aa6787b767bc405f6b66a9e1fb2af1fafe7d377d80691de45f8a70f441e955ed73e190fce661a68bc06a0327", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774039304, "uuid": "fe235a83-0591-4efb-b595-bd8dec9faffd", "value": "T1FAC6339076B0C8DA1D9AA3642F6936F4B76042503FD4D98FEB222341C9377D2CB9D987", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774039304, "uuid": "06bcf503-18f3-4780-b996-53e322c9e489", "value": "196608:M7uilBxtlDlt3WyUQAYnkhi6njHS5XjvOUb1q32Xonn2rE1GFQKKJ53GJmLIXeFd:guCBxtlRImEi6oXWybrYL8uC8Ak8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774039304, "uuid": "7cc37380-3326-4d32-8d42-0d03efc12035", "value": 12588972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774039304, "uuid": "cad0dfc3-54bb-4491-867d-ee6ef47d55d7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774039304, "uuid": "800e5f26-f783-4f16-b84e-27f19d6ffdfe", "value": "Spisok_na_perepodgotovky_mart.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "599f0ffd-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050532, "uuid": "c7f9ccf7-a14c-4151-8c5d-6ec1c6edcac4", "comment": "Malware payload", "value": "a924173a054dc20413bfdca96c62be0a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050532, "uuid": "3f019328-3713-4d30-a153-aece62cbaa6d", "comment": "Malware payload", "value": "a3444296a7f78243244f52c0de0ae408eacc9b980ba9d5aa45fbad76009690bc", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050532, "uuid": "35efa77f-85ef-4463-84a4-f7c0cf7dd19d", "comment": "Malware payload", "value": "b103ed0780b6b2317eabb553eeefe2d99e621252", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050532, "uuid": "b0234958-ce67-4a8b-bde3-6eb6b198cf90", "comment": "Malware payload", "value": "5466d56a3f894f2c24b2d2c196d87b2472ba232a245c4583ccd2435d060e1f2eca35d697e21cf10c27aca3035fc67da3", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050532, "uuid": "19ea2390-b223-4a53-bb7e-db3ed9af1aec", "value": "T1C8D64A03ECA585F9C0ADD134C6669262BB717C495B3027E72F60F7682F76BD06AB9310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050532, "uuid": "190600db-8724-417c-8498-0750965cfa76", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050532, "uuid": "013c6f33-e743-40e5-a105-3309c9dcebb9", "value": "98304:3hNSoQLwlJlsDbgFsD8Pv+p//EomfitvPU67NFi4F1RAY7wEl:3zlAbqsD8HwXEoVvPFTAcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050532, "uuid": "1756efea-91a9-4a20-bb47-e2f6432f1c19", "value": 13652480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050532, "uuid": "4323fdcd-0ed7-4ad6-ad79-470e89947931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050532, "uuid": "93afa03f-3d8d-4a0e-8864-45461b4aaee5", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1faf34e-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050331, "uuid": "b0b2036e-3737-49de-8925-f3343271c9b4", "comment": "Malware payload", "value": "2b8e26f03661b002c7a9a51b9bc298f9", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050331, "uuid": "8c5f38ef-563f-4508-85ec-6e76686170e6", "comment": "Malware payload", "value": "a362af6ce4c53a7de43eabacc90ef5a7ee49488316dbc065c6d7cd7aef5e95a5", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050331, "uuid": "feb77214-9f1a-4e47-ba91-b6b06345047c", "comment": "Malware payload", "value": "b4ac4cb5054b68c8c637600ccef4cf550e00c482", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050331, "uuid": "878b4d38-16a0-4afd-aaeb-a3fc379c407e", "comment": "Malware payload", "value": "f95a3a7ce8576fab11cc81eac5064b6d43b70b768a4425d9f4736185057961eaae499f4ed4e99d6483d33c3898eefa9c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050331, "uuid": "2245e1b2-84c5-4a00-ad4b-c2224524bc92", "value": "T183D66C55BC1E7462DAC979747F6653A43338BC489F81C3262514BF7CEEF23488B622A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050331, "uuid": "2157504e-6617-48ec-a7a6-cef6d84fbc81", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050331, "uuid": "1c2c54e9-794e-4558-818f-8d71ce92e725", "value": "98304:0TMdNlfPohRSwH7vOoUbktLKJwtQlNCiZTYmi8PWqt8hpL6E:0YdNlfPQvHqCeJwwTPeRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050331, "uuid": "b8105799-b939-48f7-a133-aed67673add1", "value": 12696576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050331, "uuid": "066c99bf-2ce9-4cb9-9eed-16f9dc00ecec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050331, "uuid": "74f60526-5d95-478b-9726-7c8457f9e6c8", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8129244b-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989180, "uuid": "3598e668-e756-42dc-a184-f99ee0e33e13", "comment": "Malware payload (SmartLoader)", "value": "ee744a66fdc36d8d89fd8493474d9852", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989180, "uuid": "3e4aa889-66f6-42d0-9205-79deaab46e55", "comment": "Malware payload (SmartLoader)", "value": "a4b1e1a980e7d870df771f0f9e15a456dce9632ea95fd01a3a9d3ce53adc0b9b", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989180, "uuid": "6a77b983-aea9-4efe-b4e0-c7ff11b3038f", "comment": "Malware payload (SmartLoader)", "value": "c453081aa715b422febcebc7106375febc5b4d12", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989180, "uuid": "f9753324-4dcc-4625-ac03-68d574ebf6fc", "comment": "Malware payload (SmartLoader)", "value": "49841999a74afd62dd064a2f6d423892eb8971e2a4817f00d6d36f5de1860c54fe31c0185c3876c9eeca1b1d6068fc9b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989180, "uuid": "9c905db2-543a-4664-a1ac-ba6bcc6cfc4e", "value": "T1E2C42304340641D5835A2B1EAEC4E7E0BEB5A0DBFA1CF940AADD7ED06DE92A177C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989180, "uuid": "59426112-12d4-41f1-a57c-c4aede42d6d4", "value": "12288:T6wlOMWROC/FTeHo22Qm7NzofOr68mleA924EwCD:L4MQOC/gHozN7NzomW8zA9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989180, "uuid": "25a4b95a-194e-4bf7-8162-e64043532aa3", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989180, "uuid": "dc639634-2bfa-4109-8172-10984dc778f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989180, "uuid": "782f4674-084d-44df-97b3-2c329a0fd44b", "value": "Software_3.1-alpha.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e66806-24b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774049848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049848, "uuid": "8f0f6855-8d4e-48d3-b1ec-81095cb7e3fa", "comment": "Malware payload", "value": "7bc7969f61690a109dbb47f3646ccef7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049848, "uuid": "bb9bbcf0-985d-45dd-b2b5-606343604c53", "comment": "Malware payload", "value": "a4c4001ecdfae216a6b79c8ca7afe458d03c039fa6948270db5bd05fb7b782e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049848, "uuid": "830a4680-6a0c-429b-8c49-3043e0fb46fd", "comment": "Malware payload", "value": "439d2b0e4657cd8e85d66ffefde07a115356cfb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049848, "uuid": "8db33478-d153-4ffb-a389-194c311a90ed", "comment": "Malware payload", "value": "c036d2a1225db112894be60d7af9fe6b766e65e685373e62899e75985d2a25f644fb42f6d61771234e59d306bc9f890a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049848, "uuid": "2554831d-dfb5-4c68-9d7e-76fb1af8ce9a", "value": "T1B996F52B22A4B6BEC55D813BF0A38A1CD8F375751732C7E7D5D08F694E029C25E3A621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049848, "uuid": "a6a3d921-f06a-4cd7-8f6f-57bd5bf1b6c7", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049848, "uuid": "dfe650ee-77d0-4a31-8f19-62201aa2f3f5", "value": "49152:REC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0Ppa/MiAyfSpLcP7TOM:3YCp2JD/dfSpLvg5ewBp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774049848, "uuid": "585345f3-c40f-4a47-8d35-e2623551a1b9", "value": 8881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774049848, "uuid": "509a8acf-8e9d-4559-a8a6-7a8129e3187d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049848, "uuid": "5808fdc5-59d6-420d-817f-757491bff9c6", "value": "SecuriteInfo.com.Win64.Evo-gen.49719895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f1b8fb-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047016, "uuid": "ab9ec444-16fe-4f46-bfe9-b24a39a9a91b", "comment": "Malware payload", "value": "51816c946e3d10d624ade0a8c535b1d3", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047016, "uuid": "f753a355-54e3-491d-9419-f77333be1509", "comment": "Malware payload", "value": "a51c07627bd017025dba2a0710aaafa613a6cb1bab4a1c75419e9b94f6765364", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047016, "uuid": "1f1ab436-1eff-4b1d-ba46-0b2f8c1b7962", "comment": "Malware payload", "value": "088b40ecae959fc4e2a631b7418565404cc16b64", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047016, "uuid": "0b1582ac-488c-484b-88a1-e7f2b2ea958a", "comment": "Malware payload", "value": "5fa06d673ff6f6f67aa1df20b821d22dad2492be808017e9cb75d981404d9729e4ce4f38d3beaafa4ee0b4ca92ad00fb", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047016, "uuid": "cc35dff9-f2ff-42c6-a2fe-2f8862f2c3a8", "value": "T10B9533411DAF3E6D0D7C863E10EB1A1EDFB047931048A5BBB6EE6186373FA83515A478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047016, "uuid": "b11a9eb4-1b09-4864-9b5f-b2d799cbe166", "value": "24576:2jSKxSbe97iZsXG7wlOcpMK8bfEIK1+Bre7ZViWA0UA844WjJ8NJkzsRETQlhETq:baKrfuxqXTC1ttUWUWQthc/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047016, "uuid": "7a488821-38bd-4c09-8c85-6a9091a8e4b4", "value": 1942109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047016, "uuid": "7605612a-226f-402b-b8de-1d7590a7af6c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047016, "uuid": "421c81f1-6dd3-4636-9f8e-35be7c5eb781", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415de382-2433-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773993798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "71211553-a4d3-49f7-bb6e-85b8a42ff49a", "comment": "Malware payload", "value": "ab33b8ea2c220c81033dda7fd3d80ea9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "0d6b176e-81f9-41f6-a75c-e3edac00b503", "comment": "Malware payload", "value": "a61c74d12b3e33d976eac340cb3039a7ef455b7bc362f4b956083e45de566a2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "3d64272e-0fd0-42cb-9163-ee08ce4b3ae0", "comment": "Malware payload", "value": "91f6939ed1b92fa1fa64c6ed8cd2c7268c160e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "294a1557-97f6-4506-bc40-24c71efc1195", "comment": "Malware payload", "value": "c970298f3c7e631593b61e8660575b26e4d7e834e963a5f51f76f433497ae061ffda3cda978cd21345dcdc6e1ed4c44f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993798, "uuid": "1d6d36fc-891e-4506-a5f4-32156223327a", "value": "T11A8533F3350098961480D22CFF6DAA99CDDE882749DC65B05AC3CDD198B27E7F9A0D4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993798, "uuid": "9984b246-294e-4a52-9a80-8d4bc96c7a10", "value": "24576:4rOW0Jm2KTkxenjcEUe+ppATqpVVV4iHW+K4fpf0N4kriEOVx1rLacC0htOD3Z:WAJm2zxeVUe+pyTqLM4xC/DQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993798, "uuid": "4e7ea868-2afd-416c-82c7-224da0d9ecf0", "value": 1718332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993798, "uuid": "74a1ee6c-0117-4552-aefe-84ef1869c753", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993798, "uuid": "0330f62d-e233-4a7d-939c-46d7c47d9614", "value": "linux_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2de9e0-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978248, "uuid": "3a3d1c17-aa51-4db0-9ff8-9333ae04b11b", "comment": "Malware payload (SharpHound)", "value": "b61abb4109f4b26270501fb49e262fc3", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978248, "uuid": "04664caa-15d5-453a-9cec-05f6b4ebecf8", "comment": "Malware payload (SharpHound)", "value": "a668e277cfcc0c23bda61ea19cb91ea5bc58ba3b0dd7cfa51a9c59cb217bd6ad", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978248, "uuid": "87c8a639-68fa-491c-b0cb-448e037db19a", "comment": "Malware payload (SharpHound)", "value": "fea7c0d77a58989acf148bbf5b7f1bba36d81023", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978248, "uuid": "596f4ac6-c193-4ae8-82be-c8c20547f0b1", "comment": "Malware payload (SharpHound)", "value": "c4633ba2a40331a2cc50fb514b7cca40d7e5cf19f451edb8da8facfedc3a9d62b8ec655e9659d3d51f003e0858e4af2f", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978248, "uuid": "63360525-6815-45dc-8dd1-e7dfb17cf8f7", "value": "T12655122953F88BA5EAAF1F79902102644BFA6717F96DEBCE584CB4ED2483304D851337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978248, "uuid": "2e11ccc4-787e-49fc-803f-023f8d27f252", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978248, "uuid": "ab89a0b3-a213-427c-951e-8bf4ef198f58", "value": "24576:KdLIGEDwgrRvNuXoVIa09WmPstYX3euT4irNkong/iN9WC:KSzRvNE9WmPDXjEONFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978248, "uuid": "29479a96-6c84-438d-a2fa-32c103c7f74a", "value": 1294848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978248, "uuid": "2bccdfd3-8d9b-40c1-8a85-87dc3904cae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978248, "uuid": "617c2575-3e64-4e0c-8c65-29aa740bd28b", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fcf929-2424-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773987658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987658, "uuid": "512ce572-19ad-43e0-b626-fe0e4172eba4", "comment": "Malware payload (ValleyRAT)", "value": "dd1a40abeacdcdef8db863b261a4208a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987658, "uuid": "085fcf92-5289-4b5d-976f-45fc696b75d8", "comment": "Malware payload (ValleyRAT)", "value": "a7cc50fef60f2db424d171c34140abec446daaecb10814b2d2d8a669b7c77419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987658, "uuid": "0abd3626-7a14-45dc-92f3-c5d1a7b28fc1", "comment": "Malware payload (ValleyRAT)", "value": "a2919ef2e6634598c472375376d0fe38d0e938c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987658, "uuid": "4b8fbce8-5ccb-4dbd-827f-ffe5c20feec5", "comment": "Malware payload (ValleyRAT)", "value": "b49eed88d7e16f09ebc2616d39d2f8b545e6f61f4da82bd4303e69693b1388b59320ddc9a52db3eb1ac3095dad1cde7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987658, "uuid": "49b0eb57-e6b7-4154-b8ac-8499166f9bae", "value": "T110C5E03BF28B613EE06A1A397972A210953B7A2165164C1797ECF48CCF261701E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987658, "uuid": "e5da1df2-1d01-4caa-963e-68dacdfbb3cb", "value": "b9660b6e40d534ce29db960102519907", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987658, "uuid": "c05084fc-5a0e-45f1-b30b-ce6e8cf149db", "value": "49152:md+GuI2h3BlxrwHvyun/ggS76zvJO5WImt0XDR6KG4VqYq:qf5OxlxrwPX/gL7kBO5WIw0XDR6Pkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987658, "uuid": "290c88db-e1d9-4f0a-b13e-9329ca2e2243", "value": 2631168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987658, "uuid": "4cf86e35-4c76-4aae-886b-303cc540b99a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987658, "uuid": "b60bdb44-0584-4565-b8c3-f49c943c9d73", "value": "2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3729f78f-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041025, "uuid": "0e480cd8-4b61-44d4-a0a2-c844b7f8992e", "comment": "Malware payload", "value": "6e251f25a1d1785f315fb76f7f8ce691", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041025, "uuid": "60b68fb9-649a-40b1-879c-da57057d3d45", "comment": "Malware payload", "value": "a89fc4b34679a8a99b00eda5ba62f9334a99bc122c77f35b0c09d3c696c11de8", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041025, "uuid": "3f1bcf58-41ea-4bbd-a860-22e9ce05825d", "comment": "Malware payload", "value": "396001f4f834304c5608e634a46e129eafb2376a", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041025, "uuid": "13627b52-ee2d-47a3-a35a-b71c28429fde", "comment": "Malware payload", "value": "0673a66cdc36bbc0fa99a991b11027eabd7cd6b7ba48e3363f1ad70871c66d3e5b6dd351261c8f0ea32bf4af3c14b969", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041025, "uuid": "4d3ab89a-e602-4a7d-a027-90e477e7f214", "value": "T1BC06AF45EDD724B5D603163A49EF56DF0B2CBE0B2F319B83B9443B6AA17749704B222C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041025, "uuid": "3961da12-3773-4cfa-96cf-f8ab70f91de8", "value": "24576:V8HerEUBLQlcAwC1hKYIA5oZQ0sGtaVJpddptySBO3n1WvxRQZbQbRT4MwFDMJ6T:VaiLb/Fm6k6EAumo/61cpxwLa+2E6Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041025, "uuid": "c6e19d9c-705f-48d2-b1e2-07dd8d73aa43", "value": 3755184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041025, "uuid": "cc5d20a0-863d-4c59-8670-ce6f4fadc5b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041025, "uuid": "2b95bc1f-8fe2-4c92-9cd2-880ab35fdadf", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8fcb627-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050692, "uuid": "9b955cb7-5653-4207-b41b-0970291c38e2", "comment": "Malware payload", "value": "67845ae8a4c01917de8a74ec1fa8f1e2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050692, "uuid": "bacba1e7-812f-443e-85b1-280145b0e166", "comment": "Malware payload", "value": "a8a6922004c4b8e81d27baedbedb0e5a6916f46ec0d5aa527e766691025b7ffe", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050692, "uuid": "13282a05-11e8-457f-853f-191d1050bffa", "comment": "Malware payload", "value": "ae97b324b0e3395d74d257a7c8c7a249d799ca52", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050692, "uuid": "307dc76b-0d42-4aba-b424-c749ee2e9fdf", "comment": "Malware payload", "value": "5b75785cd57e97cb8a3a4b7c4923e5bd5f287fbcd41b5a8cac84fd1d97ba488dd5b152ff44d704d66adc2395c05dbd8d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050692, "uuid": "56ee66a0-e23e-4685-bb92-0562a52115ae", "value": "T1FED64B07EDA595F9C0ADD13086669263BB717C499B3023E72F60F7282F76BD06A79304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050692, "uuid": "5593af65-710e-48fb-a3e9-b31de0a8dfe0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050692, "uuid": "747147ae-69ac-403a-acef-d273f4250bb1", "value": "98304:llkv1Yv9e+EAufFymP7QKj8Hbfl9TokMh61NTiyQ1SucvJpnuDaEEOC:lVUwufcmP7dQHLrToUTJb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050692, "uuid": "44a33ce8-f30e-4217-bfe6-cc3757c6ce3f", "value": 13631488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050692, "uuid": "89b03776-65d4-4514-82c8-ee6fa9ccf9ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050692, "uuid": "9680fd86-983d-4a86-82b4-69cd7ca1022d", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88831cd7-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989193, "uuid": "2bf79417-4e92-424e-95e3-b98d12f7fbda", "comment": "Malware payload (SmartLoader)", "value": "a50ba4e0ef2b9a6626e0f732d8a4c7f8", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989193, "uuid": "497d3a88-702e-4bfb-959c-f61bc218e69f", "comment": "Malware payload (SmartLoader)", "value": "a97a05a371577732b630b5dcafabf03133798afb5e98651517d467fab21aafc0", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989193, "uuid": "971da0be-4a45-4800-a07e-fbdf8dc737b1", "comment": "Malware payload (SmartLoader)", "value": "6c0d1617ae2fbb53cc4f28155722b23105e0efb9", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989193, "uuid": "bb87f3cc-acc8-4ef1-af13-9ea1314ebc48", "comment": "Malware payload (SmartLoader)", "value": "f601d45df196745ce3b175e128647461d4ee179d4c79cf8d410a692e784515abe61129955642c7bf6ffb5b13ed760f67", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989193, "uuid": "f1b4e9c7-fd24-47b1-a6c6-1a2bca8e109f", "value": "T19CC4238BA3FD845390BF1F58AA5BB48D091976F34722DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989193, "uuid": "a5005f2a-a045-4cee-ab1a-720a32643eb0", "value": "12288:3+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byXH9I1P0QKw6FE3:3+QqldA/TSO713u7xnXH9IaQKH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989193, "uuid": "af63a370-364b-460e-b9e7-47597281e27b", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989193, "uuid": "196adfc0-f460-4cc0-b20e-a3a4e3a68193", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989193, "uuid": "3ff88992-f051-45d4-afd9-d54a63e12cdb", "value": "App_Chatify_Frontend_1.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2348c9a8-2431-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773992888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992888, "uuid": "d777b4de-94e0-492e-8457-6770d7023fdc", "comment": "Malware payload (Vidar)", "value": "29fc7373454cf7274a4ed670526b355b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992888, "uuid": "2982d929-3af6-4127-a7b7-c7a1afa84bb9", "comment": "Malware payload (Vidar)", "value": "aa8e3bd14e7a7271e21f60a02ee3d8cd056158c95e59ad391cd7c4eb9216f870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992888, "uuid": "9545ed94-8c4c-4ab0-9ceb-3c99d176bdc4", "comment": "Malware payload (Vidar)", "value": "f4310c67294de36d85b7bc4445b9ea31175f1b23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992888, "uuid": "c785ad83-f58e-4f0c-881e-8c1556d45027", "comment": "Malware payload (Vidar)", "value": "ee9362412c14a1f8a5db920474188edcd5301978916b43d14ef3ff2b69d2707dd1f04f2ad823ef3c62d59a47eaa2af3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992888, "uuid": "364b020a-44f1-40ec-b2fb-d154efea9f65", "value": "T10D959D07BCC114B9D5A9E23288B512A17B31F8590B3137D32F96A7B92E773D44E39398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992888, "uuid": "d91299fe-b8d4-43ac-87ff-09f5e78186c6", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992888, "uuid": "a9c7e3e1-1fcb-4b05-93c4-9b2910ddfe09", "value": "49152:cjJ29t1ioCUgMZ0mWh+sCcVbwvoAYgdkzK1:AFUgMZ0mbDmwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992888, "uuid": "09a771b8-e24e-4fdc-aaf3-4145efc050b2", "value": 1944064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992888, "uuid": "12673a2d-0823-4daf-a3fb-f9a22dc15a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992888, "uuid": "6aec6e09-68de-42ad-ae8c-9a23ddaed621", "value": "webanalytics-cdn-clickfix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e437de8-23f8-11f1-a769-42010a9c0008", "comment": "Malware payload (OffLoader)", "timestamp": 1773968479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773968479, "uuid": "e7bbdf90-3eea-4418-accb-91b71bdc2d5b", "comment": "Malware payload (OffLoader)", "value": "36261e00d3ea1607aa556e63af5b8bd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773968479, "uuid": "81f07e41-cb30-4e7d-99c7-1dfe9d7e2fb7", "comment": "Malware payload (OffLoader)", "value": "ab5a5aa399949370a99cfc953d9e93a11c7a5c16623f9ce3b94da126e3c9bd49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773968479, "uuid": "819c7c66-daab-43f0-b450-eda65631ecf7", "comment": "Malware payload (OffLoader)", "value": "d69229230e7ae2c2fd5ca995c79be04486dad525", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773968479, "uuid": "9bcfb683-7317-42b7-b697-da7847301b52", "comment": "Malware payload (OffLoader)", "value": "4b191cab7fa6ba291bacf26f8aa756e604eaddb45babe6576ce750a450a7e1e16d468293bef2b01c2f5d0699afacbb53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773968479, "uuid": "0001a267-4c55-4638-ae8f-64ecdfc6bb23", "value": "T1A9960133B28A633EE46E5A3B49B6D1645D3F7A21A40E8C06A6E44C4CDF2E0601D7F757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773968479, "uuid": "004ffb1d-ce51-4c6e-9933-52b5583e00f1", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773968479, "uuid": "721f70eb-741c-45d0-95ba-3ffa3143dc72", "value": "49152:GN61T1mZkWVsMx3BFFE6fy/+nhY9GS9CjOCs/BBhH5aOVIJnkqkJcUZ:GN66RVsM/JqM2GUC6Cs/BB6zkcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773968479, "uuid": "8193925d-7594-4b18-999d-248edf21536e", "value": 8766026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773968479, "uuid": "958baf1b-fde6-4cee-9b74-64d411f06d23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773968479, "uuid": "bb5dc04c-0108-4d4b-ab8c-fae3688c0ea8", "value": "SecuriteInfo.com.FileRepMalware.88693695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc79f2c-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001090, "uuid": "ac3088c0-ee65-49f1-87d9-5f62de3bf8a0", "comment": "Malware payload (Mirai)", "value": "aa930a5d07a779c5a342b2802f4e79e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001090, "uuid": "bc50bb48-faaa-4ea4-bf7f-da38e7c42836", "comment": "Malware payload (Mirai)", "value": "aba37cb1a7cce06e4ee5e608ec1d371feaba900b57bc28371a323cc2f1662b4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001090, "uuid": "09a5a197-d94e-457a-8e33-020a30258f34", "comment": "Malware payload (Mirai)", "value": "84febcac5e72fa59952fd4241cce587dafcdb4a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001090, "uuid": "e68c8a02-123e-4126-9a07-5de41a418869", "comment": "Malware payload (Mirai)", "value": "6de7f8ec98cb5f96a125cf9f8f91ff2a705657ec6f51a59be0e3bd8eb581c45af279c3d79426517266428455638b2d7d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001090, "uuid": "a9669a48-65f3-4875-ab38-0b2462022c05", "value": "T13A04F946EB414F03C4D727B9F6DF424533239BA4E3EB7306A5246FB43A8279A0F26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001090, "uuid": "fb61935c-24f4-44c3-abc3-b6bd50efa4d0", "value": "3072:oWmbBEePj/UjgmPEatQ1CMs+pG0wH13D+bhkouM/Rynx:oWE/U8OEatQ1CMsES13D+tpuM/Rynx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001090, "uuid": "a87a2ceb-c5e4-4b9c-b566-7a05636bfcd9", "value": 174999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001090, "uuid": "915de81e-53b2-4fb2-8f95-8524b52b5fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001090, "uuid": "d30967c7-c89a-4027-a795-bee95aed9799", "value": "g", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99202425-241a-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773983208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983208, "uuid": "aa3ad937-1e5b-4829-9607-b84e15fef331", "comment": "Malware payload (ValleyRAT)", "value": "cd7c505290f060808b1e2c61a20cbdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983208, "uuid": "38048b6c-d160-4c18-80a3-6144da14d85e", "comment": "Malware payload (ValleyRAT)", "value": "abbef9af947ab757f9d1f1149db7e622d2977ac3fc1a194ea8463388af4ea2e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983208, "uuid": "224351e2-2bb9-4324-8da1-88d69b8448c9", "comment": "Malware payload (ValleyRAT)", "value": "7e87ab0d02f56777f4cec9746f4e1970a47cdb1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983208, "uuid": "f3cf1431-7080-489c-9d34-b84afcb92edc", "comment": "Malware payload (ValleyRAT)", "value": "fd7e5cf158a7ffc3fff8c9783789e2dd0331390c5f892e24736d93161e505d827c7203d5e3a96be8ef5d4569c54a810f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983208, "uuid": "e0145141-f981-4d9c-8207-a86052839618", "value": "T1D2A633F46BB209F6E9BA9439D0A5826CE231B4524720CE8F63D419572F37F899C35E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983208, "uuid": "6087a581-e481-4955-b20f-be9758361aec", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983208, "uuid": "412dc669-8d34-45ab-948c-837e6594575b", "value": "196608:xqxc9VjA1HeT39Iig7auDXURuAGCTMQ4qFz+37kF6z:0xcO1+TtIinuARuAWQ4q4Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773983208, "uuid": "0656de76-9303-4f1f-9b2c-48160b87b003", "value": 10092195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773983208, "uuid": "e40ce8f5-9b13-4667-8427-17547792a423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983208, "uuid": "fd205c95-69c8-4b82-bd1e-8b493a5840ab", "value": "abbef9af94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba27ec03-246d-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1774018911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018911, "uuid": "00687101-8076-4d89-a952-ba86f5632ebc", "comment": "Malware payload (QuasarRAT)", "value": "6892e8230226a3353d942af64acc52a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018911, "uuid": "03859aba-5411-4602-af0a-9a3c95b4e3d5", "comment": "Malware payload (QuasarRAT)", "value": "acf4e409f279deff4fde7ea4457d2a3a126d7602d32058188727c60318a8086d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018911, "uuid": "137b4237-7dcc-40f7-aa5a-1dd4fe5efc11", "comment": "Malware payload (QuasarRAT)", "value": "9aa046c32f4fa02f169402d85675480d65f524c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018911, "uuid": "d7318b15-ac7b-488d-a4fd-2d2ac08793ea", "comment": "Malware payload (QuasarRAT)", "value": "7bb52877a0cac41a94767815d46b24af983a3b40c876e65d2780fc5d88520d01b54a56450de841a994457b0910fa73f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018911, "uuid": "b5042903-f379-4cb2-ae53-12339a305260", "value": "T19CE5C02039EA401EF0B7AF75DBD0B4DA9A6EF263770AA65D149103464F23B41EDC713A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018911, "uuid": "627c5c37-2c4c-442e-a9d4-3046edb0c49a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018911, "uuid": "99e312e0-5567-4916-b966-0c614db1768b", "value": "49152:ixiNgLmnc/N+ZZXZQOLH27YRnirm2NnPlKKSb7L3wip6MaRr6jeu:dNgScVIxpLlwZNnAKSb7L3w0Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018911, "uuid": "4a995a8f-0c59-411b-aebc-56d4deb0371e", "value": 3146240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018911, "uuid": "64ae9a4d-3eaa-4599-af10-dfdab1e1f020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018911, "uuid": "3a2bdd20-231b-46a6-a06e-121e4c3faa03", "value": "PhantomV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0f9410-242b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773990439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990439, "uuid": "e4376b4b-cd27-4c08-923d-76239f1e9856", "comment": "Malware payload", "value": "8ffc747cbec50d099efc3e76a7944127", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990439, "uuid": "af3fb931-bced-4b88-b430-7da34b5dfac3", "comment": "Malware payload", "value": "ad70845892f5115877371e98bfb51492add9182a6cf4cf5f8001138af5b509da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990439, "uuid": "e9a2f209-4b35-4d8b-8df7-e97f6cd01eb9", "comment": "Malware payload", "value": "6f1e4180e9e2ffe5ddf036fa709668b3a16c9829", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773990439, "uuid": "83bb7ac1-2dcd-43f8-9e8d-89686b97c525", "comment": "Malware payload", "value": "490b48634dd73dac2f99f155554484671b1063ec24775853a9b421e0b7f401ac47910b2172281dd9205a33098f796aa0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990439, "uuid": "9781b42c-df73-4b93-ae75-4ee6efd5f8b0", "value": "T1AD7533F74DC49D1246A6923B0B145B1F32E28F63ADAA2D09E264BD91D0AD7CC52F097C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990439, "uuid": "1d0d96d7-c9b1-40a7-8075-1c9d1a8bdd8a", "value": "24576:PR2No0P3Mk6w15VUpaSPXsUzETC1VsUFIpoiPsmDxcPX4b8y+GQBVw4aUEfUzXI:PP0Mk6M3GaE9hIuqvxcfu4ofUz4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773990439, "uuid": "25cfaed2-633b-458f-af82-9a4af373b16d", "value": 1700360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773990439, "uuid": "3d023a56-5183-4811-a139-3b18e1795b0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773990439, "uuid": "bf50229d-ce35-4715-8f4b-58e2bf62357f", "value": "linux_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4718a276-245f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012705, "uuid": "c19b9fdd-2871-4f38-94f3-b5035f5d414a", "comment": "Malware payload", "value": "3b90dbc3920c6e5f69a22581fa63c5e9", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012705, "uuid": "948688bf-2088-4b8c-a88d-810c02677b71", "comment": "Malware payload", "value": "ada7fd7409b64c2e0ee8aa0cea747a756561440b9ddb465ebad600d3ae1b1c1f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012705, "uuid": "0ad7c9c2-9463-49d2-ad4d-1e1e7d9a7ef5", "comment": "Malware payload", "value": "fd073703c71db0f4d231516827d81f2a98d33be2", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012705, "uuid": "4c136fe6-800c-409a-8a60-3ff6f3902d9a", "comment": "Malware payload", "value": "7afeb4f1b46af4cbff9955a891ea381ec922cd1a480ebabf30714296dee21de2646e8d308760e809c7dd8df049b9604a", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012705, "uuid": "3d4e54ee-b459-4a22-941a-757b240a2424", "value": "T1D167C66214C91BF6CBC74FB930D381D773A43C9E1B83074E94AEA5AC659E4C02979FA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012705, "uuid": "bd2f7419-c5f0-4f0a-9c84-b85058378bc0", "value": "196608:F44XdwK00Oj2koBigVswrpkukX6pWTUlIvh442MD52dlwiMnc6MUe09qgYHwA7:FTx00O6kIFWH442252odcBUeXBH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012705, "uuid": "f265f729-0692-493f-bfd3-eed6188d24b5", "value": 29759056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012705, "uuid": "e6d839cb-b404-41ad-a414-294bcb725157", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012705, "uuid": "61df8aa2-6e00-4c13-9472-3c4a852a1c0a", "value": "ada7fd7409b64c2e0ee8aa0cea747a756561440b9ddb465ebad600d3ae1b1c1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf5e787c-2425-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773988023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988023, "uuid": "ed0c5005-d4c2-4378-a285-d8d786581f83", "comment": "Malware payload", "value": "921080b76925aa070577fe86b21d5713", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988023, "uuid": "7bd9f3ec-8a86-47d3-8706-24ed205b3ee8", "comment": "Malware payload", "value": "adb7620ec3dac6a52dcb1ed6cc214633837a2fbef306e5f7c9a67da5368f0a11", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988023, "uuid": "34d9f445-cbe3-456c-9737-902f07044716", "comment": "Malware payload", "value": "f3d621aa1d68cba0712c8ad921a473b0e3467174", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988023, "uuid": "4cccda5f-1d12-43f6-bd79-3a1dc692cade", "comment": "Malware payload", "value": "6c54bb8ce0d9c74dfd157de3b9875feb7d6cb4047c48ac64167208e1babdcf3c9e76a9a8874c547dd70cee10677ba6c7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988023, "uuid": "71f62cc3-5766-4c0d-ac3a-4b2a03998178", "value": "T190B30FDC498E88708B1F7069462F5E0BCAEC9163029EC59479CEAF443F529F831BD6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988023, "uuid": "030d2b27-38d8-4213-b353-d8212b9d1a3c", "value": "1536:iJ3rpa4r13YT/8LQxGFObUmndWDhCrgnfAzrd88QLX+ccqsS62tQQ:K6GFOTdWDhCrgfAzrd88QLX+ccqHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988023, "uuid": "15b42bb4-3335-46d3-b07c-a06b1a5c1682", "value": 114660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988023, "uuid": "4da61ff2-e2d3-479e-b05a-2b24abc46fc6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988023, "uuid": "4ae6a550-8c83-4c6c-bc51-ea98dc27a300", "value": "System_Logs_Updated_2526.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9b8ab56-2431-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773993194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993194, "uuid": "2bb60e3d-b64a-46a6-8246-3655e41052f3", "comment": "Malware payload (ACRStealer)", "value": "7ded862eb533e09fd10108d455a407cb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993194, "uuid": "484d1646-dd29-416b-a415-47fa755e48b0", "comment": "Malware payload (ACRStealer)", "value": "b0e1beb8efa31915bb0391e97993f6a6774feda87f1b61d67f9d3c8bb6308b12", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993194, "uuid": "692131e8-ec60-4857-89af-7be8b603ede4", "comment": "Malware payload (ACRStealer)", "value": "89933117f8a5c40aa0df1322bb7f97d55a19c1a8", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993194, "uuid": "2cc0cbc2-fff7-4e0a-b878-29cdf15c5678", "comment": "Malware payload (ACRStealer)", "value": "52d196d8ee37bc419d411055b23f55328973f767ad4ed8789eb74a2e8171859b08e510fb6060aaa51bbc02675b21c802", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993194, "uuid": "c9daaf07-f424-450e-8a37-d93bfc9004ef", "value": "T1D785091B40DA5CD7F321027B662735067F2B84C73A66ECE5B4DD119F2BF272A42678A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993194, "uuid": "77b4e8a5-33cc-41b3-b40f-0f8abdc9e9b4", "value": "beffb241b5640e4cf84d9bdbb1fbfc51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993194, "uuid": "6800f794-b370-4261-bc1a-8fbf36e811d1", "value": "12288:kjmKF+kEhnbsuGm7Cr6LlAkSgkrDfPe4mmnPP9ZGXcCjS5xuZfxxAkTXEQ/fXyQC:kjnr8DloJvfPtA4+Hs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993194, "uuid": "74e55cec-3c2f-42b2-a9a2-04094332838b", "value": 1716736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993194, "uuid": "608caa9f-3bb7-416e-8d96-45c484bc7de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993194, "uuid": "fee20008-e32e-429c-9a0c-adb5fb525cca", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371b1fe9-242a-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989915, "uuid": "c8a82182-2531-43e8-9cd5-9e8db94f639c", "comment": "Malware payload (SmartLoader)", "value": "5ac6200ae6e1703ea25992fde339602d", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989915, "uuid": "78fb0d9d-7dff-4bf4-94c0-2d6a8e60c871", "comment": "Malware payload (SmartLoader)", "value": "b169daa90b9850235a725220584c61210c2339f9bf4b2b6726fc8e82133066f6", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989915, "uuid": "d9d9e754-744a-4177-b1f6-efa04b61976a", "comment": "Malware payload (SmartLoader)", "value": "68e59db2efc77f812f90986e170b8a45891eecd3", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989915, "uuid": "e2dcc09a-0d43-43ad-a5ed-01f343c56345", "comment": "Malware payload (SmartLoader)", "value": "de3a583e222c9800b69a77a9b3b40179b11ed20a66c1beec996f7deefcb04b0af752d0bfbabe7b2cec0a619279a2da05", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989915, "uuid": "a4c87385-94b1-425a-a6a4-ebc5a293dca5", "value": "T115C423692755F0C46206F3FC828CBCD886EF14F98B9315BAC90FA585F456257BB2218F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989915, "uuid": "78f01cf4-6a30-4e99-aec3-d20871f025e2", "value": "12288:OA7iOm6Jjghf4xSfUxZ2U18/dtQlSprSp16nQAH9NNzpW+SFyorOIic/7MPT:Bm6Jj6ESfUxZ91kmY/99z8/FXicTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989915, "uuid": "1d465c01-1086-4622-8183-f1bd1a5d225b", "value": 584580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989915, "uuid": "06894142-ade9-4d85-928c-1895b04dcd53", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989915, "uuid": "bd8a61de-b03d-4cff-9d19-7649781ab862", "value": "RN-3.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d92e9a-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050576, "uuid": "9932149a-9335-427d-825c-e69f5bd20891", "comment": "Malware payload", "value": "74877418833ef8b8d26a0388a82750a2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050576, "uuid": "9d67ab2c-8c82-49f3-a703-14bcab35f752", "comment": "Malware payload", "value": "b1ad44fc2e2c674edc2ac17297eeebd11c9b19e624006c7bbae6d2a7a9d1ac51", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050576, "uuid": "4d485e20-b91f-4bbb-9b27-4edab8fba47c", "comment": "Malware payload", "value": "7e3e81126233ab0c62ce82f154ba6629086b7d4e", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050576, "uuid": "a4773a48-5b5e-452e-a853-9fa47b491410", "comment": "Malware payload", "value": "08980e40c4673603f6e323de13e8da617b02cf150a6fbc72bbea25669945d14582386f77e8a1c1b09684354dc9f962be", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050576, "uuid": "fd21a7a1-c98e-4f7f-9b80-fe973ef36bdc", "value": "T1ECC67D557C1D7662D9C979347F625298323CFC089F82C3272618BB7DAAF2358CB63291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050576, "uuid": "6caf8edd-5d13-4123-b7d1-e791a9e40f12", "value": "98304:j/1X9QqgijdwCTii4BH2s93ntuz3ErDj1fhyQzj9DXBPz7nxvyrctVlGq9mZEX:jLQqgiuiizbPj1rj9DRIjq9m6X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050576, "uuid": "6689f2c4-0e62-4b35-93af-ea9db62954f9", "value": 12320952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050576, "uuid": "17e3ff69-03a7-411d-beb5-b4236671e7a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050576, "uuid": "03ab6233-a894-4d16-9d4f-066749e19e9a", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bdb8899-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041033, "uuid": "eca60f6f-5b72-4996-a2b2-a6f7338463ab", "comment": "Malware payload", "value": "e481d70af93829db9095f9cc1675ca7d", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041033, "uuid": "96048b35-831c-4219-bb5b-152682a0e5ef", "comment": "Malware payload", "value": "b22b5d7f98fcbdf5cccef4cec0f81bb85de50a24ca7ca3550f3a9db58a50a56f", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041033, "uuid": "c71ee297-9620-4360-95ee-bdc90f2cc082", "comment": "Malware payload", "value": "8dccb5c9c4b5b5a65c005d5f4f2eb019c374d123", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041033, "uuid": "dd5a755a-2745-4c4f-a3a7-643f018d0f96", "comment": "Malware payload", "value": "5a33914be5b9b1fd1ff691305375c4c21e1b42d237660e0c023fc3193dd6c491b2507bb70f0f9515a1892d96168a0ff7", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041033, "uuid": "86491c32-7202-4019-9e9d-c4824dba4a9e", "value": "T14006AE4BBDA13994C626523B89EA59C22F7DFD4B2B3113C73E40737A2A725C618F5324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041033, "uuid": "76cad29a-4530-4c5f-8529-c2ef42c06e56", "value": "49152:XTd/9pe9ffsW5k6E6FHw9oBQNslIqk48dSKaA:X/q7CoBePdSKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041033, "uuid": "32bd185e-17ce-470a-92cc-46fd012c84ae", "value": 3907160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041033, "uuid": "fd1e1ec0-2634-4969-a87f-ca7bef53674f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041033, "uuid": "47ebd0e9-9b22-48fc-a003-97d8675da4c6", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "143f4764-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977831, "uuid": "6b6a9d6a-d313-454f-85bf-d15e39bae135", "comment": "Malware payload (SharpHound)", "value": "03106b9a4cd05d83cf35b7b79f5d7b5f", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977831, "uuid": "c7e332bd-29a6-4494-a8bf-007b549ecb92", "comment": "Malware payload (SharpHound)", "value": "b26732bf36afd08ce9c6e8e151deee9a81c44134956b7b2fcb93969c8c8ac3be", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977831, "uuid": "34f2eb9b-9dce-4c39-87f1-a9db857b18e0", "comment": "Malware payload (SharpHound)", "value": "2b559d56b92d8d2f14c4b7498f4b8dbd5dcf6018", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977831, "uuid": "42bc3b76-5e72-4b5c-b77e-38261674f0fd", "comment": "Malware payload (SharpHound)", "value": "29be546698de7b774079c7522dd7d051d6b6cf86f1992e65493d56c3879cf949ba8f02ce0bea77ce300715f42ea2c9aa", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977831, "uuid": "7943d234-795e-4412-a543-c970eb94d9ae", "value": "T168752321AD02BB7A0F78D33CB2AF7F2B87640396E4A9D4C235CE115B6B37A50143B945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977831, "uuid": "745e7c95-cd35-4b05-b21e-8e0d00a8e606", "value": "24576:nmfGdi15lRyYsxPDWmyUNvjqgcAfeX0vIOznHIFF6dBH8keWKjDe6BhjONANG/7+:QbVqTyXmraF6TljNANsLMUgidLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977831, "uuid": "84f8b893-ff3d-40e3-95f4-f204851c8b17", "value": 1619741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977831, "uuid": "7a7b8687-0e91-4932-90ee-8ff024fad471", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977831, "uuid": "4a0ea83c-c8dc-466f-9f98-b3375555a9cf", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a704ae91-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040784, "uuid": "b0cea82c-8499-4efa-a01c-9952602cca06", "comment": "Malware payload", "value": "5a4dfae172ef4f4d7cc619eca6e88b70", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040784, "uuid": "53ebfb91-e3e7-4060-b85d-a991c491128a", "comment": "Malware payload", "value": "b27f723b7250e72b8fa10e29cd1a5e8a08fb10db8b6930c6eab55f2a26ba7add", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040784, "uuid": "06cde725-719b-413c-8d48-19e7f8b37e96", "comment": "Malware payload", "value": "ba3720f798a633d5302107b65739e71aca9b8cec", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040784, "uuid": "9f325a14-f710-4b3b-9297-827ab12e4733", "comment": "Malware payload", "value": "fe73a471f1341353f50e53f43dee67ede5e78d8275f9e6dda7299d72394c23763b5ec50d451425cb1b8041253719cafc", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040784, "uuid": "20db854f-b996-4f68-932f-472f36844383", "value": "T1C925EA5C740DEFB25025C97C1C950E7E19A3AF0F2665182870ECB61C7FECCAD60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040784, "uuid": "20f95b4a-8918-4420-a589-508d7876034d", "value": "6144:hYcJjMMZMXZMHZMTZMyRMijM6ZMnZMKZMfZMqZMXZMHZMlXMXjMXZMs4LmNHpaA3:jcoihTa6bw3n+LT5YDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040784, "uuid": "de500afb-a60d-4dba-baf3-138ac9749797", "value": 1005683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040784, "uuid": "1b0b2016-d2da-4169-8b5f-393f085cca0e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040784, "uuid": "2ec3d08a-7833-4a58-865d-36caa4b3c9b3", "value": "linpeas.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db318eac-245f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012954, "uuid": "79bb62dd-a42c-482f-9061-e7ae4eee913a", "comment": "Malware payload", "value": "e09473dffa9395f0d67aba351cd22066", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012954, "uuid": "f6811ed5-7656-4879-bcd4-7816af1d3f2f", "comment": "Malware payload", "value": "b3ff86f6fc849693a84e525b4839a58111c530c60fb117739a23dc7a7441f56c", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012954, "uuid": "a4f997f0-3c9f-459f-8f6b-e03418fc3d63", "comment": "Malware payload", "value": "17a6d017e3dc93bde5563f11560b7a57d5b8ccc9", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012954, "uuid": "6ab70f58-587e-474f-8fdc-76ca09bff85c", "comment": "Malware payload", "value": "70d344e12ec9b2161eb974346f9da95f6b89ccdcd69aa43e50c8d17a66b9a336bc997d764f1a2debdcfa2e5c3c793c58", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012954, "uuid": "846017b9-5cc4-437a-9e5f-180ef8ede217", "value": "T1FA67B51680D4D5FAF22EA5349B1F76792900F691497D13B2623CADB468F0AF37DE2E10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012954, "uuid": "a7e066e4-407e-4846-b87c-7d7487d1ee15", "value": "196608:u8tNJLQlMyPjXc5jU9jNb9KvUzs+7Vi0lyESe9u:uyTEVlNMEE0lyESek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012954, "uuid": "5a30aac2-06dd-4286-a64b-43c885f0efa6", "value": 29758224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012954, "uuid": "3b75611e-563e-4d2b-9a7b-8fda0b08384a", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012954, "uuid": "9d853d88-ab62-4b2d-afaa-fd407edde3d6", "value": "b3ff86f6fc849693a84e525b4839a58111c530c60fb117739a23dc7a7441f56c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478ffdc4-2470-11f1-a769-42010a9c0008", "comment": "Malware payload (EternalRocks)", "timestamp": 1774020008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020008, "uuid": "ca851c2e-c856-498a-a873-2d5c7d4de06f", "comment": "Malware payload (EternalRocks)", "value": "971e552dfbad4e009516c598deabdf8a", "object_relation": "md5", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020008, "uuid": "2f6702c3-e61f-4d2d-9886-8c0ea7e95e44", "comment": "Malware payload (EternalRocks)", "value": "b5959c9591f5b18624cfe65dfe25191a4ff4bb017c9952b6d3ae6723adfae04f", "object_relation": "sha256", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020008, "uuid": "22d75203-cfcd-4954-af9e-501152f962ec", "comment": "Malware payload (EternalRocks)", "value": "f9cc03fb33beaf16c61c6cbdc912175f18c1caaf", "object_relation": "sha1", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774020008, "uuid": "57b20b25-688e-45b6-ab55-9bd1d8727912", "comment": "Malware payload (EternalRocks)", "value": "af9fa7c8003d3356d9bf9bbee0d829031d4294344a176442c0254e280db16d726a4f4e672b883ce4a486a2c4c062d799", "object_relation": "sha3-384", "Tag": [ { "name": "EternalRocks", "colour": "#8EC11F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020008, "uuid": "18229b9d-173f-4cb8-8a4d-61739a77716b", "value": "T11B85332776BD4675D128A736AFE68E7D48B45D05020B1B4373F6F32876B24A8BC4B318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020008, "uuid": "af94aead-2dde-4f31-92f9-e2b934d32da6", "value": "49152:k1gn6jzdCcWbfdY9TKtsE+2T/wsJp95ldJ:kTdQbu9T2F0sJpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774020008, "uuid": "15d24e08-8968-45ab-bf62-421920d04af4", "value": 1785856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774020008, "uuid": "368290ef-be44-48bb-892d-1d71135ff384", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774020008, "uuid": "1fecb20b-00c4-4d8a-99f5-6c44a419e0d9", "value": "small1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c183a746-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046841, "uuid": "1c80d159-773a-4cce-b7eb-83d02d2f51f8", "comment": "Malware payload", "value": "bd044dde3443e93ca86a60ca304d5e81", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046841, "uuid": "218f32b6-58f9-4cb9-b354-edf42246ecda", "comment": "Malware payload", "value": "b596e94528f029169da8e6b313d88b3436788c516d9b0c3f5724c682c94b7cc9", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046841, "uuid": "04588fea-840a-4437-a32c-18be6acb91dd", "comment": "Malware payload", "value": "7b62732f1d5aac088fa23c92863b33fe7db799cd", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046841, "uuid": "bab910a5-e63f-4b65-ad0b-ac5c4a6c6d93", "comment": "Malware payload", "value": "926826c4b094891a6c43f2a199b152a855b13247c126634e7cc957dff8303875a36c514966ca03ae4520155f1b918a24", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046841, "uuid": "fcf1d861-8e15-485c-9da0-7b9258c073a4", "value": "T17155121943F89B96F6AF0FB9A0664059CBBA7617FC5DEB8D9A4CF4EC1482350C950323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046841, "uuid": "26c0ef88-bf7d-4995-b4e5-0438bebefb34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046841, "uuid": "1c6b3aa7-4c17-480d-a627-6c7f95ddaeb7", "value": "24576:LhLIGEDwgrRvNuXoVIa09WmPstYX3HcVIGtSljkong/iN9WCH:LezRvNE9WmPDXXs1gjFK4WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046841, "uuid": "bacd9192-2653-4275-9beb-975b243feb75", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046841, "uuid": "a9f35b13-2554-48d5-ad37-dea4d480412f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046841, "uuid": "6786cb01-f45d-4e99-87b7-a07f64c002f7", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9fc9ee4-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050345, "uuid": "f2f84255-d0c3-47f5-aebd-3bdd29d7eab4", "comment": "Malware payload", "value": "a780386fda43ddde1ef9c577d548ada3", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050345, "uuid": "088e78bf-76ab-472c-90c9-993e3dfb1977", "comment": "Malware payload", "value": "b61a86140af651a2c8659b1449fe0bdb9f8d7b7a44dd1c39a27209fd6f4977e8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050345, "uuid": "3e078224-994e-4237-aacc-e249d79041f3", "comment": "Malware payload", "value": "93c15ad61ed881dd80b41daa25510bc4bb37474b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050345, "uuid": "63686c34-4702-46f2-a530-221177cf03d0", "comment": "Malware payload", "value": "b140c583de9d590cca3ffc75f4359a46101f78b494c26a3542f4f0080fd043ce9c6585dc079d4dd0a08a739c68de5ea6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050345, "uuid": "1d82c864-7a7b-4e4b-a210-c14c7f3b91a6", "value": "T1C7D64B43E86555E9C0AED13486629713BF71BC495B3123E72F60FB642F32BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050345, "uuid": "56bd8f98-7a5b-406c-bee2-71f651d57892", "value": "98304:yjRLqggADEr8tptG9HNq2F+GqSYKkJEIXEWcdcwfjTdzwvZVB1bnEJmK:yirMptQHNqKllkd0W0cwfj5sEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050345, "uuid": "c1b429fd-3150-4cb2-aec4-a1e750eb2900", "value": 13474688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050345, "uuid": "83875bed-f66f-47ea-bc73-80d1fb7b84ff", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050345, "uuid": "8b92dd0e-de0b-49af-9c34-6b593d8b9bae", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5cd723-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040821, "uuid": "37d84166-9f55-4240-93d9-c1201f679785", "comment": "Malware payload", "value": "5f43fb59b2004e97c87da25094a1c9a9", "object_relation": "md5", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040821, "uuid": "46dd0f74-7283-4b3c-9075-f623d0d51994", "comment": "Malware payload", "value": "b6ead802826353401f563c2234d7b882e4b29d7fd4f306861a511193fc49d9ec", "object_relation": "sha256", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040821, "uuid": "778d69fe-4297-4e26-a1ca-7af40652bbdf", "comment": "Malware payload", "value": "7e3c392edff259dfda4d32cdb078b983b10c3065", "object_relation": "sha1", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040821, "uuid": "183f6f7c-b7bb-490f-a4a0-46385a95648a", "comment": "Malware payload", "value": "e365a36ce44cf14f8cf5439d9d6cb27eb84af0d5440bf67b9e6dc229102e809ffa98c08de2a53455b81d9b91a62606d5", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-d7c1e6ce", "colour": "#2D3211", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040821, "uuid": "d1e9e558-da6f-4aa4-bff0-8c1e31ce9a86", "value": "T1BD06AE4BBDA03994C626523B89EA69C22F7DFD472B3117C73E40737A2A725C618F5324", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040821, "uuid": "0a475c3d-1560-486d-8a46-09070de31e66", "value": "49152:yTd/9pe9ffsWP16E6FHw9oBQNslIqk48dSKaA:y/q+CoBePdSKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040821, "uuid": "3e0038f0-e036-4637-88f0-5b40923db0b3", "value": 3907160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040821, "uuid": "0e42a9bd-d43d-49da-83ae-46064895498d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040821, "uuid": "c1215b57-390c-4034-bcc7-a552654014e1", "value": "linpeas_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1fd6f6-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978270, "uuid": "c645d379-98eb-4835-8375-8cf40abe3712", "comment": "Malware payload (SharpHound)", "value": "208a729c443a73501609cba53200e129", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978270, "uuid": "83548591-3c6f-465c-a021-cb0e08eb4d60", "comment": "Malware payload (SharpHound)", "value": "b72f0a9f7f964e9e7a22129e937db427a6f5f927296bb191720f68c937b5c418", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978270, "uuid": "c3f2dbf6-dd11-4981-8cc1-cc7f2d9af722", "comment": "Malware payload (SharpHound)", "value": "f5de8b428e783943d5fc956a385ef5ded1c0065e", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978270, "uuid": "d2623d28-649d-4f7d-a7b0-e7d80ebded71", "comment": "Malware payload (SharpHound)", "value": "58093dd7b786ab194af31141f63f77fb35fe7e17d5725d4a995160e45df528556fea698a7f81f86b1bd9dcbb34df4bd6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978270, "uuid": "a2cb7437-5168-490a-bf0a-6aafb72c3a67", "value": "T19C55121943F44B95F2AF0BB8D0258156CBBA761BFDADE78DA94CF8DD24863648910333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978270, "uuid": "7152f0ae-eb02-488a-9ca2-9a07bbf144f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978270, "uuid": "c3618b33-4913-479a-a6ef-a8d21013d927", "value": "24576:kSLIGEDwgrRvNuXoVIa09WmPstYX3C9t6lnkong/iN9WCA:k9zRvNE9WmPDXYkFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978270, "uuid": "2d43320b-d1d5-4376-ae62-963dc6a99170", "value": 1307136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978270, "uuid": "45e51404-ebc6-471d-a908-83d6fe45dcd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978270, "uuid": "66ef32c7-3cb4-41a5-a64a-92f7eb4ab411", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9653d3ed-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040756, "uuid": "698b5791-810e-4241-a910-3ba80ad28566", "comment": "Malware payload", "value": "d586601d415e05a77c71d9f3b6b1cac7", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040756, "uuid": "05b131ea-ec13-4b7e-90e5-effec734624d", "comment": "Malware payload", "value": "b7e002005b4464d7d74d6c4d37f9fd25b6309b6504de57ab85b5fccb05427089", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040756, "uuid": "ddcc17ff-c8a9-4449-a5b9-cde75c178fd2", "comment": "Malware payload", "value": "826d75e406808e3f002cb2b6da09003f78d612a1", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040756, "uuid": "695f135e-8583-4fc3-92ff-db2664adba4f", "comment": "Malware payload", "value": "a4d8b58dbd1bf52bd049777f1aef48362dd1f474a4c6c8a8c5a789337e402128ab980ee6f2b1b35605295f53cc37177c", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040756, "uuid": "d4d1a002-dac9-487e-8d04-9cd1c3ae5a56", "value": "T1DCB6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040756, "uuid": "514f55c7-9f48-4f15-a4ef-7532f11f2566", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040756, "uuid": "97da65dd-e02c-478b-8add-fd891b8b2dcb", "value": "196608:+vyxUbTVBFUcwti7TQlyVN8iNISRTRmW5Qv:/cjHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040756, "uuid": "73c7e036-1b89-48a4-a17f-4a3e76ec9c9c", "value": 11114496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040756, "uuid": "e9d4a3ba-d58a-4663-8c34-431814287eb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040756, "uuid": "6e83a10f-ba42-41f7-836e-85e828e371c3", "value": "winPEASx86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef9a13c-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989392, "uuid": "adbd4ef8-caa0-489a-9038-d7e0f680c331", "comment": "Malware payload (SmartLoader)", "value": "fe39d9e90eea5b427f4b26599397c011", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989392, "uuid": "fd0365f4-169a-4be2-8959-73ff372062dd", "comment": "Malware payload (SmartLoader)", "value": "b8ddba517ded94631018d0b877d23fcdc94ea4a2244bb9e3c7795433fd11604a", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989392, "uuid": "d679e863-f0e7-42d8-b1c5-97d39d059246", "comment": "Malware payload (SmartLoader)", "value": "f1182685cb68cb2bfc9b907ae401d42b991b2400", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989392, "uuid": "a9101f6e-78ee-4cc1-81b6-0d8be0f5fe0e", "comment": "Malware payload (SmartLoader)", "value": "03dd7e3c69dd847a63384722d5e2324c7612efe93fa2e87481fd4ad2913e1656e6cc5aea8c06f02ef05a532f25b6d59b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989392, "uuid": "dda612bc-ffba-4f79-981a-f6ec6d9525a6", "value": "T1E1C42304340641D5835A2B1EAEC4E7E0BEB5A0DBFA1CF940AADD7ED06DE92A177C1437", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989392, "uuid": "6e679acb-b751-43ed-b0cd-bae8c31faa50", "value": "12288:D6wlOMWROC/FTeHo22Qm7NzofOr68mzeA924EwCV:74MQOC/gHozN7NzomW8VA9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989392, "uuid": "806981d0-e4c2-44d1-9525-9212fd980312", "value": 584482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989392, "uuid": "65e9ed86-13b6-4ce9-8810-dc05dd16e88b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989392, "uuid": "84013e60-59d3-4050-aba3-2f18ecd55836", "value": "Mrandmrssmith_Scrapping_2.6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255e65a3-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047009, "uuid": "013eb098-0ba1-4284-bae9-af1cdccc1e34", "comment": "Malware payload", "value": "6f4e2a26ffacf73b66d3fe9e19a7e21e", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047009, "uuid": "8f1e2092-fe5d-445e-9594-54eef1ad9589", "comment": "Malware payload", "value": "b8f20b39eefdba9286a377d17ddfa8f17bdd9d0f864ecd84da75eeb0c70c17fa", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047009, "uuid": "13739ec8-4063-4304-a8da-74afa27fc588", "comment": "Malware payload", "value": "340a0c9e36b0694757ff64a68aeab85e069b7fe4", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047009, "uuid": "0b05751f-fba8-4b81-9479-dc6ef09101b0", "comment": "Malware payload", "value": "96ba0c1f32f299987ae84ec58996ec0ec11d7dd81e3966394a5f206ccf3e05da8f59fa8adbf73daa7e5b16e7020db435", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.13", "colour": "#AB2826", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047009, "uuid": "de34bfd2-4f24-48d2-bcb2-021d2a6b9b39", "value": "T11375122853F89A52D6BF1F7DA02052594BBAB64AFDAEEF5E684CB4ED1493300D510333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047009, "uuid": "1a4fb44c-6cf3-4134-8705-83887079e4ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047009, "uuid": "e2df02cc-1c60-4560-b612-9ee80770534d", "value": "24576:dWLIGEDwgrRvNuXoVIa0xdBSWmPstYX3RMJvvkoZ1g/28DDghy1pBN94T4vyNCE7:d5zRvNExdBSWmPDXyJvvX1K2yDghMP4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047009, "uuid": "0e6729e3-5285-413e-b50f-31f78fb205e5", "value": 1557504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047009, "uuid": "04abd408-4589-4ecf-9e55-ad8f3dc33d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047009, "uuid": "fca622b8-b8e5-402a-8e5e-43c40adf8a30", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d053690-245f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012742, "uuid": "edefa83f-a763-47ce-8500-b17441c44de7", "comment": "Malware payload", "value": "ff7e5610813dd9ad8f1a3a98951d7b97", "object_relation": "md5", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012742, "uuid": "b1a3c6ba-5537-4bed-a4b0-0765ddd60d9b", "comment": "Malware payload", "value": "b93494549d589123455cd244d75765df29fdaf12b29f3faa4a16483d702a435f", "object_relation": "sha256", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012742, "uuid": "bf223c82-e3dc-4d8a-bbff-2e5bfac7c70d", "comment": "Malware payload", "value": "0e00269a03b403846d29cc6d2f96c7f76e6aa394", "object_relation": "sha1", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012742, "uuid": "9d8aabad-f104-4f12-aefe-187401092757", "comment": "Malware payload", "value": "d45cd4ee5fa40f58b3d6bde8307dff4371030afb231c66f1b389c7462b5381ce5edc735c96bf4dfbc9f8b40acccbc166", "object_relation": "sha3-384", "Tag": [ { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "task-vault-54a2-356814497283", "colour": "#8395BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012742, "uuid": "e5ffb157-b4e0-429c-8271-09992cb0e0f0", "value": "T19167E9F1A63706C1E02312B7B46DB78EFEAD99DC0D288767181D58668632392DD67F03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012742, "uuid": "6eecbbb9-caaf-4725-b655-f3646438c250", "value": "196608:7gtx6q4Xky1CcFCgKOg8AHEBg/YdXd3O8pQJJJJJJJJJJJJJJJ/LrLAsPZ0XdLuS:7m0XpywdX0GufqNLuH1tzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012742, "uuid": "0e3fb075-feaa-4bb3-8cf0-298a4f6d3dcd", "value": 29763552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012742, "uuid": "f127f8c6-9dcb-467c-89e3-a61527d5308b", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012742, "uuid": "8625ce81-201e-4863-83b4-530255c5f7d1", "value": "b93494549d589123455cd244d75765df29fdaf12b29f3faa4a16483d702a435f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a462f9-2446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774002091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002091, "uuid": "30950810-f82f-4458-b3ef-9d9663ae2cd4", "comment": "Malware payload", "value": "586b03ddacb9f16344e3d978c1299f49", "object_relation": "md5", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002091, "uuid": "6e467509-6653-4cdd-a3c1-9f7732b4c42b", "comment": "Malware payload", "value": "b9cfa0cc449959feb1a242e572a76046351e82b16e3ef711f71e993cfa278adf", "object_relation": "sha256", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002091, "uuid": "320a5e44-d70b-451f-8d66-73a3f6844bea", "comment": "Malware payload", "value": "d77eb6b0471083a7ce56f30e2d1ec5b778aa58cc", "object_relation": "sha1", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002091, "uuid": "481e8172-bf27-4bfa-82f0-0ff942685521", "comment": "Malware payload", "value": "85469b2b90ce1c0d5b8b973cabec638f52433ef328193763fd8a4e698a167996a840e4c2a7513d054895ffc4c9064a5a", "object_relation": "sha3-384", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002091, "uuid": "7fc9c6be-d223-418f-a5f4-a4b69c5276b0", "value": "T182E4B787F1208AC7F44FEE7E14504210AEB0E4704607F2561B6E885B6FEB9C89F657E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002091, "uuid": "8482781d-8fdf-4738-886e-a9d15aacb390", "value": "6144:C1eMX5Uh/W94gpr2TYPjhMocjk/2N1zedG8aqxDB8T4FU2h1Ui/14p3x1ZCA:CZTc89BrH/1eV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002091, "uuid": "4dca1663-83ab-4b60-80f7-93c881b7f962", "value": 702341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002091, "uuid": "7f78dddb-6707-4edc-aefd-a1c79033ecb9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002091, "uuid": "cd3140cf-4051-4a14-afb7-ac8eb1d0ddfd", "value": "Jenny_Mod-1.21.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36650811-24a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774044460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044460, "uuid": "69e12ba2-9cf5-488c-8310-6c972b91943c", "comment": "Malware payload", "value": "1a18ce7d4dd5f848956a865e9b5a471d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044460, "uuid": "dc827fa4-4650-4cc6-8a8f-7345cf5a9ee4", "comment": "Malware payload", "value": "b9d45e38b403321e3732e180051192c50c0e8eda63de6bd67ae056c0b5ed56e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044460, "uuid": "4aa5e14a-3318-4a4b-8db3-89569705d516", "comment": "Malware payload", "value": "4531971d2d3f87287883c570ec7b697827b12f0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774044460, "uuid": "c09ea35a-78c8-4361-80f0-27b48c166946", "comment": "Malware payload", "value": "b22849d3d07391e1ce143052b5bc0056af31615d073f0ebeebcb1343103e2a92ff7a2c84c299623206bbcc2199785564", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044460, "uuid": "55dc2e30-224a-49ec-a955-e15c9713c978", "value": "T1FAA3EA56F8819B12D5D012BEFE1E128E37131B78E2DE72029D246F74778A9BF0E3A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044460, "uuid": "31ab1f7a-6802-4c74-a615-69c489309b45", "value": "3072:vfKtnMwIMUYehT8XKkzG3j+aVLXM6WDgyje:nKtbbu8XfzG3SadHyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774044460, "uuid": "9d50dd51-ecc8-46bc-a16b-d43a26c03df6", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774044460, "uuid": "8babfb10-a1aa-4d5e-a6c4-2aac78a07cee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774044460, "uuid": "9159e713-eb7b-4b91-af00-fd7bec92c794", "value": "f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276319c4-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977863, "uuid": "df4d269a-09ef-4df0-8fca-2953a3523043", "comment": "Malware payload (SharpHound)", "value": "25fe9310732fad03cdd47444cd6b595b", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977863, "uuid": "cb440e91-9628-42ca-89e4-925a0310e98f", "comment": "Malware payload (SharpHound)", "value": "bab4eeb7298c05b54dc2eb8d5d21e5e9c4eab67f30f778f7a4b4992ddc683837", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977863, "uuid": "3b4bc784-6b8f-44ba-a168-afcdfe2878e9", "comment": "Malware payload (SharpHound)", "value": "f509828f8534371e9d4585725c7d6a0c40b53e89", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977863, "uuid": "4ab520fe-b627-462e-89b3-030052831e53", "comment": "Malware payload (SharpHound)", "value": "bc1efd2dfb0038fb963da1d4d5d5f02c642b26614d745297bbe5d9b42275d63d44336673915d85821688fd1d98daf815", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977863, "uuid": "0adbd97f-c458-4d61-acd3-47813943f674", "value": "T1A8350255A3F8CB45F2AF1FB9A03442688BB7664BF9ADEF8D994C64EC24437509841323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977863, "uuid": "2e2f44b4-daff-457a-ba8f-8a44ab6eb1ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977863, "uuid": "1edb801f-2a0a-4a14-8871-7f7387cf87ba", "value": "24576:GHvNuXoVIa09WmPstYX3wTasVa2fdzqkong/iN9WC:CvNE9WmPDXAmsM2fQFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977863, "uuid": "965b8633-e7a6-4b96-83de-f363a8a27d48", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977863, "uuid": "79be5cc8-9f6d-440c-b539-79c54a915229", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977863, "uuid": "d5463e9d-5485-40aa-a310-05859ad72df1", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54da40b-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978128, "uuid": "3f8cd370-735f-4e78-b8e3-6d5df0a64245", "comment": "Malware payload (SharpHound)", "value": "e7980a4f0fd3966dfa2849a47851dca1", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978128, "uuid": "4f3e85da-63e2-405e-9034-498af31225a4", "comment": "Malware payload (SharpHound)", "value": "bbaf36f3fbb36b0bf67188dc26e0a0f02b15051b4df432db008de8d8414ce1d2", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978128, "uuid": "2dba6248-a7fb-48a5-8579-a8477243c461", "comment": "Malware payload (SharpHound)", "value": "c16b6ff85c3036bd685c8c0a16890cfe38df4dc7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978128, "uuid": "9e4ce9d9-a2a1-494f-8f73-58a2c743557a", "comment": "Malware payload (SharpHound)", "value": "368cf6b15f8d1c64c3899d064b9c8a6ccac9990478d9ffeac7ac98c1409a8fc16d356dc1cf6a236cfde554efb2802c78", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.1", "colour": "#6F4B08", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978128, "uuid": "6b244acb-a43d-44be-879f-31242baf8ddf", "value": "T10F7523727B45492B0EBC8339E467B92C9BB1AFA3600C93AB73CD608C9777E40415B59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978128, "uuid": "c0f4dd83-7b67-4f9b-8e40-e21e49d01b1d", "value": "24576:d3L2KtKfquP2qhPef6HIpDtApgcgf1acKA3sJiYNUyoBJELVNNYXEScFKA+iTMCM:hdQvbgf64h9vcBuyVLVKcFKA5TJz/nta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978128, "uuid": "a9f38f06-e052-452c-9d2a-3e588ca90bbb", "value": 1620017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978128, "uuid": "45ba8505-73a7-4a18-8436-caf01db72fa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978128, "uuid": "469eeee2-2535-454c-837f-688b3f6a0617", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2d87ad-247a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774024557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024557, "uuid": "1f9c7e0e-bddf-434f-92ae-7ce4ce80ac38", "comment": "Malware payload", "value": "bb2fe5b3367c03352824a7bf462437c9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024557, "uuid": "cb45b824-dc3a-4c16-bd92-1792ba101069", "comment": "Malware payload", "value": "bdc3f94df49992cd5641421988d55ec7ea59c8df014bc5a1b8936143841abf54", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024557, "uuid": "6d577a77-2c1e-41e0-a485-599b22e89c41", "comment": "Malware payload", "value": "c1cf0004372ce306c472eb8b1349c71b0d45a6f9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024557, "uuid": "a4518ef3-7b09-49d2-bb5a-5240ef3dd005", "comment": "Malware payload", "value": "f4225533533b111b392180919faff80cc0575723cf148f0d26ed6850c7d6bc548b108bcd4e94b0c22caa94197c759f8a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024557, "uuid": "c506496c-07c5-444b-a758-91196fcbc7ee", "value": "T11396282B22649528D15F823AC15F8E3CC9F37876E773C2E791B0C7574A1A9C2DE3A521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024557, "uuid": "0dd45f33-6ca4-4b69-bdc4-ce7242b8aa5d", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024557, "uuid": "cd812384-4491-45a8-9e82-4975731c056b", "value": "49152:CEC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0PpA/MiAyfNFhakVTcZ:qYCp2JZ/dfNikVTGX3JFI8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774024557, "uuid": "4e7d66b5-a9bf-42b8-aaa9-1ea293b2678f", "value": 8706048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774024557, "uuid": "a586efc7-9833-4320-a8ed-0305aec526ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024557, "uuid": "564d68d0-efa6-42ab-a9ab-7d4382ec16b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62858383-245e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012322, "uuid": "5534d2f8-0702-4529-8eff-80130a23d857", "comment": "Malware payload", "value": "10af515ad7f18deeaa070aa4e45e074c", "object_relation": "md5", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012322, "uuid": "ea94b296-b0ee-4928-ad65-1832f276e1d7", "comment": "Malware payload", "value": "bdf731c1a813df3c97b75d6fbebad5a5cf89e22a54931b89a00a409358324b1b", "object_relation": "sha256", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012322, "uuid": "67b0ae1c-9c4d-4603-8d62-750439b661b6", "comment": "Malware payload", "value": "506fd3a9ad60d2e9ee48e2029d1a47eab11a2ec9", "object_relation": "sha1", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012322, "uuid": "6602bf82-7e3c-44ab-9cb7-9993f31740c2", "comment": "Malware payload", "value": "93b49a2f238ccaf225c5da75f4bdb3caeb3223676233509b0aba260c4c9ea3910f2084b7cfb329b8cb4adbd6885d3d51", "object_relation": "sha3-384", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012322, "uuid": "c8bfc5f5-da9e-426d-bd6a-30db3c44f9d2", "value": "T14A263393DBA1DC711C9257130969FEC8E60A44F46942A77C4BA947B93393F881FF320A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012322, "uuid": "f10d82a7-bd79-40d0-aaf8-450809181c27", "value": "98304:DG1/hJUn+2+rHRFb4vDHjNeYNhaLfMo6ETVFv0xnQeb:6DR24F0vDHBeCk0WTKXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012322, "uuid": "d2bf08d9-c09a-4935-92e1-e72f616f967f", "value": 4653892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012322, "uuid": "fddec19c-b665-46d3-8009-27bb22ff1002", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012322, "uuid": "7287af99-0f69-4dd8-8c10-1074cd1bae37", "value": "________.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c51b646-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050456, "uuid": "58f023f5-7628-4a20-a3d3-7888f4a1cc2a", "comment": "Malware payload", "value": "891295fb2baa8ace0a38299eed3bf39d", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050456, "uuid": "b647e2bc-7237-4135-a5b6-373d1e50b4a8", "comment": "Malware payload", "value": "be31c08bd0f35fcc7f280720e4df7281c89fe443360ebeac8f6bd3b450974120", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050456, "uuid": "0761180f-7a30-464e-a555-9984624d5874", "comment": "Malware payload", "value": "fc8337e11389dfd5c4c8b6bf45b47c8e5abb86bd", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050456, "uuid": "d198ebd0-8f60-493e-b24f-50ccb413ad12", "comment": "Malware payload", "value": "8755417ff3d04f8308b015f76d61f34cde3e7e4cb65d9f4123fbab62bb9b4fafbf6744fac51029d2843c30e57e9f6dbd", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050456, "uuid": "8eddf545-e62d-4209-9a1a-a2a2ace3fd74", "value": "T1B9D66B85BC1D7462EAC979742B6213557338AC455F81C3276618FB7CAEF2398CF236A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050456, "uuid": "cf40bddd-16dc-468b-8d44-af77998f251d", "value": "98304:+MHLIyiGxfOJY9GGIUrO7bnyK3/V6dmuGN7m6xACftt860kxukUhFI+iDpgErgtT:+wLbiGtOJYoGILbnL96dm5cupZU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050456, "uuid": "fbae9e8d-7a6e-4755-ac2d-75e76e153ba4", "value": 12758178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050456, "uuid": "15d3b3a2-6e58-4d47-89c1-0ed15609f909", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050456, "uuid": "99c2e7a8-7b6b-4b4c-9d0a-aa75074328b0", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51b09a1-2416-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773981590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773981590, "uuid": "ca37feea-7d9f-4bdc-b1cc-85f252917681", "comment": "Malware payload", "value": "2ce07c9376aba2eaf6c91aa5f6cf9da8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773981590, "uuid": "ffe8b208-d60e-404e-a413-76265473f4b3", "comment": "Malware payload", "value": "bea75da8dc88cebe0e06a8d35e56332b64e3f1948ce9fab60cc44cb0a1196364", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773981590, "uuid": "950734a0-e3e5-417d-a8b3-ed347ec60d72", "comment": "Malware payload", "value": "a39578c9032488ffa6da861e93b6e70bc7b160ad", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773981590, "uuid": "ea28ee0d-5a45-4668-8599-53422b7afd3a", "comment": "Malware payload", "value": "6a925ca066f0fccd4ad5e43cbda3d0e34a5d1e900636a783db7158a33717819f2f1741f785ff68c6a3dd70b7293e9627", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773981590, "uuid": "4e3c0b35-4ad1-4639-82a8-a0033913f128", "value": "T190924CB512896C79FBD1CE39AF3C7F4CADE8C2C42124A3ACBA4F39205A1166DC605359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773981590, "uuid": "275b14fd-fa12-4fa1-8644-f4ea4c5498e8", "value": "384:LFcuQpWx+BL0SWL0gWzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:LF8i+BL0SI09zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773981590, "uuid": "fe8a6bfa-fa9e-4a6a-b7c0-8757d53123f7", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773981590, "uuid": "cf585ef9-ca10-4c4b-a785-c7bd5ed6d25a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773981590, "uuid": "ee3ea53f-502f-4d90-88f1-d78f7eff4318", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df3ee86-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050647, "uuid": "5846b1ca-6bc5-4c52-99db-4e447efc0f8b", "comment": "Malware payload", "value": "b4047f3c137353e5be4ad25cbb3d3029", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050647, "uuid": "4176457d-808a-470c-96d4-f6d7d21ad939", "comment": "Malware payload", "value": "bf4ea34bdf846414dee8157953eff4571a35b09fe468bdc247f8336552479721", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050647, "uuid": "b7d4bb1e-b69e-49a6-8ff6-0ca0c60252ee", "comment": "Malware payload", "value": "337098c255352509ec39195e1529d99a63637874", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050647, "uuid": "b46191c1-b0ce-4910-b0b0-931d962a21cd", "comment": "Malware payload", "value": "7c1d994f7a9e9a252f88359698ca3c2684ac65a3724df948eb7ca64c0077e3a57fc70a3a933277ef6017b3be918202a0", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050647, "uuid": "fc90e3ff-4854-42d1-822d-3a9f07848ea7", "value": "T17BD68C45BC2D7462DAC976746F7653943338BC44AF91C32A2614BB7CAEF2348CB67260", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050647, "uuid": "888f662d-3188-4f18-9ac6-8a6b57410d58", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050647, "uuid": "0214a8ca-56e9-4cbe-b7eb-83874c5a6596", "value": "98304:5NVnb2CQGNpUvAQeRBU0UmwnOCtHDEdhrh06OKhfbxtXucHoYBE:5Tnb2CQC+AjopOCOXh0MnHoYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050647, "uuid": "0e15f945-5625-490f-92a4-ad5587aa117f", "value": 12656128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050647, "uuid": "1ecc62c7-3f42-4bca-8840-1d1cc376f6b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050647, "uuid": "98db1ffb-b5b5-4a03-a34a-c83b45ea8a0c", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63c46c8-245d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012087, "uuid": "cf679ee5-b3ae-4279-a9b1-468dd6cb79d0", "comment": "Malware payload", "value": "489e1df5c2a0501c79866ac7a4a76715", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012087, "uuid": "1094de83-0a36-4e9e-9425-ff6aa381ffce", "comment": "Malware payload", "value": "bfc6725c9f1f9c14b29f0875322e2374bb9c8291150e27e7f7f788981bed4665", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012087, "uuid": "c2c34b63-dadf-41b8-852b-34aab42ed58c", "comment": "Malware payload", "value": "0dba875f647ed02e59d89e6aad0767a8ecb62e43", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012087, "uuid": "f1b4d44f-78bd-47d3-979c-31005513d6b4", "comment": "Malware payload", "value": "536d2adfbc2ee82bea0692da905d74b32cfc933276761714fe1c36e6b2f51092075ee99a9f86a8ee5f424bd1c4201ccc", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012087, "uuid": "f765d991-55e1-47f5-848e-d0b50e01c97d", "value": "T1A634EBE2AF0A0F7513F5C9A752E881918E9188E4FE7E4706F4CFC862585D845F2936CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012087, "uuid": "b6c0894d-7c5e-474a-9d07-ad60c208c2f9", "value": "1536:lvZnEB7XLlFAjgRn6sv1QTr0DiRj5MPBk6SF:Y7XhyQ6sSADiRVMPBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012087, "uuid": "13d4c074-9a5f-40f0-9721-d581de5cbea3", "value": 240047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012087, "uuid": "547666d2-55b5-42f9-a827-355fdd69f49f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012087, "uuid": "d629d4e0-afde-4953-a7d3-e3710dd7e65a", "value": "quick", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4dec3a-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050622, "uuid": "56df547f-ca79-4a4a-8201-d4671db5b286", "comment": "Malware payload", "value": "713c273fb4cc54383d6ee558c2e7e8d7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050622, "uuid": "7575efd1-dd19-408a-b787-a937bb25d3fe", "comment": "Malware payload", "value": "c052a56b9d91a2b51554288af977da8d1accf15ca722b2de0b69f4ed74e9abab", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050622, "uuid": "3af86cce-3784-4560-af72-08ae8c83d362", "comment": "Malware payload", "value": "a15d72271b3302c25658b988e0706531d4f6011f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050622, "uuid": "3c04b58a-670b-467b-8bc2-872b5834725e", "comment": "Malware payload", "value": "6587f57820923dbbb103273644d0dfc6da8570c3ec938903d71eaa83f2a2f5c1c7311a13cb67315e8ac35428f3b09806", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050622, "uuid": "6eae7478-4785-4fff-bc68-80e4d384d5b0", "value": "T1F7D64B03E86555E9C1ADD23086669723BB717C495B3023D73F60F7682F76BD0AABA700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050622, "uuid": "692e574e-4d19-4590-84ea-8cd2d798f49f", "value": "98304:yLAmH2mdtqZuPhgblkHmdhc8uRUi3vKCPz/P3GVpWrr16I+E2:y0AoZwhgbaHmd2dRUiiCPzH3gAP72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050622, "uuid": "73dcdeba-ee22-4c5f-96b6-8f986baa4696", "value": 13144356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050622, "uuid": "452edaea-eb89-49b0-aa64-29d94c3178bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050622, "uuid": "037fe6b1-76de-43b0-9091-e10250c04cec", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c827a39-2479-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774023855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023855, "uuid": "88724ce2-5244-43fa-a518-d7352f9a3886", "comment": "Malware payload", "value": "e8d87406569a84d04dc5007ba51bb154", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023855, "uuid": "ab02f91a-438c-433e-a1b8-801e69543934", "comment": "Malware payload", "value": "c0861f5be19ead006864f44bbf542572ebf35ab3da3a547ec06770a5685d8b29", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023855, "uuid": "a325115e-3236-4ca5-a5ba-726f070c7dc2", "comment": "Malware payload", "value": "3f45b16eddca9fc72f563cfd47caf298c589047d", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023855, "uuid": "48983f0e-b294-4a10-8a33-17a76d6f4046", "comment": "Malware payload", "value": "8dfadbde1800900c75669cfbff47ec62787f634cfe82a6d4f5939df05be7343b1ea7134b8bbbef1e7cd2132ba5c4ba0a", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023855, "uuid": "60f092d4-5fe2-4118-a8f6-6f14aa49c139", "value": "T107956D21F7640077C92306329E59F379F36C65730FAE41F7C29096B92A3A5928A1C5EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023855, "uuid": "3f0981ce-09f6-4786-98e1-70cd131e9d25", "value": "5381fe4412fcae6d8ab869f4842fb296", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023855, "uuid": "9d1ed73c-6635-4e28-800b-fa1ca4bbcaec", "value": "49152:T62ICdiy75P4K3pvBxNhXIaEMH4aR8S5QnWexjczCg+k:+2X0y7uK/PBIaJgS5KWexjczl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774023855, "uuid": "9f88f527-549f-48ee-9340-36ead60b8ae6", "value": 1978880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774023855, "uuid": "42784035-87e4-4cd4-8f6a-3b29286a546b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023855, "uuid": "aabd90bc-4489-4648-9e49-940e516553b4", "value": "QQ\u622a\u56fe20260105205840951367815.png.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf7ba9a-243d-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773998139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773998139, "uuid": "0252ff3a-6829-4acc-b67c-524b85f2f0dd", "comment": "Malware payload (ValleyRAT)", "value": "1c5f6fab58c9af235fc22bf361e60ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773998139, "uuid": "d87fd841-d603-46e0-88bf-c7ed43baf936", "comment": "Malware payload (ValleyRAT)", "value": "c0fcad0ba982fd95958248c73ee12f1732229632fde97d645e2e479cc664bf84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773998139, "uuid": "cccd33c2-799f-49f9-9c98-828f6d5f9761", "comment": "Malware payload (ValleyRAT)", "value": "06eb6d6d82b02f391ff32a1ce15b1d89ec883186", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773998139, "uuid": "55ad9735-0cd6-4434-bea3-2eab20cfd9bc", "comment": "Malware payload (ValleyRAT)", "value": "9821040d9727962161694c35326a6d8444fd0ca8fc82e7950b656affed755af04d6c17190b0efaf4dd3667479b00e23f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773998139, "uuid": "31b09f1f-d933-410b-a3c6-e16bac900e2a", "value": "T12228337FA3AB753DD8355E763730D212887F66A29410CC17C9F48A48DBA85B02E7D392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773998139, "uuid": "2c947478-7b86-4e85-b463-01151dfbe51d", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773998139, "uuid": "b787907d-98b5-44f3-bcc3-a1e77d9ce3a9", "value": "1572864:LeTyd6AsHLnDPG5SBOY9rSwzKrz6YCCQ65lMH9r9Dq9aGxXMcjf3lC:Syd6vPDDrSqKiGdu95EaG1tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773998139, "uuid": "0c322bdd-3ea9-45aa-a3d5-da01ebaac438", "value": 102305461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773998139, "uuid": "3c711e04-0583-445e-8942-05d3090a7563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773998139, "uuid": "982fbd51-3eaf-4db6-9b25-3ddcbbaffbc8", "value": "letsvp_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5d9985-2489-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774030968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774030968, "uuid": "5663f816-5c84-449d-8bbc-eb4e5227560b", "comment": "Malware payload", "value": "26abcbfe111a0af18bef57897da30185", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774030968, "uuid": "f7ebd77a-8ad7-4ad0-a6bb-4cf5d2844dc8", "comment": "Malware payload", "value": "c242afc00e978ce32db7b490116d948b3da14ecb6e170dcf0e69ce2cd9d96f1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774030968, "uuid": "935eea8e-0830-442e-b13f-f6a2151a3320", "comment": "Malware payload", "value": "4f66de120e0eb2722d76bb9e3d3a27dd66a24de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774030968, "uuid": "f4276c38-7cfb-42ba-a347-14d0f62a84c6", "comment": "Malware payload", "value": "2c8541ed7ca4bf57426e811f1c72834237453c095e2fda930e6fd649d25fdecdd137a868308d84ea3f60326bf64292d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774030968, "uuid": "7b1942df-5b69-4660-a82a-9234ed421bc6", "value": "T14786496B22B5916BC15D8D7EC09B8B30C8F378710B33C2E7569C43554A6E9C36E3E6A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774030968, "uuid": "62320b21-5ae3-414b-abdb-f8be0dc837d2", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774030968, "uuid": "394b3ed7-3287-431b-b13f-ce016555756f", "value": "49152:6EC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0Ppq/MiAyf+blWEBief:SYCp2JD/df4WEBieNLCUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774030968, "uuid": "8b0e109a-a856-4f3e-bf50-f559695542a5", "value": 8591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774030968, "uuid": "a374c130-ce90-412e-9512-4bde6f76608f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774030968, "uuid": "47dc6afd-6e43-4ad9-84de-62e1c63656b1", "value": "SecuriteInfo.com.Win64.Evo-gen.15883527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9a2ae4-241b-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773983589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983589, "uuid": "55d549a6-98fd-4d22-9667-9637f201ce23", "comment": "Malware payload (ValleyRAT)", "value": "0eca6fd953f8e306e98714bb7bf37d78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983589, "uuid": "c40da0cd-8c7b-473e-8da8-b01383e2332f", "comment": "Malware payload (ValleyRAT)", "value": "c34b5313c165c6aa89044e9a3f81a2cc0367cdad81e12e8e6c4d7ff93c0fef41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983589, "uuid": "b27a1ff3-79dd-46a5-a0be-7850adc64a4e", "comment": "Malware payload (ValleyRAT)", "value": "c32c485a6291fcd63f3a26bfbe476bdfe098090c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773983589, "uuid": "a7c4c4d3-c91f-40c2-9329-169e472be0dc", "comment": "Malware payload (ValleyRAT)", "value": "07952db35a5251a7fc60b7e397c3f0324bfcaece411a62f2c74754a6a4243ac3e42eaa973e0825881fdc83e66cadfb30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983589, "uuid": "be6d880b-d9bd-499a-8ad1-baa9cf56d954", "value": "T170D6336B3D9F140182D07C8EC747D1B3CE9BCB160E360B6277909219F52646ABADB7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983589, "uuid": "7ff8825f-0357-45c4-ac78-81f2fb029134", "value": "a5c0b4b0144cdefca6a7954e47aaff29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983589, "uuid": "0a836ef3-14d0-46f4-a924-7ac136aaf2e4", "value": "12288:dxWZTDkuJqL3q7HgGsQkNEg8CRLPsY82I7UKTeB8sc1j9evdtYrL8Erij+QvgnR3:d8TzqL3q7AGsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773983589, "uuid": "be7cae41-2faf-4a52-8bf2-6ba42be65fdb", "value": 13325864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773983589, "uuid": "76704c40-7663-4508-a184-6f915808ec5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773983589, "uuid": "2ffd3c8d-8b09-489c-8765-646fd6fe4341", "value": "\u5b89\u88c5\u5305_220.15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3db7ce-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977982, "uuid": "7edaa5f6-aa66-4db2-8b16-916b2334796a", "comment": "Malware payload (SharpHound)", "value": "1e14997b8d035021f035860c728e5eff", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977982, "uuid": "38f06d88-2a44-43bc-aaec-c23bb1c1ae22", "comment": "Malware payload (SharpHound)", "value": "c5a84a394e5fa00a8f4ab931535a809db056f9e92b860bdf7b9322402f9a03ac", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977982, "uuid": "d87cda51-a097-4247-89c2-be5ec893e025", "comment": "Malware payload (SharpHound)", "value": "308bdb79c44cc63f9c09e94489c9b52d9d3e4fbb", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977982, "uuid": "b2289650-ecf3-4a85-91ac-e8b22782f956", "comment": "Malware payload (SharpHound)", "value": "dd6953c71445a83c7a9e94a5b933c420a81ec66cd640504b933c93cb15c6f57b923827ade65252eebf55c5252b851800", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977982, "uuid": "0894fcae-3410-4288-af54-b03b76343218", "value": "T1C355121953F89F95F2AF1F79A03041688BBB7A0BF9AEEB8D584C64DD2453710D861323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977982, "uuid": "16b6ff65-048f-45e8-8ae1-aa4f3d5248f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977982, "uuid": "2999cfdb-f598-4f63-8e51-1175700e871a", "value": "24576:GLIGEDwgrRvNuXoVIa09WmPstYX3xvPkJcEfI/TmdBHkong/iN9WCfumT:JzRvNE9WmPDXNXEeTmTHFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977982, "uuid": "cf3f385a-f295-444f-8743-e8bbd6b74031", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977982, "uuid": "57490039-9404-4840-9410-58f7a5b2b82d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977982, "uuid": "0445bcad-80a4-490f-9339-69987e7d1c2a", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f94e687-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989205, "uuid": "65bac821-af28-4458-9501-e524459627c2", "comment": "Malware payload (SmartLoader)", "value": "1aeaac73f380b8903af51d607cd9ded8", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989205, "uuid": "2e90d8ad-7359-4b5f-af28-4538546a563e", "comment": "Malware payload (SmartLoader)", "value": "c5b45ccc19da946197376a6e54727b485abc4f68b7ce069d6b3cb8e098d9b3fb", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989205, "uuid": "2b2a7230-d726-4c9b-8ff9-5cf340e8135f", "comment": "Malware payload (SmartLoader)", "value": "0188c8ab5f84074e272365c1d053afadccc9b098", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989205, "uuid": "28ff1325-d527-4b66-bf00-3c0fc307d199", "comment": "Malware payload (SmartLoader)", "value": "0c3148784263dc03a0be03c50e2f26e3f00c601df549f0020c4b30e3e292ea2f70595d5a393dec63b480707a1654cfd8", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989205, "uuid": "2ada93d7-5258-4e2a-93a9-ca67cd43e4d7", "value": "T19BC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989205, "uuid": "4e6216ce-f10d-4889-98de-7237d2dc201f", "value": "12288:3+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byRH9I1P0QKw6FEZ:3+QqldA/TSO713u7xnRH9IaQKHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989205, "uuid": "98f9a236-7822-4aaf-bc79-97fd05c1944b", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989205, "uuid": "c82fa1a4-388e-4b9d-99b8-775469a26c22", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989205, "uuid": "67e5b0b0-3546-4ebf-86e2-c28ee4dca720", "value": "Tp-Css-Html-Final-2.4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68612992-247a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774024358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024358, "uuid": "f4818042-cc43-4f80-9b33-8ab5e4c57235", "comment": "Malware payload", "value": "839536ad221e7914dbfc32fe5b52e4ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024358, "uuid": "372957c9-50a9-4ad7-8250-22ab375c71d6", "comment": "Malware payload", "value": "c60c466575e11effe11a5ec7901f8a3017f25fbfb46d0df1fde8800ba3c49f55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024358, "uuid": "fc37e9f1-97d5-4bf0-8693-3f5899edce81", "comment": "Malware payload", "value": "1388c7c9e271b4d54ba752f87a9db598da188bf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774024358, "uuid": "5b497029-abcb-4427-b8e4-02159092c2c6", "comment": "Malware payload", "value": "ba73ba0a72648e919d2bec9865891cf91adea3b528f1753ad8e0e9ca33e2a89e9b0861231cd1d64a863897faad5ec1ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024358, "uuid": "c92cef5b-9b76-4957-a8bf-919a2d1af676", "value": "T14E96D6FBE2789368C7AD8D3EC0528A4098F3767F1733F6E7599003598A069D15E3B621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024358, "uuid": "79122d0d-459f-482f-a114-71cecc06ff99", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024358, "uuid": "3ddea48d-8d07-4b29-8c80-a8982f65f480", "value": "49152:iEC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0Ppi/MiAyfVvqn4LSQ9:KYCp2Jr/dfVvq3Q43po7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774024358, "uuid": "607f3482-284e-49e7-99ae-8200e29ac6b7", "value": 8724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774024358, "uuid": "c67e289d-8ea8-46b4-9cae-c7850d75b1ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774024358, "uuid": "ff785a2f-eabc-4faf-a81f-711b2a3fc3a8", "value": "SecuriteInfo.com.Win64.Evo-gen.43592195", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2685a03e-2458-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1774009644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009644, "uuid": "42fa41be-6edd-4600-9db9-2f3a93f06ef2", "comment": "Malware payload (XWorm)", "value": "bca08f92dc4425eaa59a32462f76a57b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009644, "uuid": "a1259626-edf3-4356-ad83-7c102851604e", "comment": "Malware payload (XWorm)", "value": "c65eaf97e859f449181b25903b14c53b29adcba3a8f456e006fbf045e4e85613", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009644, "uuid": "df817364-2adb-4af5-bade-bc510d3c2ec4", "comment": "Malware payload (XWorm)", "value": "fe8b704df9e628d6d092718277fad2c19c8419b0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774009644, "uuid": "96d2b914-b0ce-4052-9047-318bea2ef7dd", "comment": "Malware payload (XWorm)", "value": "68b12a8e671545ab7943ab15b234ceb2dc86bf9c626258b0f548e0f2df0a118b76c3c02ecb3cc02fa5e9f9fc048b521f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009644, "uuid": "ce07387e-e9fb-4405-846c-0caf8d180664", "value": "T1B2D533D9A5297BF1D2933EB911ECA471E23285CF44D4900E059AFFC62EB7BCB49D2481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009644, "uuid": "07178e28-aec5-4cb7-a111-f59567a338f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009644, "uuid": "8bfd1f95-2d00-4842-8e65-9125efe76e8c", "value": "49152:Z9Zmdo1sNc/56Maq7gx2xwIOQly/KvlhP3/osx7k3bTHb2JN3cQPpnGei:ZjaCYNqm2xqMM2fk3/b2XzNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774009644, "uuid": "24802503-b78c-4a61-843c-9d993f0edc19", "value": 2971648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774009644, "uuid": "55c7a090-4aae-42bc-9f78-5ed60b54e2e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774009644, "uuid": "56540dee-ea5f-4f64-80ac-d417e8c98d02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecacc03e-2428-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773989361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989361, "uuid": "83e5f255-6a0d-49eb-bd9c-09ae4f25923d", "comment": "Malware payload", "value": "a79244da9544d5a040d7d030573d3c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989361, "uuid": "948ee294-7142-4ed4-a367-d8f3e477c47f", "comment": "Malware payload", "value": "c69e69dc3ae7633b9476072001c4eaaeb8dd8c85700b97484dfdda3d86fe6fec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989361, "uuid": "46699037-91e2-42a9-9fae-5a951374d014", "comment": "Malware payload", "value": "042dddfc884560af782be0c0ca546ff2aa59f97b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989361, "uuid": "50e12c63-e678-4c1c-8b61-181eb11e9919", "comment": "Malware payload", "value": "3ad04568a8c18d13f9ef1b9156d6ac53ddd15feb372bc5153eb0efd0a910ac47f6c84c9fac4d3298bd2f52ec762aab13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989361, "uuid": "be3cdbad-3e45-4d71-9fe0-039f64dbf3e7", "value": "T18B75330974911E420EA64064F37D4FDCC400F6EC663B316A03AE1E9EE77B352AE79B59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989361, "uuid": "9c1d8e0f-952f-45bf-82d4-635932a45f55", "value": "24576:KxPLF/0kL+oHC6hGw/bLdJfyipF+CGBZwWMJobF+Nl9qAdgCnvBcCIfRsNio9zkb:OgbwDLDqipJJWMoB+hZddy5oBk/j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989361, "uuid": "ea7d8ac1-98ef-460d-8be2-5aaa4c2fa981", "value": 1702544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989361, "uuid": "1a3ef3be-04ac-4672-807c-9b19d430cbcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989361, "uuid": "67c0fc6c-df01-42b0-b8c9-cca18fd58860", "value": "linux_mipsel_hardfloat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8261419f-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040722, "uuid": "be61d748-641d-4570-9513-4ad84551c82b", "comment": "Malware payload", "value": "cd4cdf5d7523bf864e102239bef322c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040722, "uuid": "50420a7a-612d-490b-8354-f769b0b27ba2", "comment": "Malware payload", "value": "c6c28cd300143b20a0728a96bfc9098749d97871dbe8a85a7a507f97b23cc60c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040722, "uuid": "e1736c66-022e-4bbf-ac6c-90e1a28f9fef", "comment": "Malware payload", "value": "9ba7fc484a9d97e008ba3e0836e3ff7151feb004", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040722, "uuid": "31bd2007-e9e8-430a-aaed-1a0f5624eedd", "comment": "Malware payload", "value": "86574293ab9eb5f8ccc4602c14beeeccfbc16e5148c6495881c66db22a2413fe672cde31f9562e5e8bd6d5628b195e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040722, "uuid": "0d86baf2-d63f-45c6-a2be-b3bcb704413d", "value": "T139F46C2BB77541FCC07BD13886539916F6B1740A43709BEB13A006A62F277E4AE7E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040722, "uuid": "be7b6638-5a2c-4567-ac2b-416bfebd5a99", "value": "f0f5c81e68bcb48f13a86aa9b1c42c20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040722, "uuid": "b3a53192-2ec2-4227-8f92-308a30e1f0f5", "value": "12288:gE5w/q9OhRRY2Bk0S/HThZ28/rk1UeMjoeOTejfU:ZwS9Ohm0OHTZ/rFe2nOTeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040722, "uuid": "3312420a-a729-4a3d-8288-f3e0c6af4747", "value": 773816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040722, "uuid": "fd85e061-33da-407b-9edd-96bd0c4ff0ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040722, "uuid": "12ac8026-b59f-444e-bc09-cb63f72b6da0", "value": "edeb387f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f03cc9-24a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774041968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041968, "uuid": "dd302d51-8bd7-4a00-8b5f-4b05f8c2d98d", "comment": "Malware payload (Mirai)", "value": "9eac3296b87125e4d5012787c16e1a40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041968, "uuid": "573cc020-a476-4664-9101-d8c6879b55d3", "comment": "Malware payload (Mirai)", "value": "c6cf3e38335114df33a9add8d25c13324598ab14dcac4d464f964cf8ec5bd7aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041968, "uuid": "7dcbb4e5-b833-4d1c-afd1-0ceaa993ec5e", "comment": "Malware payload (Mirai)", "value": "5d7fca03ee76acc08eaa80a0f707853e0ede4101", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041968, "uuid": "e980a90d-a7f8-4523-bb79-a446b82dcc3d", "comment": "Malware payload (Mirai)", "value": "a6ea4a628ae0eb27cecb80e250234a203cb2f37b029a25c123bfe4aca605cc3fbe4b52c0d79d574ae822993b0e303da0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041968, "uuid": "7f426a0c-2912-47c2-9c3e-e60c8c0bdc23", "value": "T18EB35B73E8222F58C594D0B5B0608FB81F5395A1814B5FBE69B7C2749083D8DFA49BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041968, "uuid": "ee85583e-2d45-4108-b600-051bf8342c3d", "value": "1536:/1z7j+hmSW2yPbUzDHQs7CDKgCLh7Q/qpxZJOWkrGtBUVM9Q2Uhfd:/1z9SWJUfws77gn/q/OWcGtaJNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041968, "uuid": "ac768538-3953-4d6e-a41d-787da715831b", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041968, "uuid": "f83f71e5-de3f-49fc-a60f-7f72bde00261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041968, "uuid": "926a3271-0de9-48c5-956d-5fcea0c832ce", "value": "r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ee7a82-246e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774019285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774019285, "uuid": "7e7d9f87-566f-48fa-b233-7b9533af2436", "comment": "Malware payload", "value": "11cd6531d220072045bd980e354a6c1d", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774019285, "uuid": "84d6569e-a9bd-4b89-880c-f550863ef2b2", "comment": "Malware payload", "value": "c75b99b5a5d90f74aabb4596cf515f6f448b224a04e7e30d6f0d10b8348d8f6b", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774019285, "uuid": "4aad0933-d3ca-4c4e-a5b0-0a678d1637ca", "comment": "Malware payload", "value": "deb3c9eac82a08304c4b35ce32c6ce77612c7cd9", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774019285, "uuid": "0c485c6a-550f-4e71-a96e-5353c4e53ac0", "comment": "Malware payload", "value": "fa7074c870cc318aee8e375777d7dae66eb4166b43cc8a086135dba10a7eabc2fe18a7f598e779bf6cbe3de05f3fb77f", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774019285, "uuid": "8e3aba73-281f-4362-baa1-878e6a8a00ba", "value": "T1D345FFD35B480BEC97E4CCDE02983657A4F2C1B77C2E2249F9D68A13B43ED14B925A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774019285, "uuid": "6ff37e92-9c05-41c7-ba56-f6c0587a9b5a", "value": "1536:EVy9w24+yBamnln2sdCmJIx9iwfNbCYQ33sOWAeaxArCee4azLjwsTa1GbNVc44o:CRfPY6XHMJFKWDKw9Dk1aZ65Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774019285, "uuid": "e6a7fae0-a087-48f6-a86a-f0581fdc3377", "value": 1187241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774019285, "uuid": "cbab16cf-aef1-4627-beae-1d009c9aa707", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774019285, "uuid": "a6a0da36-476d-456c-b42a-29009b81788c", "value": "lefter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e254074e-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046896, "uuid": "a0f66dd9-597c-491b-a5dc-af6c9f365c46", "comment": "Malware payload", "value": "c1612ee4137eee18974ec1a17cf31b2e", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046896, "uuid": "9627cca6-acf3-4843-8c0c-3c8668747646", "comment": "Malware payload", "value": "c76d59052e5ce4ccd3a5b54c603a6ca512f2f1b1743c15de29d501ebc127f191", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046896, "uuid": "78cc2b02-41ca-4a8e-ac81-100e99cca2ca", "comment": "Malware payload", "value": "eae0adc91340a3351c15fa0c0a62c0dd157467d7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046896, "uuid": "49d5ef94-bbf0-486c-a53b-0a403b08638d", "comment": "Malware payload", "value": "801ddcbbab7729eb41360d4ba84fce226478fef329ba1ef35c70f1149f1cebed57eb8a7eade292832bffbfe110c2e0be", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046896, "uuid": "49d95626-cb53-49c0-a278-01f039293c4f", "value": "T1AB55122953F48B95E6AF1FB9603102698BFB7717F8ADEB8E598CB4DD2442700D851233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046896, "uuid": "13f707ad-cd23-42bf-9ff3-527c5059af03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046896, "uuid": "306af38b-a4f1-4e43-aba1-88ce671ab6f6", "value": "24576:QbLIGEDwgrRvNuXoVIa09WmPstYX3HcVIGtSljkong/iN9WCH:QQzRvNE9WmPDXXs1gjFK4WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046896, "uuid": "f573d67b-1f9f-4a3d-818f-4d924c7b8eb0", "value": 1284096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046896, "uuid": "ea89ecfa-80be-42f5-abbe-68b58c33145e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046896, "uuid": "a166bcae-de2a-41ed-becb-e5268e724c5c", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b9c51e3-240b-11f1-a769-42010a9c0008", "comment": "Malware payload (FatalRAT)", "timestamp": 1773976582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976582, "uuid": "dfca0592-f5a8-4aa1-a914-1bf2a4d9041e", "comment": "Malware payload (FatalRAT)", "value": "10771b24bcc3aae9e8c630d3a53a7b9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976582, "uuid": "b36303d4-4ac2-4803-9580-784e30f5a5b9", "comment": "Malware payload (FatalRAT)", "value": "c796d4b14d6cd27b2bcf3db13677c824b0d7eb4a133567a4fe6e40b4e35b33a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976582, "uuid": "cb806824-e1dd-4af2-a493-11932b136ed4", "comment": "Malware payload (FatalRAT)", "value": "864e49257fbcde17c90ac77ecba5195abeb56226", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976582, "uuid": "8204d9d5-a8da-4615-8216-ac89ca45365c", "comment": "Malware payload (FatalRAT)", "value": "ce99716727a59c09462ef8ca3db5ffc2bc516a01ee29179d21f08dc6ffe6335f24ff1bab2d9114e516a102663d5907b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976582, "uuid": "4600d65e-ca0c-419c-842c-a585004c98c7", "value": "T14E14192CE943C06BF4D240F5C3E287F96A7C5E37339120EFD7A4655A13690E929718BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976582, "uuid": "a5edecdb-064e-4872-b23c-e7ca8c1e2721", "value": "5e5e0516b9cb49f396b0ce208c8bee82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976582, "uuid": "410668cb-89cc-4b09-b1b0-2e074d9a7039", "value": "1536:pLNBhXd4ikzIJiUFK0IP49lEE2uwPERQNBldJQqOetA5u:ppBtd4iKuiUF5IP4XlWJPQq1t/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976582, "uuid": "fa496528-5853-4853-bb5f-9ba21199680d", "value": 192568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976582, "uuid": "485ae5c7-5e78-4569-a31f-7201b6c21852", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976582, "uuid": "29464946-5179-43a2-b473-fd83b095bff9", "value": "10771b24bcc3aae9e8c630d3a53a7b9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7014b596-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040691, "uuid": "d842478a-eed6-4909-87e8-e37865f2c7ec", "comment": "Malware payload", "value": "7f5694e9daccf259dc4a732b29090472", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040691, "uuid": "0a324fd7-92d7-4950-a899-e96c2439f848", "comment": "Malware payload", "value": "c7d62e129de1b306f45aa655f1da8158237b866261df3d1bd1c31ac89f0774c8", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040691, "uuid": "231ac798-e9ef-4fc9-b5b7-b4123ebc34f6", "comment": "Malware payload", "value": "a6eccbd016bd96eeb431ee7f763070ba1d14bdc2", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040691, "uuid": "02ac4eae-4bb7-4cda-9cf1-87b4449e218d", "comment": "Malware payload", "value": "72f8a95a2eb745ff1f634a2831fcbbea501453f254433916b692fac28d2bcd93f721dd1e0feb56662e706d3f46f3fa0f", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040691, "uuid": "3df6a82f-0375-4e65-ae4f-0b6c5d724cea", "value": "T13E25FA5C640DEFB25025C97C1C950F7E19A3AF0F2665182870ECB61C7FDCCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040691, "uuid": "dfdcb9e8-bb4f-4f14-99ae-5303b4904d1a", "value": "6144:hYcrKC1OClOC9OCpOCDOCXOCgOC1OCWOCNOCaOCtOCFOCBuClOCDOCo+IqxHp+Ub:j3CihTiQFo3n+LTtRYDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040691, "uuid": "87d465bc-b83c-42bd-a3e1-72bb9ad8e63e", "value": 1016911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040691, "uuid": "80d02139-f7a8-4314-a649-63b7225aff2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040691, "uuid": "85123d97-bb71-4278-bc66-35b069acaf4a", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b7a036-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040699, "uuid": "359a6a23-78e9-4c7e-b703-d2acb9346beb", "comment": "Malware payload", "value": "32c1c3bb8932f2e06a1670b7a9589317", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040699, "uuid": "4c3f2947-e68e-4187-95f3-89b874a4e030", "comment": "Malware payload", "value": "c7e3e91f71b72e8025a270a430e8fa7e2ab4b93a3c68ede1a9f717711ba33c1e", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040699, "uuid": "32f9c7e2-824b-4806-977b-cd79092bbfc6", "comment": "Malware payload", "value": "99d14b52fb58e6bb0221df60308ad8c9f75fda6b", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040699, "uuid": "f67ca3ba-aac1-465a-87ff-e5421e315955", "comment": "Malware payload", "value": "26fd9a5fcb778c708ccef2d79916767b62cfb31c5b5e82f48c89bdee5a7aa34489fcc8eaa5b7ae400209119a70ee6fab", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "x86", "colour": "#3BD92D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040699, "uuid": "3b68534b-a690-4130-a75a-c6b2af1035c9", "value": "T17006AF45EDC625B4D6031A3648EF56DF0B2CBF072F319B83B9447BAAA17749704B622C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040699, "uuid": "63d39e48-b27f-4b94-8815-89c8d2976b65", "value": "24576:YR1eLHUBLxhyywKSLJpK/2fZfkMVY4J2plarI1i3n1WvxdyCy91h+TlzGrUm30ts:YBu1swirYlDrImo7/1cphxF5RE6Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040699, "uuid": "a627f583-d6a6-49c0-b5aa-3710364eb95a", "value": 3771592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040699, "uuid": "75e814f5-f60c-458f-9eec-02780b6822d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040699, "uuid": "13c2b4ec-4a8e-45bf-bc7d-38bc2b05af73", "value": "linpeas_linux_386", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f76e98-246a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774017503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017503, "uuid": "0fdcd3c5-dd24-4895-a0fb-8c4cd1b7ded8", "comment": "Malware payload", "value": "39de7716b152a5cb084e243ba92c78cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017503, "uuid": "e308f8ff-1ea1-49cf-8e2d-9594cdac58d9", "comment": "Malware payload", "value": "c7fe86aed191cb848d436b49602f3c351921030cf9e6879d9f8b438243abb63d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017503, "uuid": "49bf8776-5e8e-4801-a26c-34664ea3cdce", "comment": "Malware payload", "value": "e45005a1cc64501eb98f550d6785733cb11f8649", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774017503, "uuid": "e7985083-9002-4fd0-adf3-c25b250ca14e", "comment": "Malware payload", "value": "25ab3fc516f04c816c397f775e027422a64d7bc328451d1203c9132c9a237f2da33586911295da0cdaa2ae2dbc7116bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774017503, "uuid": "35a92f40-b4bc-4029-94aa-42f25fe67917", "value": "T186F533EBD8DC73A0994D9B3CAB353643750022F429ED56522E95D2730C3B0D9ABE274A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774017503, "uuid": "5c334bf5-71e1-42d2-ba64-059000ee3baf", "value": "98304:UISe13/F/FXiEJkW97U1nR88WQjmAkcUw3QGmf:VzX9jCWQjmrw3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774017503, "uuid": "05bb993e-52d8-44e5-b59a-fe2a097c1b3d", "value": 3450416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774017503, "uuid": "7658d9e2-d1a7-4357-892c-592de36b4c31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774017503, "uuid": "3ce4dfe2-5389-4f5c-baea-c7c1b2cc39b3", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd535a87-2446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774002166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002166, "uuid": "7c970ad1-f04a-4928-9176-226c6ee683a0", "comment": "Malware payload", "value": "8d91c609f4d669890560a14c29bd24f0", "object_relation": "md5", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002166, "uuid": "3df826e2-6eff-44c8-9b05-c27d8448a762", "comment": "Malware payload", "value": "c87ec10a6b3477e10c158bb5b7c3cd1cd43fd83f619527a7e7fcdd87103b5a29", "object_relation": "sha256", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002166, "uuid": "3a0914b3-1b7a-457b-8642-3d189926e79c", "comment": "Malware payload", "value": "2b0ab5e381efc13bcfbcdca280a0eca93a110b8b", "object_relation": "sha1", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002166, "uuid": "637884c2-e1e5-4fbf-88bc-7beab6f0b7e5", "comment": "Malware payload", "value": "0d3f927f78585456a9561cac06fa70a332e26981ebafef3a3f719a71561f9133cccc5f8b10d1454466ab28d225b447de", "object_relation": "sha3-384", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002166, "uuid": "ccf3ba11-a24b-4bda-864f-aa7bb906c5df", "value": "T15E36F131E66D0036F83BEF33C0C275A134FAEED1511BB0A63B79056D8867A958B3E915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002166, "uuid": "6c09feac-0783-41b6-bd20-e67a296d4eef", "value": "98304:EkzOmN1C8eWms2SKro1pEN3tHXk+rRuk0G9JGZHQp9PeM:Ekz48eO2modHTdz0GnG+9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002166, "uuid": "f8dcc6f9-685d-45f8-83d0-56bb8fb1ee37", "value": 5079666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002166, "uuid": "7365a126-5e0e-4ba9-a1c3-27ab242c4639", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002166, "uuid": "62a35da8-b3dd-4781-bf2e-3d5d0f538cd7", "value": "best-1.21.11-68.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4081c191-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001098, "uuid": "5e4ad803-0f2d-4bcf-a7e5-ada7f42b8e35", "comment": "Malware payload (Mirai)", "value": "89ed26a9f99817ecde017fb91f28f45a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001098, "uuid": "39e177ba-1c7f-4611-86eb-1e03ed38b8c5", "comment": "Malware payload (Mirai)", "value": "c8fdae49133b119723a70beab1d4ef29f915d4aefeae76686a446dfa08c71775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001098, "uuid": "860452c0-a304-425e-8847-1d9319dda85b", "comment": "Malware payload (Mirai)", "value": "0cb107c59fb1e1882be4c83776f120c1fd828793", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001098, "uuid": "174c9229-a7bf-4f91-bb8d-c2afd6ba14eb", "comment": "Malware payload (Mirai)", "value": "62ca2757769e5791d90164755a6b2c895a094fc7cd997d0bd212d633d5a5b6b944112e216f8acf78b68c8ae1ffedbfec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001098, "uuid": "5e26152e-e940-4164-9ff5-92894df0b9a6", "value": "T1F7F318C7F900DDBAF80AE73A48570909B130B7E245825B333257797BEC7A1991477E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001098, "uuid": "0ce66d46-904f-400a-a85b-555a01a50c91", "value": "3072:6x3J1ZduMz15s2g1UiZOqARXG9qAHZVqjbiTLaSw3MyRk95x:64c1klZOqWX9AHvLaFMyRM5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001098, "uuid": "6de28776-22ce-4ce2-9758-eb6c42ecbcfd", "value": 162976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001098, "uuid": "81776437-3211-4f21-b7d9-bbe0860f8d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001098, "uuid": "8b9826e9-c705-4290-9f0e-ef1eade88487", "value": "k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7530f637-2406-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773974557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974557, "uuid": "bb2aa328-6fa4-4035-bc2d-a503188ad97e", "comment": "Malware payload", "value": "4293819e66aded8cd416bdfb97865986", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974557, "uuid": "d62c55e8-7c3c-4441-8344-f76f35e9674d", "comment": "Malware payload", "value": "c93bc5209ee539a36527fa4ea5b2ea48da7117f80e43bffffc1656761a29d14a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974557, "uuid": "dbfa343d-18c4-48a3-bdc0-c857de478ed0", "comment": "Malware payload", "value": "25edcbbed6f9086e9855131461a5399c006856ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773974557, "uuid": "6f028f8d-af19-4571-b919-739b6aba07cd", "comment": "Malware payload", "value": "4dbda6bb6334f39388aba2783ae7bf9f59578857a75f9e623300bd29ee6e46248e736e22c2ce44e342f0e8a9e70170eb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773974557, "uuid": "8a07d13e-9093-4cf7-87ce-79163bbba0fe", "value": "T1B9925DB512496D79FBD0CE39AF3C6F4CADE882C42124F3ACBA0F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773974557, "uuid": "0a5bd561-7302-401c-a42d-4d2a7fdeb34c", "value": "384:sHcuQpWx+BL0SWL0gHzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:sH8i+BL0SI00zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773974557, "uuid": "817bee2e-46bb-47cf-bce5-4b48f92bf7f7", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773974557, "uuid": "9f7d98d0-dfa2-499b-ad31-4673c65ed438", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773974557, "uuid": "d8df0c25-e3f1-4ae6-8baa-923a15874486", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4204b12a-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773989075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989075, "uuid": "bc230b5c-954c-40d8-a336-1aa4be7cc918", "comment": "Malware payload (CoinMiner)", "value": "b85a48a85dbfa3752b26ed22af4a49c0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989075, "uuid": "67395fa1-e762-41f4-87c3-b8cd2e9fd111", "comment": "Malware payload (CoinMiner)", "value": "c982c57e6e25fc3a6d573fa0baaf8f686d85745e0aec6f978c913d6044dfa047", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989075, "uuid": "11db399c-8c66-4db3-8759-71ffae87383a", "comment": "Malware payload (CoinMiner)", "value": "94d07298188c898bea52371e6ac2dcab34a0c880", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989075, "uuid": "6f51f804-03df-4587-a1e2-29bf2bb1d0b9", "comment": "Malware payload (CoinMiner)", "value": "b675b8d550e7add112791891ba2404b02a6013d53cc8f37813cf2f3a2dd25dc259737f063b2546af69bd9bd2a4a7179e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Ymacco", "colour": "#7872FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989075, "uuid": "fc023122-b7f0-40b0-9318-2acf9fc1751e", "value": "T177363362F480E431E039143A24E948F1F07DBD7197254A8FB3AE3A755E352E82279E5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989075, "uuid": "633135f8-3165-438a-95fb-4226e3ba3524", "value": "91ae93ed3ff0d6f8a4f22d2edd30a58e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989075, "uuid": "863da262-d341-480a-a9a7-65388be49a2c", "value": "98304:RLGSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+YD:YBfTCiUswVSLOJgyBG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989075, "uuid": "fadefb2b-c3b1-4b7a-85ce-c6ad313be182", "value": 5315959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989075, "uuid": "96f87263-65db-4df4-8099-16ede06c162d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989075, "uuid": "73f86b3e-9137-4032-b3b0-5205a85c4014", "value": "bd8fvn86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f03804c-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050488, "uuid": "dbd73985-e69a-41c2-8965-6985e4129de4", "comment": "Malware payload", "value": "7e80e05278926a72c4636d5793126ba4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050488, "uuid": "62292c5a-605c-4ab3-8c59-3e6092910ea2", "comment": "Malware payload", "value": "ca5e88a64127a13d544c50e75b36a626b0e1288caac4a81e45103df917f5ada2", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050488, "uuid": "0e113954-adeb-40e3-889e-3c0c090e34e4", "comment": "Malware payload", "value": "ae293403e3406c0719b7f71956e1be7a51fc62bc", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050488, "uuid": "2cae69dc-660d-46e0-9f35-e0abc1483615", "comment": "Malware payload", "value": "5e2f9939986832f5ef2e02b27dbd14b30136fd7ab500fa75e194b9d51806ada5a367db14ec594b2726afa6900f98b18d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050488, "uuid": "f2038216-7e32-4062-8f62-f4fab50a0da3", "value": "T1F8D66B45BC1D7462DAC9B5347F6653943238BC449F91C32A2528BB7CBEF2358CB632A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050488, "uuid": "7451f146-7af5-4c33-a260-490bc80116a1", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050488, "uuid": "daf43b58-a75a-401e-8849-3a7f5c68ebf8", "value": "98304:BohiMmLMbWn8dkiZWIT+PMhbde5Q3/bTo0v3gttsnoo3/2NbGF8wjPqE:BsiMmLMy8eQ4MhgA93/2bg8wjP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050488, "uuid": "26a9e03d-5bc6-4007-a1aa-4582f6f34a53", "value": 12676096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050488, "uuid": "4765ff41-016c-4d22-9d4f-164b6d1561e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050488, "uuid": "a68c9bfd-2b2b-42a9-8c96-16db2dcee6a5", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc33ce83-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050375, "uuid": "a75c979c-306e-492f-b3b1-58766e80c52c", "comment": "Malware payload", "value": "8a69f7861a3f0574cabc46c40daa5831", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050375, "uuid": "05683d56-f318-4c19-a25b-94e5fcbc08e4", "comment": "Malware payload", "value": "ca703d739a6ff3fed6b576af29a53b3a07a75b970229624a90f4995cf6f52991", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050375, "uuid": "57490c71-f884-493a-9e91-0b9d64c45357", "comment": "Malware payload", "value": "07695aabf98d740a5f94ac4102642c7a07e79e73", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050375, "uuid": "26d5f58f-59d3-46ca-b009-936ce19000ba", "comment": "Malware payload", "value": "fceb245100db7055d78b05bfb14733bc4bb299b698589fe9c6398717f6ef8eced37209ab8f2e3858417711797478651e", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050375, "uuid": "d4b9af1b-47e1-4da3-af16-68588e3b845b", "value": "T154D64B03EC9545F9C0ADD130CA269262BB717C499B3123E72B64FB282F77BD06A79750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050375, "uuid": "c3af45ed-167a-4f43-9718-fcea821c0c27", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050375, "uuid": "1388e485-125e-4a67-b3f9-964faa5084d6", "value": "98304:EN3NtSl1nttUtJ34KJroPYINUEtMlT6PNUpSx1hRM99E:EolhtIJ34WMP5NUwMl36wu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050375, "uuid": "5893fde3-3ea5-4336-b410-3b78042c4327", "value": 13678080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050375, "uuid": "a87a656a-c609-4fcb-86ec-864dead0d43a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050375, "uuid": "0fbc8eea-c24d-471c-9f67-e9d20163bbc6", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b876b1de-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978106, "uuid": "89936798-75b4-44fb-8b57-1513ad44243e", "comment": "Malware payload (SharpHound)", "value": "91122856972b0ebe81d0fca4eda64fff", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978106, "uuid": "f7736ad6-8248-4b7a-bfb4-687eaf6cec09", "comment": "Malware payload (SharpHound)", "value": "ca96808f64bd449c3892a6c08185fb0ad30de9618af198e5daa6ea6d6680e79c", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978106, "uuid": "ba5a6937-bb19-466b-8aec-4a9b80fe6ea3", "comment": "Malware payload (SharpHound)", "value": "da320f5f49daaec26afd0d24655ebf82ea9d3941", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978106, "uuid": "62110228-d994-4924-8248-26097e5d5430", "comment": "Malware payload (SharpHound)", "value": "b8ca900eb775fc267ba2f2da9081a1aa339badd971a26f58f74949dfb96254ef41823f57e9efdfa5e09e402284b72b48", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978106, "uuid": "9d4733f0-f65d-4175-b024-9db34ff774fc", "value": "T1C37533A03E5B55AC1B6C4635047B1F0E8E51475B909CC2E2F1EDE4822F3AFA5C2774BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978106, "uuid": "39386489-00d5-4c1a-b9c1-db41f74fcd32", "value": "24576:X9B9KVOxvpxNsBWZNLXkWCRpxnNiHZxgFh+2uyioUF8tGbNpjmsBCJPUDoAfiK36:vFpxNBZtk9E23YvjRDoAqK3TjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978106, "uuid": "8fe1e66b-d496-4e13-8d01-d106ed1bc59b", "value": 1612229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978106, "uuid": "3d627a15-e606-417c-9580-4499a423ac67", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978106, "uuid": "c19dd6af-3cbe-470b-b7ea-4d67206ed631", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d068db-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001056, "uuid": "84218063-3c58-4c53-b7c4-595304ab849a", "comment": "Malware payload (Mirai)", "value": "02f23f01e30d5f4af1c78826aea184bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001056, "uuid": "234282b8-df57-43e5-be06-d41eea066eb0", "comment": "Malware payload (Mirai)", "value": "cb3110ed7e474c88b71eb8d13a2e4224ce0632dfbb5441028e49dabc0da3fd22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001056, "uuid": "e5ad3ecd-2ce6-4177-b7ad-7c8c17ead23b", "comment": "Malware payload (Mirai)", "value": "0928983d30fe1d3748655e0304c3fc45ef1662b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001056, "uuid": "d0288b01-1443-4abe-acf2-6e841ccb53db", "comment": "Malware payload (Mirai)", "value": "b81c330119e5320f9844ddb1b33d753401d258384d158401de06b377d2e85fd14dcdc2470cd2b1e5f5de37ac8ac8615c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001056, "uuid": "66dc829e-1138-4615-a6ea-4b915600a0ef", "value": "T1FF04A71A6E228F7EF668873447B74A259B6C33D627E1D644E1ACC1105F2029E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001056, "uuid": "0b9d4199-e091-400f-9911-9bc95abb3535", "value": "3072:fl+quvEVTAcFvV7kVnEtRA6T+Ig1oJGvw:QqfVTV7gD6TS1o4vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001056, "uuid": "7064c4a4-fb7b-40fa-abae-58420a5d7048", "value": 174999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001056, "uuid": "e798f5d4-b8b5-4c64-8310-d74a5d902c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001056, "uuid": "cb8d3ecd-d173-45fd-9b62-0e561355043e", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fbdc905-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978280, "uuid": "ee5f34d8-b2e1-46ab-b20b-8b46ba008b97", "comment": "Malware payload (SharpHound)", "value": "1cefa7ba3fd90a7f802d0b7b6d6f2619", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978280, "uuid": "ec1a3c79-077b-4748-bf78-4e4aac5cd805", "comment": "Malware payload (SharpHound)", "value": "cc6e416232368536c1fe1b1fd7c9ce1238bc2c2d710d32f597bccc3934a85d5a", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978280, "uuid": "83f377cd-d87d-4ac1-bcc6-a3947d4fc78c", "comment": "Malware payload (SharpHound)", "value": "cc8ee64c0c06793c5ce3831e58411ac164600284", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978280, "uuid": "d6654d5c-e593-4c17-a809-a83252b34b82", "comment": "Malware payload (SharpHound)", "value": "83dec89dfd11307e822564f8b138e4d41231afdba652450cb13ee33fdb94e65f56a53bb4566e766d7d4a0b9d3ff4d733", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.7", "colour": "#0FFB77", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978280, "uuid": "21ee5050-bfde-4cb6-911c-306ecc8ebe02", "value": "T1467523307B790FA649384338758BAF1ADEA05BEB4419D45E79CF46C62BB544281ABC3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978280, "uuid": "cc32fbcd-7a72-48cc-b184-f48f13f4db53", "value": "24576:9HBeFMcu2ZUAa0mKVVCgcufUW5VV3jxyuzrk7ImgR461d9iW4/7oJjHUAq:9hQTVWAnjnRp95oo90Aq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978280, "uuid": "c6622652-d472-4853-9b4e-16487f5c5a97", "value": 1594261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978280, "uuid": "c310e68d-c172-4194-aa62-d24b2c60ae4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978280, "uuid": "1aa5652e-3688-4e39-9752-69d6d069fc12", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0eb6c1-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050427, "uuid": "8165461a-ce39-4d90-98e1-f1ca86b91b42", "comment": "Malware payload", "value": "e39e4b68a73210583fcbda6a1b6ac280", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050427, "uuid": "a900ca53-91c6-435e-a967-348aedaf6387", "comment": "Malware payload", "value": "cd1c700e599717687823b6471ffcb0c74b2af33ab00570e753501a785901f0a3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050427, "uuid": "d4dfbf15-d04c-4c58-bb80-465ded51b982", "comment": "Malware payload", "value": "ff35665b92f10e68483fb7c5f7820c1e9059557c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050427, "uuid": "b5389d22-bde2-47fc-b8e2-eb5e414dd966", "comment": "Malware payload", "value": "4367a2a2c610c00e46c045d3c3bbcc6ccdfd880f37007834c7a43e89c7df349d1730036ee5a56f7aedf812fa4e929468", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050427, "uuid": "6f53472e-06f1-4beb-9b0b-897c8c6da7af", "value": "T1B3D63A07ECA585E9C0ADD134CA629262BB717C494B3127E72F60F7282F77BD06A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050427, "uuid": "3c9d7bd4-ee0b-4d90-a4b5-c9e1a02d2368", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050427, "uuid": "652e6027-7003-4f39-b71e-2ba05fb5effe", "value": "98304:QPdkaif0xNcX9S3d7lw7PkPGU7wv6HN6pSB19jY4E:QofGNoS3dRYPOn7wVhx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050427, "uuid": "82fe0790-a3f5-4010-8cf5-90d8a84c99cd", "value": 13677056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050427, "uuid": "1983b223-ef8b-45b8-8815-0dc7dac1eace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050427, "uuid": "737d3c07-5177-40b4-83c2-2becda4bee11", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1938788-246d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1774018870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018870, "uuid": "fd7c88c8-5f45-4840-a1e6-fdac5e0f4856", "comment": "Malware payload (Vidar)", "value": "56589e5d713295415379b4622c1e74e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018870, "uuid": "40a7e17f-d004-41d1-beed-7a0fa668b55e", "comment": "Malware payload (Vidar)", "value": "cd24da0069d1d15c28538a0e9cb9610d0a47d6e7b36f00ac380ddfd0362afb93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018870, "uuid": "567eb591-6634-4737-83b1-2b14903d222a", "comment": "Malware payload (Vidar)", "value": "bab94357d255c22ec55e60dc55745d58b4d7ef12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774018870, "uuid": "fd23f3d9-cef9-4c8e-9a67-0501f0672869", "comment": "Malware payload (Vidar)", "value": "8f90aee79cf3b907ff87cdd0be18f70df41da88665aee285fc9fcff471e1babdef505eb2d6b9be2a02422492036c70df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018870, "uuid": "b06a24a5-6465-410b-919e-403644584585", "value": "T1DAA57C1BACE004B7C46A933689B652A27B34B8180B3233D72F51AB783FB67D05D79715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018870, "uuid": "8a2da2d6-8005-4e7d-a96b-0c778af85d4d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018870, "uuid": "8a53207c-4f31-4976-ac69-17ad37a2c59e", "value": "24576:EO1autQrAgEyVYYOcnSpbODGJHrWMQd7f/myJPV9cD/EW3TqGiWPKhH/2q4:EWjtQrRYYOcnSpbOnvNJ99wsW3TlA94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774018870, "uuid": "3610f6d9-f1b9-4973-82da-3eda3396231a", "value": 2168968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774018870, "uuid": "dcdf6908-4617-4b61-9c7f-1ca4464ea8f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774018870, "uuid": "d5a2a431-98b7-42d0-9e36-53178f9df0ae", "value": "cd24da0069d1d15c28538a0e9cb9610d0a47d6e7b36f00ac380ddfd0362afb93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf3ba0d-2450-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774006271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006271, "uuid": "986fc05e-db50-4cfb-b2d2-0dc4d6d76044", "comment": "Malware payload (njrat)", "value": "99dc8c9fb675afcfd691b83e017151e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006271, "uuid": "16f0b189-7cda-4377-b624-01293298fcc6", "comment": "Malware payload (njrat)", "value": "ce196329dd2fcb8abcf065508b5e8421cf596779c76667d86cc46b4e59231418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006271, "uuid": "f5c5ac9b-78c9-4d47-a4ef-caa27c545809", "comment": "Malware payload (njrat)", "value": "6ef1f711eb577b51cb08e1973856c49a369ba1c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006271, "uuid": "1e080b5a-1f6e-449c-aed7-b6132e3522c6", "comment": "Malware payload (njrat)", "value": "685985195ee77030439117aa3741205d2440d6cae7b209a7371100e1d3863da2204df0478ad20800d9f868be73459902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006271, "uuid": "bb68c672-7e9d-455b-a762-47476024a883", "value": "T172E21B6DFBE64465D2BC0AB50571950113B8E103E523F77E4ECB24A62B2B7D84B88DF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006271, "uuid": "ba52a050-6df0-465d-bc0f-671d97c47266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006271, "uuid": "605181c9-2d12-4c02-a07a-7d29bd10c051", "value": "768:PzUDYZxTDezxp+Bqdaf8Z3vsxQmIDUu0ti0Lj:isaRh8QVkfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774006271, "uuid": "6101fa78-e774-46d1-bb1b-2b70b324ba33", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774006271, "uuid": "87e1e18e-8d4d-4252-9360-635bc61d4f56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006271, "uuid": "cfc3284b-87de-4024-a369-13ea3d2f9dda", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b5bfb7-24a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774042743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042743, "uuid": "61ce8ad3-c44f-460c-99c2-b6a3a2474897", "comment": "Malware payload", "value": "5a90d0dfdd32ed32126e069dce0949df", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042743, "uuid": "f9e80b24-0d93-48d1-844a-c9ad99fbd863", "comment": "Malware payload", "value": "cee0c7d3d39536d7a9dec054baad486b011477f2d4d5633e3f292f0721bb7ffd", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042743, "uuid": "ab2f0bc2-0292-48ca-8296-9b3d8cd69ce2", "comment": "Malware payload", "value": "a35353b16d721e5d710e282d5c9d4332c9bf5cef", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042743, "uuid": "01aed9c7-8c64-4e19-ac5a-3cd79dc31bd2", "comment": "Malware payload", "value": "71e4dfce11f8e8a9a803d9f76ca1ce8901907549d4da94611e9a98881c44383f268c8d208a71858a19cad43094d3bc2a", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042743, "uuid": "a40aa864-b4ac-41b6-8f53-1474d749c359", "value": "T1C6B310894F9D4C75CB1F2424851FAD0B8B9C56531B5ECAC07A8F6E423F22CA9B4E97D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042743, "uuid": "7abe1986-b44b-409a-b753-34bab5655620", "value": "1536:wOoPQE8RC/j000sTOY18OYyOYkyOYaFb79uY+zf4LMHBChjkzDh6lz+8ab:wOoPQr79uY+sYIkzDh6lzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042743, "uuid": "fa23b407-ed22-4f06-b99a-fa81077f7297", "value": 111961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042743, "uuid": "4ec21a59-21d1-455a-ac87-1e0524e3a9e1", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042743, "uuid": "d5006c5e-2acd-4747-a631-b89175426b56", "value": "Winter_Photos_Raw_315.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84978fa4-2467-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774016244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016244, "uuid": "f8d7ac3a-9dbc-4b3f-92a0-b8958fd7b741", "comment": "Malware payload", "value": "af78af5b2b650b341233cf9bf5258030", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016244, "uuid": "63ce65bf-9f1a-465d-9eb6-8b1c13698fd0", "comment": "Malware payload", "value": "ceff35d3a3fc3ac3ed48f7505e96e676c3c81665a15e2e7afbf7896eea76e62a", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016244, "uuid": "5ac0d12c-aa51-4653-8269-660ee42e2850", "comment": "Malware payload", "value": "7f8e4989dbb57d1a4b2ee7dbff488e74135a699d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016244, "uuid": "1bb6eee4-0c2a-4b56-b4e6-59650e49c6f1", "comment": "Malware payload", "value": "0a682b6644ca059880d059ab6d37e5a4f541e20e18d969b6bcd25edf424301627588ed5c3a5e457acaa6dc025d92a709", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016244, "uuid": "2f3931ee-de3d-4c22-b30a-acc7140512b9", "value": "T160E05C0075409269CF91954097906AB4C66BC2AC72251201335E4F0FF20CA2A84BD3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016244, "uuid": "984962f5-725c-4d6d-b4d6-ab128e54c0e4", "value": "6:jt2cVeDuwZH1j5tjo5lkrcsny1R3KbQO0c+EkjAu4VN2nK1McsdZXH5d55d55d5g:jZ0VVjSZsngkbQpc++POU+dZzddpU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774016244, "uuid": "07719652-c4bb-4558-85cf-9d70327b0056", "value": 437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774016244, "uuid": "0f9021fc-2bb3-42bf-a2e7-457fbbc90a9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016244, "uuid": "5d15d04e-00fa-49b7-8f3c-22897baa8810", "value": "ceff35d3a3fc3ac3ed48f7505e96e676c3c81665a15e2e7afbf7896eea76e62a.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0f8778-24b5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774049756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049756, "uuid": "8ad2060b-5c84-4840-9232-8e9ffdcc69ab", "comment": "Malware payload", "value": "175cf95f9f58d11e5765bf559b5e8eb6", "object_relation": "md5", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049756, "uuid": "6f74532a-19a9-4728-affb-9684d7aad4df", "comment": "Malware payload", "value": "cf1320b7b2f57c565d6248a760bbf34b0c69341b65a080938b12df88e061077c", "object_relation": "sha256", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049756, "uuid": "e2e61df1-31b8-421f-a275-bcbe8a9f3258", "comment": "Malware payload", "value": "7731449d95734ba81a96bcee286886e716f96c33", "object_relation": "sha1", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774049756, "uuid": "369ea9c7-9ed8-406c-8e02-d09f3dec31d7", "comment": "Malware payload", "value": "7324157a7694832e373fc5694d1084de1d03d53595e8c932464cdfe98e36e21b83a94f41b804261435f91d2d2c7ec701", "object_relation": "sha3-384", "Tag": [ { "name": "ADB", "colour": "#8CA410", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "Moobot", "colour": "#FCD400", "exportable": true, "hide_tag": false }, { "name": "multi-arch", "colour": "#9FC842", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049756, "uuid": "33fe595f-1077-4690-b659-28ff47659bf5", "value": "T1627163F8F9B49932314EDA2DB3680994998F5DBB38F83978D59B8D11290D848730DB73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049756, "uuid": "a3458d8b-36ce-4d0a-97a2-333116102ecb", "value": "48:z2AYAdIGKvlLHH3pB0kKGARvjdDtt9i1lwiXl9ptTf0gmwI8chFcczFE4CEEyr12:6jvVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774049756, "uuid": "dc186e99-2c00-4e18-9a19-34a550557930", "value": 3714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774049756, "uuid": "54b80b3a-4279-4093-b0ee-1f963a38ddad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774049756, "uuid": "f0ebc92b-f842-44a7-84bb-dc984a91577d", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf0e963-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978168, "uuid": "3bae1524-d7fc-4dc1-8ea5-9ef0b0886fa8", "comment": "Malware payload (SharpHound)", "value": "761265b7d491778c5c7eddb7adefe0a4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978168, "uuid": "c5f64eb7-f721-4758-aa4b-898431833b97", "comment": "Malware payload (SharpHound)", "value": "cf7de6319fb31008d79e708a8c588e9856375e4a2df8161c5da876130707c935", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978168, "uuid": "204caa58-070d-4c69-aee8-b78faecba9ef", "comment": "Malware payload (SharpHound)", "value": "629448f7bcd3e50c401ffc7f756923f9a2b24e6f", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978168, "uuid": "7ef6d306-cffe-4abe-8f03-bf1a87bd8db9", "comment": "Malware payload (SharpHound)", "value": "d09f79c37e2e31750548a8d122f50acd69c029cfae388f8bf95b99c73036d377a418e965ccb7cda64316ff382d4c72b6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978168, "uuid": "fb57506b-ba62-452c-8fa1-57220ab658d5", "value": "T16A55121953F88B91E69F2F79A02142698BBA7717F9AEEBCD9C4C74DD1482710E811333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978168, "uuid": "49af15cd-d513-4941-9d08-a2979c72ca6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978168, "uuid": "dbf7c35d-8dd5-4b12-a8f9-54657bb43b98", "value": "24576:pLIGEDwgrRvNuXoVIa09WmPstYX3AfmmusRkong/iN9WCz:2zRvNE9WmPDXw9u2FK4Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978168, "uuid": "9f103a31-f9e6-4e6e-af0a-eb42efb8dbfa", "value": 1307648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978168, "uuid": "ee7fa121-93f7-40a0-8f57-849944249b85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978168, "uuid": "f40396d0-571a-46ca-97f5-a90bb3410fe7", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81937dc0-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978014, "uuid": "3368c582-9aab-40e8-a806-ad135149e240", "comment": "Malware payload (SharpHound)", "value": "e10d6f871f461a649600796b4095ee31", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978014, "uuid": "3a7fbfd5-2b4e-4b9d-9b12-cef9eff1e713", "comment": "Malware payload (SharpHound)", "value": "cff9322d6430da88d21515909ec485909b4cfdeacc1d5c549730f835aa27636e", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978014, "uuid": "951d6514-8fa1-435c-af26-bc201e15b3f2", "comment": "Malware payload (SharpHound)", "value": "20187bfdf7daaa4573eb12cd9399c1c6f81e15e7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978014, "uuid": "309967d4-0fbc-47b9-98cc-930de0b475cc", "comment": "Malware payload (SharpHound)", "value": "7c4c93b2c79476cec2fc120a3f5f20d29ce4537bd61f1dae284f261fb74596a6fc380eb9dfef77b0545ee9511df83f4c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978014, "uuid": "8cd8b854-3ff8-48e9-a236-33a57968f3f5", "value": "T1437523625F1A5CAD8EFC8334143F9EAD97E21613E01AD49B7EDD80C52F7AE408A53478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978014, "uuid": "906b08a8-d473-4c54-a516-aa988b13cdf5", "value": "24576:nDHmsr0Q8LSDopMqmnTph1q7CWUV/3BZy/RCmAATJPeQKxFVDNAOCiNLeGxVQ31D:Dr0Q6SDopQmCzK0xxAuCPuicY4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978014, "uuid": "d48edc18-bdf8-4eff-a05f-57e5b5ad0047", "value": 1627325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978014, "uuid": "9c057fa4-fdc4-4713-ab61-3e8ff96911ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978014, "uuid": "500db66a-ca8c-40b3-9505-5541f508dc8a", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3f411c-2478-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774023616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023616, "uuid": "6a9b060c-34e3-4b14-a0a5-a2d7b1d914bc", "comment": "Malware payload (ValleyRAT)", "value": "c71c636647df391359b5f7486e93ac46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023616, "uuid": "86925c69-32ea-45fe-8709-47965989b86b", "comment": "Malware payload (ValleyRAT)", "value": "d02ca30fbc880b849ef53cfb14fd5c8c2afc246ee9350fc7ab1793d5588d11b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023616, "uuid": "696692a5-ccdb-47cc-b2d1-ca3cf62a0059", "comment": "Malware payload (ValleyRAT)", "value": "cbacbf5dd125c27576deef132158a571b131631c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023616, "uuid": "0e28e961-3f99-49d4-a581-592b8ab8d8c1", "comment": "Malware payload (ValleyRAT)", "value": "9c6f538f442a4ee317c6188cc7c7fb149f41252b5dab2a132e31a055dd387ec33947bfc384a75ac0fa2569479beab430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023616, "uuid": "a33dc9a6-2b3b-4768-9e27-11d865c8f6b4", "value": "T199B633A13FA9A530E07653F1E6F01221636D7E407A9CD6067FC0F89B0D66E41C979F2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023616, "uuid": "bb4ac8df-94a7-4d44-8149-e37ca5fff76b", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023616, "uuid": "577d6796-c75b-4c5f-a2de-9077939b95a7", "value": "196608:wb3w07pd6SzOAGC4bb8kZZFzfmBx9ULUrJiKSKhRBjbt/:wb3wkhz7DYlZFz49ULscJKhRZt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774023616, "uuid": "ba3370de-bc01-4275-861b-8079dc5e34d6", "value": 10509947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774023616, "uuid": "8108bf11-ec2d-4e68-9c83-a1538df22414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023616, "uuid": "3f4b9ae3-3514-4ab3-815c-8c69f99f4021", "value": "%e6%96%b0%e6%96%b048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871021ac-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978023, "uuid": "eab5d13a-d530-4e0f-b84e-d6037655210d", "comment": "Malware payload (SharpHound)", "value": "1f4bcd0a41a1acf8f7d9cbfa8e93bb62", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978023, "uuid": "ef7ab516-3c0d-449e-936c-35a7d8143362", "comment": "Malware payload (SharpHound)", "value": "d04a358c61d3d58a423460a64da95089a9f46e87ee2e34b990c802fbc4cf9c3b", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978023, "uuid": "5dfa2e90-dc2e-4b0f-8d38-8f6ad15e0b90", "comment": "Malware payload (SharpHound)", "value": "3a408e566d1ec3b1ca6e7924951bf9dffe900d58", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978023, "uuid": "9c022d2a-5bc1-4696-9fa8-2146aee3e226", "comment": "Malware payload (SharpHound)", "value": "d11e64dc381752638c97c45527a5f9325797caeed666f97083c338c7dc0b39c797015f82926195ab48f81fcf6fb47c99", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.1", "colour": "#DD8D23", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978023, "uuid": "b7d977a2-b645-497b-9e0b-86f512290c93", "value": "T10A55121953F88B95E2AF5F79A03042688BF76A0BF9ADEB8D5C4C74EC2492754D811333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978023, "uuid": "b031fe90-f819-45ab-9aae-5b902102fd7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978023, "uuid": "1d0bf9ce-f57a-46a5-ad43-81cc9fa4fb6a", "value": "24576:tYLIGEDwgrRvNuXoVIa09WmPstYX3eWKMFnLxXdjkong/iN9WCwS:RzRvNE9WmPDXuKXFK4WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978023, "uuid": "4c8afd5e-93ab-4a4f-8ac0-4c47ca84e03d", "value": 1316352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978023, "uuid": "0d75ff39-da4b-42d9-93df-03fb75b58831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978023, "uuid": "4b763b13-c82f-4661-9cd8-cadce1d90cdc", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9678232f-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989216, "uuid": "85ffe505-479c-4d6a-85dd-dc4d4527fc01", "comment": "Malware payload (SmartLoader)", "value": "2a5401c4221c3fc9a7ed9655319702cd", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989216, "uuid": "ba6416eb-ed8f-48d8-84b1-61767f5bfe2a", "comment": "Malware payload (SmartLoader)", "value": "d14856969df860a679ad1060c7d2a81dd60180d0f5fd22988a4c09de0a6de11b", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989216, "uuid": "05f0c48c-9c4f-4d80-8dcb-4b48c6e62009", "comment": "Malware payload (SmartLoader)", "value": "d4a9ebea3d5b8d4689e7d6d32b6dcb31cdc10417", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989216, "uuid": "d81f4c70-885e-4d70-91f6-10a7844e328a", "comment": "Malware payload (SmartLoader)", "value": "e89fcf23e4d570a434f77b4b80c16c94916f749e4a4dd18a27092dbd56a2792b18e54effcf7669bc824e9eb3d7a1a330", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989216, "uuid": "af2a64c2-ff80-4080-b5aa-cc7b6dec52ad", "value": "T1AEC4238BA3FD845390BF1F58AA5BB48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989216, "uuid": "314e6d63-59dc-4b4a-a317-055bbe2023ef", "value": "12288:b+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2byKH9I1P0QKw6FEI:b+QqldA/TSO713u7xnKH9IaQKHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989216, "uuid": "ae887c46-b8f0-49de-8450-375bd0cdbb30", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989216, "uuid": "b3f31980-354a-4419-ac44-39ba727b0ebe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989216, "uuid": "96cc95ee-3261-4cca-863a-197f7770e7d8", "value": "Software-v2.9-alpha.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1896dce-243a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773996966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996966, "uuid": "715481d4-54e0-42d0-bc53-91d82962aa0d", "comment": "Malware payload (RemcosRAT)", "value": "9c38de5f86eb5bdc2cc34cc37497c9e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996966, "uuid": "fca9b8e7-52a6-4fe6-a27e-ab33ebe75e5e", "comment": "Malware payload (RemcosRAT)", "value": "d165c4d72c0bff469d16f73e1840cb6edcdcfcb2785d136dbd8646db668c236a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996966, "uuid": "3b1372b7-fd7d-4d2f-90be-f47c026e56e3", "comment": "Malware payload (RemcosRAT)", "value": "5d1c5f1dda806593f2fce77c88fe8af131ffd8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996966, "uuid": "e6b12d3c-7fa3-4be4-978d-740cdc1e39f2", "comment": "Malware payload (RemcosRAT)", "value": "9a49899988421e436c3e4bae7db1180279188dcfda05ba7e24ae77a361fa1808a3c308d54ef21ae25b4fff3ef1a06551", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996966, "uuid": "c33da52b-3209-4a6d-b362-7217269ee1d7", "value": "T17C2523117700EEABD8694BF307A7E3A81B34EC2429121B077751774D3FB13E89A3A695", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996966, "uuid": "80eeb09a-3fcf-45e2-aa1d-50257ea5f40f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996966, "uuid": "e2fb3d57-9e15-4c6e-9750-3b2a70bb7650", "value": "24576:tDVpbxViz4mVRNrVgH1TCJsPufA2imDOWzNphmR5gv:tDVpbXY1TxVgHpbI3imDOkNphf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773996966, "uuid": "06884ab5-2f8b-4872-9abe-13bba3c4d70e", "value": 1008224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773996966, "uuid": "6e5f7032-5d41-4c60-80b5-f923717612b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996966, "uuid": "c04b7f54-a74a-4c07-b1c3-c527a0ad10bf", "value": "9C38DE5F86EB5BDC2CC34CC37497C9E9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0da1ff-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041010, "uuid": "b9c91098-72db-4f4f-ac74-e44e863fe285", "comment": "Malware payload", "value": "592bf1c8a7280a521351854a02741896", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041010, "uuid": "14d6f824-3106-4d97-93e8-b3b2f12055a2", "comment": "Malware payload", "value": "d3e4361adea537b57415a2ee983ad864dae80ef2a6a702f93a1a441e1c5a0847", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041010, "uuid": "1b033e54-bfbb-47d0-bc35-04777b4c5c6f", "comment": "Malware payload", "value": "a7fd12483e4310d31c0887a67b1d22539a80bdb3", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041010, "uuid": "0aa09a60-816f-471b-b7be-2ae1ec323d91", "comment": "Malware payload", "value": "61e4d8c1b74f9f6e5f2f72aaffacb87190650b22113d004007ac9a6b94b0ec59d59f591a98634e14a745eb704d267f2b", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041010, "uuid": "244b2d1f-ce50-4797-8672-b75f603ed6d3", "value": "T1D706AE9ABD683940D659263E5FEE47C11B3DFF4B2F1287173904B7AE1AF221A49D1320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041010, "uuid": "48245574-8025-4c66-99a5-b14c4608aa10", "value": "98304:czoyVKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+zD:EG2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041010, "uuid": "9a815ea9-c1c5-4576-99b1-e05ec671df52", "value": 3844482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041010, "uuid": "d8c4653f-d1b8-42e2-9c9d-c0fadf254fd2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041010, "uuid": "2cad4cab-61f5-474a-bab1-7f9ee8788b5b", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f666fe0-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050569, "uuid": "67f9cd7d-4bc3-4c76-82dc-f77abbecd267", "comment": "Malware payload", "value": "d09fa477bca6954808cdeaafba3569c2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050569, "uuid": "cd49beab-fd54-4fc1-bd07-5e7ce36a0bb3", "comment": "Malware payload", "value": "d40afab6ce066b04d7ad3faeefc25569318a717b47b89079bce4c2cde4ef7379", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050569, "uuid": "6bee6f28-1a08-44d3-a682-aea69c3b3cba", "comment": "Malware payload", "value": "f7f4eb41bed26f0ab52382797d306b018a60988e", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050569, "uuid": "437fecea-bbc4-4ebf-aba0-624b3c8997ac", "comment": "Malware payload", "value": "cc69a5b3161e6ac26ed0911f53a3af1140619119b6998dd692f495ed176d3c8d07730555caaea1d6be6b9cd88cdce177", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050569, "uuid": "5acc1cd5-558a-457f-a1a6-380d70293998", "value": "T1DFD64B13EC6555E8C1ADD6318A669223BB717C498B3033D76F60F7282F76BD06AB9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050569, "uuid": "07f12e5c-58fe-47db-aca6-170bf0bd5853", "value": "98304:kNaAlDHSma4yErdmWmDIAJzNRUSLlXvs2WnNrpTzrmYKZEx:kEEanErQWmDIYZRPXvjWn9cn6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050569, "uuid": "db3609d4-92b9-47c6-a71e-7b31e872b235", "value": 13144356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050569, "uuid": "bf2c62a3-02a7-4fe0-aad3-f9245ff39d5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050569, "uuid": "f527d766-2b8a-4ac4-9023-f993e1faa5e3", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26482e6a-240b-11f1-a769-42010a9c0008", "comment": "Malware payload (FatalRAT)", "timestamp": 1773976573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976573, "uuid": "05fc632b-ff91-4d98-994d-df9b5ddd1db0", "comment": "Malware payload (FatalRAT)", "value": "1024810f4352b3dc145f509ca427b980", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976573, "uuid": "d87e1fcd-e2e9-4d44-8b65-7715a20cfc2d", "comment": "Malware payload (FatalRAT)", "value": "d477cac8cead223e8670770c6c0da5a441d7497d362db56c845a4f97c2905a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976573, "uuid": "823c3d39-6158-47c0-9597-9d9eeb463e79", "comment": "Malware payload (FatalRAT)", "value": "7cd5ca0c4de36afa896b42b77d276d171d455f35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976573, "uuid": "621a4725-b459-4f4b-b8ea-4ad130dc92be", "comment": "Malware payload (FatalRAT)", "value": "8afb6cfbd059c15fab7594169cbbf006bcf8e18bd1753bf923ce92fb13984370ae5e5de2fa4f4c2fbf2314ec14e1e866", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FatalRAT", "colour": "#A297E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976573, "uuid": "a60564ff-bf74-4327-9382-06324883df45", "value": "T1E714192CE943C06BF4D240F5C3E287F96A7C5E37339120EFD7A4655A13690E929718BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976573, "uuid": "4035a1b6-0c1e-4016-9d72-ef4e1a175980", "value": "5e5e0516b9cb49f396b0ce208c8bee82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976573, "uuid": "3affcd3e-121f-4783-a65b-1976cb2a4555", "value": "1536:pLNBhXd4ikzIJiUFK0IP49lEE2uwPERQNBldJQqOet75u:ppBtd4iKuiUF5IP4XlWJPQq1tc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976573, "uuid": "ecbcd535-6231-4ec4-a8fc-a4c49e3305cf", "value": 192568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976573, "uuid": "9dc39381-6892-45f0-84dc-fe78719c0b35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976573, "uuid": "1e7e59a2-0184-4cdb-b966-3c6dc322f831", "value": "1024810f4352b3dc145f509ca427b980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d11200-2479-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1774023954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023954, "uuid": "791c8846-39da-49f4-900c-6be0a48fa3d0", "comment": "Malware payload (ValleyRAT)", "value": "7e91f75792ec49769123493be62ee1bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023954, "uuid": "3523cc7b-bc0c-4364-9195-f674c6a0fa93", "comment": "Malware payload (ValleyRAT)", "value": "d4c7157d593e6ac6c4afc9a466f731d577caee271a29ca8ef0bc9acd12322c4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023954, "uuid": "46b83768-7e75-4018-afc5-14ede9b2f9c8", "comment": "Malware payload (ValleyRAT)", "value": "b1bfdc55706363c4ec4359bd8ff5a1c564cacb74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774023954, "uuid": "abf6a874-a8c8-409b-8f83-352262bbbeb5", "comment": "Malware payload (ValleyRAT)", "value": "a711f571768896d6e03b40f888fac08021c01bd6b9a3231efd66eaf1be636d5cbb95c92950c3f65014f156fbd7232131", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023954, "uuid": "dec97adf-5475-4f57-8b6a-ebf1f2b48a77", "value": "T1A1258D701509A2B1EC9E08F7397D7D60A4EC1D7DEA8BDA26A843373C97775D9E0B2012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023954, "uuid": "dc57b1ef-5e28-4b67-8dfe-4f8105f2b962", "value": "f124e3c852beed59010d10499df2e236", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023954, "uuid": "6d5b6111-7333-4863-a95e-caa3dd24727c", "value": "24576:Ep3gUG9WIKDySUNK2KF6lYnQX43b48oVu:Epw/wIcyxZyQK48oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774023954, "uuid": "f64359b4-0c22-4169-8e44-b6ae728bc4ca", "value": 1050624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774023954, "uuid": "900305ea-daa2-4584-9447-c97567f9743b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774023954, "uuid": "162741e1-5827-4aa4-9ed6-7776ad3411d0", "value": "\u82f9\u679c\u4e0b\u8bbe\u5907\u8d85\u94fe\u63a5\u6263\u6b3e\u6539\u5730\u5740\u8865\u5355\u79d2\u6263\u9644\u6700\u9ad8\u6536\u8d27\u4ef7\u683c\u51fa\u5feb\u9012\u5355\u53f7\u7ed3\u8d26(2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36e7391-2486-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1774029691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774029691, "uuid": "4a0389a8-007e-4fd0-807e-38d43834915e", "comment": "Malware payload (RedLineStealer)", "value": "7a424a1093f34208dcdcd7d403e1025f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774029691, "uuid": "61d57e2e-c649-4d50-9e2a-75e0113a8acd", "comment": "Malware payload (RedLineStealer)", "value": "d51ea87c715039f7c8902c8698520ff59afc13a4c7ff5ccfa15085d0f1bcdd24", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774029691, "uuid": "6f5af662-6c80-4493-a1fa-9f5b86fc11df", "comment": "Malware payload (RedLineStealer)", "value": "81a1b0e97e1ea6e4c5c2aeb58e524d4ad9c05f5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774029691, "uuid": "022d200a-df77-44e0-bcd8-739c3c67f89a", "comment": "Malware payload (RedLineStealer)", "value": "7f550658e399b6e869d0be1ae2d6ba0db1ad142aefe7e8c676bd5213566de6a24e266c664ffbd0b3323178fc7398f8eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774029691, "uuid": "31e28bc9-0d87-4af9-80f0-4456f4c17dd2", "value": "T1C1757DCD468FBA757F88C70C80E8579067D065BF6AAA3690DB06DD75BCFB34812412AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774029691, "uuid": "8432df78-e20e-4d32-a592-13deb4b50986", "value": "49152:kpi+zbvAA75hmkz5207D1YAE6APpEaGhm0B5zk4/uPDCH8TT9O9NPrLXOq80B6gd:S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774029691, "uuid": "7016955d-7648-4e6f-beef-ab7c872d8b8b", "value": 1678995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774029691, "uuid": "8ed26982-df9d-446e-a119-87691284ea37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774029691, "uuid": "30cc859e-ac77-46b2-988b-947b32b3688a", "value": "Payment Copy US$.24,48015.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eaa47ee-2430-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773992585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992585, "uuid": "405b7718-3b43-40d0-a551-e35a270f4e89", "comment": "Malware payload", "value": "2bf9ff8b9bc1a03b6597805a26249e80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992585, "uuid": "4b050461-ee24-4252-94de-fd539267ff31", "comment": "Malware payload", "value": "d58724360b47456e9f5162b1ff011a2ae8b797be15a37ed80d01d96fb7faac5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992585, "uuid": "4fc51fe4-5e6e-48b3-b378-4959b6912ad1", "comment": "Malware payload", "value": "c4642446cfb1afa9ca3139088e202f4e46ecda71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773992585, "uuid": "d013c972-4354-4e49-a8ce-00591dc0d887", "comment": "Malware payload", "value": "fb5a7684dd0869fcba93bd57da899d6ab7f4d33820cb0a5d282640662adc33df38957864288c5ba7839bef9bc2bea124", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992585, "uuid": "b5ae7e58-340a-4e81-bd4c-f61a62b791d4", "value": "T1298533B559A1930BEDBBB92E8CDC008F51E522B3780AFD1E17A71AD47C1A18707FE095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992585, "uuid": "615f36e5-bea7-4dfb-8e9b-ddccbdf7f006", "value": "49152:OdNxWqMBh8lErt5z5Mdtl2BJF9d8XbGAYAJS:kNIqMBuc5zkkzrAbJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773992585, "uuid": "0d1e7b10-3c1b-44e4-9dbf-3207ca2b1347", "value": 1708880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773992585, "uuid": "380cca6b-efdb-409a-b25c-a6492fba4673", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773992585, "uuid": "c464c003-9730-404f-994d-5d2917c8625c", "value": "linux_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66759dc8-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050554, "uuid": "90c58f53-8b05-4b17-9c9a-5004990c1fbd", "comment": "Malware payload", "value": "8ea298384252ceef82432f9d7b43bda7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050554, "uuid": "b978dd4e-ea27-4514-b375-1e9b2dc38f1d", "comment": "Malware payload", "value": "d58ef410f18b146fe4e2827e6e347dc97bf5dd84cb8cfa9a578e10d9473a94ac", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050554, "uuid": "e9c1e6e7-07af-477b-b112-231f328d309b", "comment": "Malware payload", "value": "d4fcf602b3584a680b4da399ee5024654b553326", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050554, "uuid": "fac122e9-9ad9-49a9-aa3e-a220d58677a1", "comment": "Malware payload", "value": "cba511450d64bcefcb5097bd2fc9f9b81d52eb44c784e5e1270936c82450b252ed070e4f53258a73484d052aa3445a35", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.2", "colour": "#484544", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050554, "uuid": "415217fc-9dd4-4e85-a014-f99d6dbd3c07", "value": "T1A9D63A03E85565E9C0AED13486669223BB717C495B3037E72F60F7282F77BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050554, "uuid": "26bcb12d-b4b9-4a35-8c05-b68165b16913", "value": "98304:/LvCcNowCicIB1xzOf73+ozYuRN/SUY8I4d0wCsV05rbCkErveIE7mD:/fCicK1xz2+YYQ/SZ8U/cdrWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050554, "uuid": "72e1fb5f-b1da-49f1-89c9-fbcf10b0246a", "value": 13436864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050554, "uuid": "09837bb0-d763-49f3-a1cd-6ae958ca70bc", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050554, "uuid": "c6b90d33-59c6-4345-8ff0-dadabf5e2363", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a008ecc7-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978065, "uuid": "6c81feae-d0bc-4ce1-afc0-b7afa27a157b", "comment": "Malware payload (SharpHound)", "value": "735693ac5d186220584ea5dd8d823f22", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978065, "uuid": "38bc6ef2-1f73-4615-ab4e-3042771e3e56", "comment": "Malware payload (SharpHound)", "value": "d81c3aa4c73a2287ee1fd26d24333504e13939bef8fc7c5a34223ed34d0d4553", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978065, "uuid": "07cedb88-7c99-4072-87b0-592c9b6c9c51", "comment": "Malware payload (SharpHound)", "value": "84c1d079a493c4c3e31cb556c2c3ee165ce9e21c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978065, "uuid": "9e05ec2b-4f42-4632-a8e2-dd47b8a6e36c", "comment": "Malware payload (SharpHound)", "value": "7a1697eb57509905023535d66e396c2325aa5920e839bdf1d311a2d7b5fbfd0c1761e9e09b5f016984d86efa1caf5727", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.8.0", "colour": "#0A3559", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978065, "uuid": "0f28639d-b969-418c-8819-520a2ecf088d", "value": "T152753300EC274D3D487D5138645EAA1CC7B046F7C07DA3AA77DFA6D2676BB8048235EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978065, "uuid": "cf21071c-12a2-4bf7-b2bc-654f0d43f548", "value": "24576:5tfvDphoV4gTO0qKxAurwXwxgFDqhFKK2xFxPLf5kqaOo4/BtNyOqSkfKgT8SpKr:bpk4TKxkfzvvmoSpRxFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978065, "uuid": "24f1fa17-bbcb-4e4d-a142-0ae9afbf4678", "value": 1615053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978065, "uuid": "480553a3-c440-445d-bf8d-658c3cc61663", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978065, "uuid": "883a75ac-4b03-451e-84bf-a57b13f98ef9", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8d1024-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989228, "uuid": "1ac835be-a5cb-462f-a2b2-efac14a520ed", "comment": "Malware payload (SmartLoader)", "value": "e0c56b26298cabe9d766e2e0123c9eae", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989228, "uuid": "d32e8ef3-06b4-44c4-9de2-27c35a634e44", "comment": "Malware payload (SmartLoader)", "value": "d846882fa1b0de2fcceb143c24fc98a4920376df4b28449798da63037ee9e4da", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989228, "uuid": "17dd4af2-01d8-4e48-9e60-914594793dad", "comment": "Malware payload (SmartLoader)", "value": "455e14d5b83892c551fd13fb97c0eedac9dfd1d0", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989228, "uuid": "a219b046-85fc-47fb-8ad1-37435e1bc5e5", "comment": "Malware payload (SmartLoader)", "value": "dde7f64e69c6145fb035e04284f64aad0214af6de72eacf40420c66b4a9056fb7c006ba0bd73d23f9a25d632ee797a50", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989228, "uuid": "f7e39082-b786-4a7d-be94-68df66f3079e", "value": "T147C4238BA3FE845390BF1F58AA57B48D091976F34732DC93146A3213D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989228, "uuid": "56c36238-a2cc-4387-8510-8d927f68069b", "value": "12288:7+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2by7H9I1P0QKw6FED:7+QqldA/TSO713u7xn7H9IaQKH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989228, "uuid": "91f90a1b-bec4-4b1a-b0cd-0b85fdad811f", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989228, "uuid": "b4025c12-ee9e-4722-bcf7-103f033bbca4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989228, "uuid": "2cb95015-187e-46bf-809c-a18738943b50", "value": "Web-Test-v3.8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3a7fa4-24a5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774043074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774043074, "uuid": "e7af9fe3-8210-4759-b179-6b00c7fe8518", "comment": "Malware payload", "value": "45e507358ceb27babdd24081bed7bae8", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774043074, "uuid": "ec4283a2-439c-475c-a050-3cb26ee53d60", "comment": "Malware payload", "value": "d8bef505cda8bb5d208bd6b616084e201898e7878844240b41051090733a3b9c", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774043074, "uuid": "e511c40c-d2d1-446b-a3d3-92f4125c2811", "comment": "Malware payload", "value": "682ca1a6b6281d2d088f27dfd0eff54d80b8a377", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774043074, "uuid": "1068e842-98e4-41b3-8c69-e6f3fc4af5ba", "comment": "Malware payload", "value": "6b6ad5e574d8d89cfc2c9fe864b1dd3bfe3f16ebc0c28d57ef651e464d22fa1be4a635328b9a64665e8942c681b6df40", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774043074, "uuid": "c4b887d1-9bd1-46c7-b85f-c434e73df16f", "value": "T19BB3DDCF6A8E84DD859A641C815F6C0FDD972B134B1CCA9035EFBE463F32DA520A59E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774043074, "uuid": "490f3889-c87e-4563-baf8-415323f5c054", "value": "1536:17UBbdLT0gZHPydRLqfPfULhcjG4Jx2Cru/uc:17O6gZHPuqfP8Efu/uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774043074, "uuid": "572bbc96-b5bc-4671-bb13-89f453a51bd6", "value": 117127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774043074, "uuid": "135ce43e-a57a-461e-b0e3-9e80d95a8e5e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774043074, "uuid": "156dad28-dc96-4046-a868-8fa6987ba235", "value": "Photos_London__52.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409a59eb-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041041, "uuid": "0985f1c0-45a0-4e77-bd2d-21c09713fafe", "comment": "Malware payload", "value": "7b40f48b7eea36989a9770682126a2ba", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041041, "uuid": "631d61da-719d-4963-9dd7-48179b261b8a", "comment": "Malware payload", "value": "d8f661c90cdccc6be62a53a22b82bd5cde2624f613595aa8b679c62a44f8c847", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041041, "uuid": "567eac4e-745f-4cad-a110-6875c7d84407", "comment": "Malware payload", "value": "6e78df2261003604e1b1522724720763fdf70454", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041041, "uuid": "623cecf9-024d-4463-a8b0-02a88d1fc0cb", "comment": "Malware payload", "value": "5e38f8c8d3048162ca8b43d80a0d5c1b22fbe031eb259f74b296647757d47382e186ec4f351c5b85879fb43c16070479", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041041, "uuid": "52211145-6116-4b3b-824f-7918e1b813f4", "value": "T114069D4B7C922A05C5D4263BACEE45C4376DAFBB3B9252063D05FA7936BF09E08B5314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041041, "uuid": "4e4ba664-63b3-47ee-8685-ad69d1b892be", "value": "24576:AC+Yf62KBYbmiOlxy1xejYCWle6FFgod5zH9p1huOnneSwUcgn1WvxRQZbQbRT4B:m2SujDPk6EQ+hghWIl8YNXpmxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041041, "uuid": "d80510b1-32db-4252-a7ca-79b1708d52e3", "value": 3856497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041041, "uuid": "bf285ae6-459a-4609-a11a-b3d22dfc44e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041041, "uuid": "fa1cb77e-8724-4f42-8cc9-c78c50b75c87", "value": "linpeas_linux_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3795d84-2414-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773980729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773980729, "uuid": "ecede7f6-d8c4-41bc-b1b5-e052fb4dbaa0", "comment": "Malware payload", "value": "94941daac5900296d32a9b5a3eda6c4e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773980729, "uuid": "82457dde-373d-4f2e-8471-adecfc8d16e3", "comment": "Malware payload", "value": "d9a0a0748cec6d9acaaba5178484b6ecc196afd1c1b22567525e22147ae85d47", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773980729, "uuid": "1310ef4b-8871-4415-9e09-f8311a47524f", "comment": "Malware payload", "value": "e2604dafb38c751ddbaad2cba38945dab885fe08", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773980729, "uuid": "59c1ad41-3e07-49ff-9e17-529251dcc3ee", "comment": "Malware payload", "value": "d6eca36650015c9f27fd4d6257589dd33970b1901e1683975ce35e4df1b8deda49562d91ac1d0b79daf4995e513a227c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773980729, "uuid": "f96a4a55-b381-451c-93d4-88f1ace8867b", "value": "T126925DB512896C79FBD1CE39AF3C6F4CADE8C2C42124A3ACBA4F39215A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773980729, "uuid": "c5f7dbfb-d07e-40c0-b61f-c33edc757012", "value": "384:bFcuQpWx+BL0SWL0grzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:bF8i+BL0SI08zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773980729, "uuid": "86bfe025-6d60-4ed9-be6a-cbc10c936e47", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773980729, "uuid": "732a02c8-bddb-4467-91e8-d8ab826c7bb9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773980729, "uuid": "cdfec18a-b607-4ad0-864b-b293fb39ce3f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc08c8f0-247c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774025464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025464, "uuid": "b28ec3cc-05e6-4bf4-876b-edd961d5d8bb", "comment": "Malware payload", "value": "92459c1925a7314711001c67ce79754e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025464, "uuid": "40447fcd-6a31-4194-b5d6-048389ec586e", "comment": "Malware payload", "value": "da358ee183526c39b4f3d2172b7f21819d815f516c44a6c5c5a398ffe398f5da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025464, "uuid": "9d80a2a3-2444-425c-ae96-8edb634cbf82", "comment": "Malware payload", "value": "c6c0ef422cc3e2d650c258f4b5d3d652dd8aa008", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774025464, "uuid": "1f777c86-9fd8-4b5f-ae25-81ddf4335897", "comment": "Malware payload", "value": "f388c6b7d61898bd5b0e3ad61adac75498018d264c9b356da96729167dca7f43217bd886dfed16a31f03313b973b601e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025464, "uuid": "d67ce081-6f59-4813-a4af-c281fa4755a7", "value": "T17A230A0637CB0B55C42D217500EB352043F1A7861673EBDFBE98638D1E563B2AE93B89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025464, "uuid": "8e104243-2738-4f0d-ac2a-9db564b0016e", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025464, "uuid": "4acc74f7-8069-4d4b-aaad-e7bf86227a13", "value": "768:26BnITyYGQtOXAd/r3VRq324iDlzXXfaAVq++Q22Gkv:FAdrVYQzXXCOgOv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774025464, "uuid": "643697d6-7576-4132-846b-039577724a91", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774025464, "uuid": "d6df8b52-60f9-4d0a-92d0-a5d0ef89eb5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774025464, "uuid": "da1fb800-7034-4c1d-828a-b8bec76a5da6", "value": "payload.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fe222f-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050360, "uuid": "6562c608-d623-49ec-bc64-ff813cd366fe", "comment": "Malware payload", "value": "b2c54f3b93b07c3dcc6827d355c3ff63", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050360, "uuid": "aada1576-a653-41dc-8bf8-5ef89197adb9", "comment": "Malware payload", "value": "da9bdac1637631b7e63a87832a6a0d56f81774fa6bdba58cc47482c4a70096a7", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050360, "uuid": "19cb298b-605c-4a9e-b25d-ae08e73dbc90", "comment": "Malware payload", "value": "29cdd0e6173743d6fbc735f2ac32843366ac32eb", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050360, "uuid": "07011cd3-d7ad-4a14-8e4e-273e5f2a8102", "comment": "Malware payload", "value": "1d042ddf34226ea295ba7ad49b624990c62db2035cec2df7593e2a80cbbd48b44d7b407023bad0013e73d1c6ff8060e6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050360, "uuid": "7a90d71d-0fe2-4d5d-998e-17117521e424", "value": "T193D63A03EC6541E8C1AED634CA629262BB717C495B3037D76F60F7242F76BD06ABA740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050360, "uuid": "255360b4-04d7-4a9a-8b8b-632c66da8214", "value": "98304:tihI6n+IklgABwhlgc2QSwGJs5Ds/x8AGHsi5f60SXpcqr13+Z7rE3:tvBPwhyc2twGJsy/xTGMiZbWRuZ743", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050360, "uuid": "36f1ffab-1a25-4151-a010-730b03799bed", "value": 13181220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050360, "uuid": "74f8cb3a-9052-4676-ba65-07a8521c8036", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050360, "uuid": "919cff11-dd67-4663-a584-6b7a65f6490c", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd62913-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050435, "uuid": "8e60d07e-d2b4-4ac0-9dff-dae1dc81fd52", "comment": "Malware payload", "value": "e08b82a572b70580f6bea6b2cd14d39e", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050435, "uuid": "35415bf0-854c-44d8-94b7-1f8088569b88", "comment": "Malware payload", "value": "daa132e019c8f48c9228633520c9d5d16814437f7811fa6e3b391d1993820214", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050435, "uuid": "718d2ccd-3efb-40ba-8de1-30b030f4049a", "comment": "Malware payload", "value": "7c8d4024a3915adfca7a40ffd75b59c644746f49", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050435, "uuid": "151c0b21-52bb-442b-9f91-5895c8dd4ce5", "comment": "Malware payload", "value": "54ec858a44d415ff8c39a8fb4f6e4af313b8016b5455a19cdfc2a99776725446cf4ebd886c99991a63165a12b4697ede", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050435, "uuid": "72bcc6ec-29f7-4be3-ab13-826033d0883c", "value": "T166D67C55BC1E7562EAC979347F6643A43338BC459F81C32A2614BF7CAEF2348CB62161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050435, "uuid": "52a5092b-bf0d-41ee-9dfd-a274fd0d5f78", "value": "a1d5e373439f70f0fc1b42684381042b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050435, "uuid": "327e4c56-82f8-4884-b187-0bd82220f47c", "value": "98304:qB39+6pvz5O3L+g5fRAzxDS3YcHyU1xkF6XmPCA4bjftIwByPSgEq:qB9+6prULNW+Ycve4/bzPZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050435, "uuid": "2c80b4de-b98f-4888-a85c-d6f952f57eb7", "value": 12695040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050435, "uuid": "babb0ab0-bd30-4835-9aef-64eb6ae0d9a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050435, "uuid": "8fb9c1e9-a45b-4f77-8e2d-87abda30fd55", "value": "azurehound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaf2e67-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050677, "uuid": "fd6a4959-8b27-43ba-a258-603ed0ea2de2", "comment": "Malware payload", "value": "0fd0f9f37b601686bcbce984aab877fb", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050677, "uuid": "42abac9a-dedc-4a05-8492-8f6ae67944b1", "comment": "Malware payload", "value": "dacc98ae9182d9b0bab37c3c6b99fd27571e08ddb3fba1ef619aa5ae3d18ead8", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050677, "uuid": "85d9025f-3af6-4e5c-a6d1-e41be4884fa5", "comment": "Malware payload", "value": "45bd1dbf1dc4f92069c37ed8e60d240b2f2cfc9c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050677, "uuid": "2e696ef7-2d42-4f48-8217-ee032fdff49b", "comment": "Malware payload", "value": "4d628332a024ef53059cd6674dc86a4f792d841aa3f2e9e21554928e3dcc1c2bc26c22d8e2bbaec788ccb7fca864179f", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050677, "uuid": "873c7d9c-8f16-436f-b629-6e0f11071f04", "value": "T1F2D64B03E86555E8C1ADD2348666D223BB717C495B3023D72F60F7682F77BD4AABA700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050677, "uuid": "cccf5b02-cf3a-4113-abbe-a4523687d2ed", "value": "98304:n1EBL2Fgqh5mhEnYb6m6zKnKuUfdqjkqCVX7gKpWvr+S+REZ:nKEhohEnU6m6OKuUfukqC97t7RyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050677, "uuid": "9d47dca2-1019-42ea-9477-3c23a7d09004", "value": 13144356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050677, "uuid": "0fd2d868-acbb-4496-90db-7b66937a9fe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050677, "uuid": "583714fb-fd54-4b56-9f09-28c489b3c80e", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93508f77-242e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773991788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991788, "uuid": "e3b6c865-f49c-436e-9160-3f267c28e528", "comment": "Malware payload", "value": "ac31366e73452db51ad3ae296ac12add", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991788, "uuid": "c9c5ad95-77ae-4a06-9bf3-3093faf5dc3f", "comment": "Malware payload", "value": "dcf5df996a112e892bae324b5e3c0664ad4d4f9f473494bcaad1cac3adedb512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991788, "uuid": "2b3e775a-2d8c-4e02-b96f-efe475a3b79c", "comment": "Malware payload", "value": "a722e38c9037a5987879f466ed5a1072da09dedf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991788, "uuid": "adc41c43-713a-4864-8dc5-72abe23a8175", "comment": "Malware payload", "value": "970fc54ce518b40562f079927b27f96de8a43326200ddffdae2cf6aeea276d26f55d309b19246d8c3bdaaae052bac3d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991788, "uuid": "3488ec4b-dea6-4ac7-b8ca-b5411a84c055", "value": "T1119533A6BD460DB0F44D188F5D7DC94611F32592DAA0B3641EA3CFEAB0B8ADB8374147", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991788, "uuid": "d50d5865-8d59-4924-ac30-ec69ef287490", "value": "49152:GmroGOaGwi/EpVep0RDT0MF7uuwC0XGJiYr7r2YN:GmDhGwiA0MFVwJwiYrf2YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773991788, "uuid": "977c08a3-cabc-4b7e-bc58-72e104cdd563", "value": 1987020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773991788, "uuid": "d91750d3-c55c-4418-b287-92d079119ad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991788, "uuid": "38a9991e-5f5e-484b-882a-81a3ae808859", "value": "linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba8542a-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050509, "uuid": "ca42210e-1db0-4198-bf23-dcffcb6d7ef8", "comment": "Malware payload", "value": "7097f286f261a0e94472ae7f7a9cf368", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050509, "uuid": "1660c728-8dba-4f5c-af34-ecadfea254d1", "comment": "Malware payload", "value": "dd2a0080cf0261ca31cab89f760a6977b36adfa063008d709bd8affd46e96595", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050509, "uuid": "11c77d2f-d2fd-4e07-a702-729db8b1f85c", "comment": "Malware payload", "value": "945cb476b03d7e43e634bf1721aea6a1d3f3dfb3", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050509, "uuid": "b8e6a8f0-c101-4ec9-a0f6-962b632982d7", "comment": "Malware payload", "value": "9b1523364297d0f893d99400d59a2447c32e0f9910665ab596197867baa11e5fd2f7cd8c86891329f71c8b221d21c0d8", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050509, "uuid": "4aa86176-280a-4cdc-bd81-d7a8ef6aca6a", "value": "T1CDD66B85BC1D7462EAC979742B6213557338AC455F81C3276618FB7CAEF2398CF236A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050509, "uuid": "f9d52721-44b2-40a0-8543-60505b19eb02", "value": "98304:VMHLIyCGxfOJY9GGeUrO77nyKX/V6dmuGN7maxAiftt860kxukUhZI+iDAgEagts:VwLbCGtOJYoGeL7nr96dm5IuAZZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050509, "uuid": "79819b2a-e5bb-45ef-8fdc-4064cb7e7039", "value": 12758178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050509, "uuid": "2d60c7db-e39c-4de0-9e6c-af31ebed7dc8", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050509, "uuid": "eef1f9df-dc77-4490-9c41-d0fbe3622b46", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e6606d-2439-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773996542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996542, "uuid": "edeb8342-6ddd-440a-b172-88854e8f042c", "comment": "Malware payload", "value": "e61011689448590b37e508a375ffac7d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996542, "uuid": "02667cb0-6a66-4055-888f-21d81002b47d", "comment": "Malware payload", "value": "ddeb09d3f1aed6e8d69bdbc5e35e308c96b3504f9c4d8dde32b6834d14644aa6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996542, "uuid": "d31cc0ae-90a1-496a-a396-6d7e1a84069c", "comment": "Malware payload", "value": "4eddcdf792bed74a26bd3fdd4ff93c4f7387c4ec", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773996542, "uuid": "7fea9538-976a-4b10-b0ce-683a17d6ee11", "comment": "Malware payload", "value": "3231a9ed407946315496be485f3ee440ca9624fa03ddb6344966cbc7457d6ef0cefc6bcfc00e066589bbe71105ae591f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996542, "uuid": "6257a13c-d747-4e73-8d05-c89338491b41", "value": "T17E925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996542, "uuid": "9e7b1dc6-d859-4a66-889e-873bc27cc913", "value": "384:kFcuQpWx+BL0SWL0g9zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:kF8i+BL0SI0azsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773996542, "uuid": "b327f42c-858a-4c06-b308-969e397f9170", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773996542, "uuid": "47a2933c-6aa0-4026-818a-886cfc721518", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773996542, "uuid": "1f8f557c-94ec-4910-bd3d-6276e3f5e478", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec01012-2433-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773993847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993847, "uuid": "06ff4296-57e1-4bc2-b3a6-a5b1eda133b9", "comment": "Malware payload (Vidar)", "value": "bde8538b00c70ba5e16a511d1906e238", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993847, "uuid": "a3cf491e-a5ee-46fd-9399-d0d614ef160a", "comment": "Malware payload (Vidar)", "value": "de2c5592a885835cc52ce4ecf742d0dc0306d268bbe086dd89ceab8495490199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993847, "uuid": "115cb567-4be1-4c35-aa20-fbd2aaa1be6f", "comment": "Malware payload (Vidar)", "value": "c24130652baa4769a0bbc5bfbbfe6bb5775dd4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993847, "uuid": "3a658cf6-54a6-4c57-ba4b-b3342d57f7a4", "comment": "Malware payload (Vidar)", "value": "ea4a8be88ae96f4f50302f0f74a118201a5a321cc5c2f635f6f88fefe1de76c4b0b2e8897231b35419c7a5b2f118b238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993847, "uuid": "4a12e224-224f-4e38-ad96-72292310114e", "value": "T1E696F66B7FAD8168F369813EC1928E0195F376750F32C6F752B1036B4E069D16F3A6A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993847, "uuid": "0a52b210-c3c7-4e84-812a-8331b5742a9b", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993847, "uuid": "3c7b7248-3e01-4fde-8920-57e8e8cc927d", "value": "49152:vZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+91r9AUtqvHIb8mssz:vPOkz7MsDq/Ib8mssz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993847, "uuid": "1be851cb-a8b0-433b-bfcd-d8514402a602", "value": 8680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993847, "uuid": "d3faaec0-818e-4a8d-9b5d-ef3225a70813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993847, "uuid": "24c0aa92-f3a8-4b8c-ac9f-633230b940d1", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab52512f-2446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774002136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002136, "uuid": "342168dc-30fd-4fcc-9485-504df2f19d01", "comment": "Malware payload", "value": "4c1cec40cd9c6b0aaace151fd8f11403", "object_relation": "md5", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002136, "uuid": "e5708bd6-1101-4e46-9628-6aaa75571a6d", "comment": "Malware payload", "value": "deef2be7a02b2ac4f0735eab5888f8a61cc4e537c64f170f856930a53a1110be", "object_relation": "sha256", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002136, "uuid": "9a600484-8820-4c4e-90ac-9f6ac4518388", "comment": "Malware payload", "value": "f086728c19d6f06e9590654c021dafb9db7d986e", "object_relation": "sha1", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002136, "uuid": "8ffe0d4e-6016-4bfb-8cb1-2000d1b54627", "comment": "Malware payload", "value": "cd42d135405460ade9439d0c2239f3d63d3643ad56e794dfb13d4f39e56e90edbf5c7a0e7e2cf76c5bc5eb9aa3d47c63", "object_relation": "sha3-384", "Tag": [ { "name": "crypto-drainer", "colour": "#056FCD", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002136, "uuid": "342d1b27-cf7e-4520-b7fd-9ef2c11706e2", "value": "T1AA45F163ED2C0B66EC2B853AE0841D263EE566D5910BF43B35B84D5308F7ACDDF44A98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002136, "uuid": "1d4f614d-00f0-4df3-b724-d5ed72a71e6c", "value": "24576:MrynMTbDgaCuwjAo54OD2YYNKS2zyy/lCLiDbdWM2dLbKDVZfTYfDcyWw6qF:zSfgWho54OT8KSOyy/l5AboVRcDWi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002136, "uuid": "986719f0-dd51-49bd-8e22-1969f14618af", "value": 1202180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002136, "uuid": "8e3bd392-f425-4898-b8aa-e0ee8f696a65", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002136, "uuid": "d487c768-6dae-4a15-9112-55213c19b98d", "value": "4E-1.211.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383a2ede-2424-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773987340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987340, "uuid": "d245ac23-ef9b-434e-b290-0cc52ba9a300", "comment": "Malware payload (Mirai)", "value": "51ad4f33a18823a36d35161eefd47972", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987340, "uuid": "c16d4119-6368-4b2b-ac21-122398aef053", "comment": "Malware payload (Mirai)", "value": "df24eb51b2adf5156ac28a629e943a906cbb7efe9aebabfcdf2e749f7f305e2b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987340, "uuid": "2ca5ebd4-0acc-4a51-bbd9-7c79bfd8d7fa", "comment": "Malware payload (Mirai)", "value": "1a8e7995fbab9e9c44f78949d0d38090075d97b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773987340, "uuid": "b5b889c1-cce3-4105-bb2e-d18911573901", "comment": "Malware payload (Mirai)", "value": "29253a16c1c70da67d2f190cfaf053cb96e8bf229f40473d858a6388379639da562aaa4b08abcf363b1ca3d2481b3936", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987340, "uuid": "468a0ef5-ab03-400a-8be8-bf257c24ab08", "value": "T1F1262B97B8918683C0E4267ABCBDC1C433671EB99B9712676D00FE3D3ABE1990E35714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987340, "uuid": "425213cd-2daf-492b-b9b5-f8962232ba17", "value": "24576:tYtx4BzKTHpCJAloFEc2mtjXUGRyzzbOJY2Eb4en6ILqoEAmPQUVHMA4BD6SwvG8:SznhFCpmiqqm7mIoFAE9oammxB7U1F1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773987340, "uuid": "e8442a97-1d15-4080-ba5d-282313804981", "value": 4521984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773987340, "uuid": "4bbe49db-0b67-433b-991a-2c854a270da2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773987340, "uuid": "48a023f5-b203-452a-a07b-070d28df43e2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97fdad02-2445-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1774001674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001674, "uuid": "05156732-a878-42c3-9e34-a2bea15659f2", "comment": "Malware payload (ACRStealer)", "value": "e3e83a050decea5c3052d4777a5ad07c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001674, "uuid": "87a54a91-3ab9-4513-886f-1d632aa8dee7", "comment": "Malware payload (ACRStealer)", "value": "e03cfa8893b52e12f4f2f1aae7e18388ecc27122ce27ad37fe4082130dd92c4f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001674, "uuid": "93dbb45e-42db-456a-92cc-af6246604954", "comment": "Malware payload (ACRStealer)", "value": "863e976ddc947725814753c4b3e234ee6bfd3277", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001674, "uuid": "315c90db-9aa7-4124-97a9-b4606c43d76f", "comment": "Malware payload (ACRStealer)", "value": "783d0eb9283216106540f43e5620033a325d8c3a969b818d281d7e6b13b0ad0294806d0472c994fe1ec0646555267d2a", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001674, "uuid": "67b2f91c-c5ac-41ef-be00-01e7ad7e3757", "value": "T100363A36F8670EAAC3B462718DFF16466334E4051B63B3D71E12BA3879B21CB9935391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001674, "uuid": "572060c0-8666-416d-a5c3-418da11ffde7", "value": "e1cfd71a2ac1e1ab37b3be2f2e2b8496", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001674, "uuid": "d29d9877-4d0a-40ce-aeba-8617dc389458", "value": "49152:7yK9rM0uYFrr2SJZtD421j8UETkPvfX9aGNmg2Ykyg4gxCisAqc8ZZ69+:7yYRx7D426lkPvfX9aL4gxCisPc8Zs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001674, "uuid": "7751f734-befa-4069-b926-872096c42b13", "value": 5293532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001674, "uuid": "232f2448-9ef8-4c35-93a3-e7b0747df787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001674, "uuid": "20f95625-de67-4ea7-838c-1a5290389fca", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f2293b-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977963, "uuid": "d85475e7-37a1-4594-8d51-453338cac776", "comment": "Malware payload (SharpHound)", "value": "3b20e8868ceb427ff7cc8f3478178544", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977963, "uuid": "a311bc2a-b81b-442b-8f70-b7a3a7faad08", "comment": "Malware payload (SharpHound)", "value": "e047c5ebfc20ecdf90baa1d46854350e8454411d847068d38bbb617d5e145a20", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977963, "uuid": "c0e5cefe-fb61-4cf0-acd6-c3215f082339", "comment": "Malware payload (SharpHound)", "value": "4c03f1273569b306c0dc54ac71e2691041476da4", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977963, "uuid": "bcd48072-7347-43f1-a5ff-62f9c581c623", "comment": "Malware payload (SharpHound)", "value": "63084127d544223b60f87bf5d1d37ba3c523f60fa0fc7422b6e7d4aa70960cb8e4a33f810a2b972e94094836efd3929c", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977963, "uuid": "8c114741-0acf-4e2c-831a-4e01ee7c97cc", "value": "T1FE55122853F847A1F6BF0FB5D42281558BBB7A27ED1CEB8DAD4CB4E928823558450733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977963, "uuid": "5f06ac2c-6335-413d-97cc-baf81cf43e90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977963, "uuid": "afdb29ee-9363-4789-92a9-e2107d942699", "value": "24576:nyqgnLIGEDwgrRvNuXoVIa09WmPstYX3xvPkJcEfI/TmdBHkong/iN9WC:nyyzRvNE9WmPDXNXEeTmTHFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977963, "uuid": "1d363584-6333-45d3-8d0f-6b42a4d74be1", "value": 1339904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977963, "uuid": "c907a25b-6486-49d2-8d3e-5c1e406ea265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977963, "uuid": "ed4de8cc-4222-4a9c-b351-394d033895d5", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053fe485-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046955, "uuid": "1fcd900a-39a5-42e4-b5f6-5161442aee79", "comment": "Malware payload", "value": "a22d06252e9890188abc59065a2ecc8f", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046955, "uuid": "b5bc17df-be65-4b08-9c80-9f874872db68", "comment": "Malware payload", "value": "e07b93eb23ab8006024b9badcd46893b20708003780c0ed763685a884e2d58bb", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046955, "uuid": "9ebd8d61-58b5-4e99-b495-9df011df4ebd", "comment": "Malware payload", "value": "05be99c4ae2d79c600b82531d75108c87c4ee480", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046955, "uuid": "40016fe3-0dd0-461e-a6d9-8787b4a5f499", "comment": "Malware payload", "value": "735bd3e2aad8c1a4277c90ff2797c535daaa06b6de4e86e66b0b2190df3222865a6edb05406a8eabaf0627f10c921a6d", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.0", "colour": "#3EA525", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046955, "uuid": "2224fd93-ee1b-4d3d-b685-0001c4f44485", "value": "T171753334DE9A5D7A8A3D563930A77E3CCF600743D08457E232AE41953B6D2864137EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046955, "uuid": "ac58a2e9-680a-446f-90ad-2733bc5483f8", "value": "24576:GgVBov5r02nUKWgPyiVCjOz/RGdF7tFQ4bQU/uk50t8BY7S/uM7IZvoXXOizb3gq:rAXggxsPQUUbzw825k0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046955, "uuid": "1f0bfbcf-1588-4565-86c2-9c547896c153", "value": 1579325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046955, "uuid": "f61c5986-bbf7-42e7-9731-3a79ba097e6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046955, "uuid": "902a4b2c-9348-4afb-b546-9382399d33fc", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b287f48c-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046816, "uuid": "7d9948d0-c36b-4929-9d8f-efdc8dcda77f", "comment": "Malware payload", "value": "e3cd7e4a071aed12931b4b6b63f488f6", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046816, "uuid": "f0ea145a-910d-4c65-b853-dafb69862e48", "comment": "Malware payload", "value": "e0d45c85667d4276c6709daab50bd014c6a928a66a6725f7a6b0f593bdc8d8f3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046816, "uuid": "4f366a86-6382-40f6-9c40-99e44e9f5189", "comment": "Malware payload", "value": "2cbd0a8a8715ef5153912f43effb6cc6422c1d70", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046816, "uuid": "19cd8b5a-ab51-4804-8633-1ab614a8fefe", "comment": "Malware payload", "value": "2c584b658681f32d07f629691a4a4ee8f988503101b5e5f7e39a3f53cf287c5098f67e017272852bb8d18f989b93d9fa", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046816, "uuid": "92846a81-d495-4350-bed0-6d4c8e192e03", "value": "T1167533712FC31BAA0B748234D2BB4F184BA14657908CD5F7B7EE68821766FC4496B07E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046816, "uuid": "c7839997-3ffe-411f-ae04-cfce46ceef94", "value": "24576:RUZy9nTXeNIzjmpk7WySEpy5INgcjfzMFPOtwtAEKJvqMAo9SzyXYE6mQOE7ZVIr:RUga+3mpDxgXvvRqc5QPtO5Adf0buy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046816, "uuid": "88e18bc4-4f0e-4b1e-8265-5ff39e1d2a61", "value": 1591989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046816, "uuid": "75c75f7e-011c-44e1-8947-05d4261611cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046816, "uuid": "6bd44e86-a9d2-4de7-9088-fcf1b059e09c", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dbe971-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046759, "uuid": "e534b1f4-36f2-4ed0-a01b-8a2591406b5b", "comment": "Malware payload", "value": "df194fe61379960f294486e3a32a869d", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046759, "uuid": "87eb6c4c-5257-4c2f-a3e5-efda56fce17f", "comment": "Malware payload", "value": "e24aad5ce9053a030e83bdaff958f59c8dc730e459aca7d23b70ac0ac9dccde6", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046759, "uuid": "a97a654a-85e0-4e85-a913-728443aee0fa", "comment": "Malware payload", "value": "92ddb78426f2f7892ea703ba3522bf8e568f9c46", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046759, "uuid": "c2c6f89f-32e8-4b9e-ab8f-48050c7a18d2", "comment": "Malware payload", "value": "2ad2a5d4d9ebed0208279b2b5dee1cd6392d1197e8542f9880c91e6de892f51e0f189f040def6dd10532fe4e9dbe27c1", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.6", "colour": "#DFDD91", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046759, "uuid": "93b8ae6b-0256-4cd2-951e-60640b7ce2bd", "value": "T13955122963F88B95E6AF1F79A03042194BFB7717F9AED78E684C74ED1482304D852323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046759, "uuid": "0d74ec04-9c66-4ed9-8acb-b41faaa72c82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046759, "uuid": "e817477b-dcad-4042-8142-1c56ad4f3654", "value": "24576:gjLIGEDwgrRvNuXoVIa09WmPstYX3H9iCuHITYsIkong/iN9WC:gIzRvNE9WmPDXXYCTYsIFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046759, "uuid": "63529770-0259-4854-a6c9-ea31d2a8e940", "value": 1285120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046759, "uuid": "290b3362-40a3-4976-b6dc-e56139df265d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046759, "uuid": "81a6f2a1-44ef-4b09-8b84-98510849cf14", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837dd8e1-2433-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773993909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993909, "uuid": "2b29750c-0429-43c4-ac27-e71b1ea2012e", "comment": "Malware payload (Vidar)", "value": "04b3b4160e4c56d21789ebdfb41bb235", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993909, "uuid": "111fc39f-68d5-4dc4-b68d-47d6205a5be7", "comment": "Malware payload (Vidar)", "value": "e3edfc278bc13aa77ed2d171b4d58343ba97f217ff3a8c49a833b7f88aac459a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993909, "uuid": "928b67be-fdd9-4098-afe8-9088c2e7b4d8", "comment": "Malware payload (Vidar)", "value": "50cb663afd46f4256195b1edda7ae536fa4b3bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993909, "uuid": "ede150bb-8050-4bdd-acba-6ab9c32085f1", "comment": "Malware payload (Vidar)", "value": "f271f75d923a0f973e6951606d4cf011bdc12eb36219c244ecbb8988d0cc6f0fa943c9c30ccb1300b48e8a1336a8906f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993909, "uuid": "c414880a-c956-4a70-8846-8cc8c6a4cde3", "value": "T1A996077B62A08168D16A813EC396AF4094F3717B0B37C2F745AD0375EB069D35E7AE60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993909, "uuid": "aa1da9ad-fd0a-4c96-a121-f966c2a84377", "value": "c92ff17b9c0cc71aa2a22e9faeb5d1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993909, "uuid": "b11356df-f62c-467b-b741-60a966f4edcd", "value": "49152:BZZDZ3Rgj02W0et2ZHpGFnRAwfSSTO7dAKYYnqBeId+W0+9ar9A2Mh9SmIV1:BPOkz7Mb7Mh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993909, "uuid": "793d3489-0cfe-4998-8b34-6a9348ba3921", "value": 8786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993909, "uuid": "2c9041ec-c24b-4005-a8a7-bb385964e1b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993909, "uuid": "24f229ef-90f1-4b03-ad72-2d6091599990", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b1dd27-2444-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774001164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001164, "uuid": "e9b64925-b517-4842-8caa-98fbc3731aea", "comment": "Malware payload (Mirai)", "value": "f71d6c3f18c8642852e59c2faab902d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001164, "uuid": "c93c672f-4ab4-41e1-acd3-6a4e02a48bb5", "comment": "Malware payload (Mirai)", "value": "e3f2d119f6739f2a32f04d3e4b2f6a63f0e6394e227901b169a3dadb316a6bae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001164, "uuid": "71804911-ab8b-49a7-bded-4c91f114a5f7", "comment": "Malware payload (Mirai)", "value": "98ae53e00271affc719b5e58d3ca5991bf55cecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001164, "uuid": "df416aea-58e8-480b-a2d2-18dc8be5319b", "comment": "Malware payload (Mirai)", "value": "21c907c0fdd86c26dd4b2e3dd0daf4514cc4b9dc0dc1e01b0f7f7af89e6e43bd98c00d75d480cafcaf0f04f3b71acc13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001164, "uuid": "15d4913a-a95d-40e4-8c34-65059af4689d", "value": "T1C4B31A45F8914B27C6C122BBFB5E428D3B2A17A8D3EF7203D9215F25378A85B0D37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001164, "uuid": "f74b032a-e8a7-4b43-9412-b0ad88c5817e", "value": "3072:7dfWtsuHLbKW4sBRS4M0LOo0wcBcrNbA4:7d+tfrx7DS4MgOoFcoNbA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001164, "uuid": "2fd1857f-cec5-4193-aa59-bca98e05708d", "value": 109839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001164, "uuid": "2e5be735-db12-45d7-ba75-f51e81e62553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001164, "uuid": "4002876e-ce2f-4a93-81c1-a3a011c6ce67", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaa387b-2467-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774016235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016235, "uuid": "4bd1ca34-f5ca-48d8-bc8a-174ff6a9b01a", "comment": "Malware payload", "value": "c80b74137a69ce6f3e180bc93483e1e8", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016235, "uuid": "f6db8694-9fca-475e-a7d9-e8ba463589b5", "comment": "Malware payload", "value": "e4642f0e905567e6ebd4ce75c3adfa46503415d4c18ac4b5b59814c78b0d4c4b", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016235, "uuid": "b5d95c4d-5d28-41ea-9552-ccb0ee22db82", "comment": "Malware payload", "value": "064f6ee04b1f42b9bb2bfe38b3c9a4160fc500ea", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774016235, "uuid": "c970c4f1-add2-4215-bb3e-ee24cd42e71f", "comment": "Malware payload", "value": "e2e586f5c33e70742369ebd10093a6eb3b79ecc24e2344bc8864ea299be8835defd6b4ead9cb9b067ff73fc7b6ef49d0", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016235, "uuid": "773c9592-daf8-4393-9e19-ea96f7366325", "value": "T158E05500760092A9CFD2A850D790AAB4C677C6AC72291115236E4F0FB20CA2A44BD3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016235, "uuid": "e43bddf8-6b0d-4234-8fa2-6126f1ecff92", "value": "6:jt2clFsDuwZH1j0IQHjo5Vrcsny1R3KbQO0c+EkjAu4VN2nK1McsdZXH5d55d55Y:jZfsVVj0tsngkbQpc++POU+dZzddpU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774016235, "uuid": "4e3aeaa0-1106-4dc6-90b7-518f9a88090c", "value": 432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774016235, "uuid": "2c923889-3369-4386-81d4-cd2386852077", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774016235, "uuid": "9f285a67-5100-4ce8-8bbe-671fa070529a", "value": "e4642f0e905567e6ebd4ce75c3adfa46503415d4c18ac4b5b59814c78b0d4c4b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e72e1b6a-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046904, "uuid": "f33cc5c6-ae0e-4fc6-b9cc-4cd2391909d9", "comment": "Malware payload", "value": "59404ab74a58fb79fb0cd2e4daacb7cd", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046904, "uuid": "dd2c8f49-6d4e-43a7-a458-ed17438b0fb6", "comment": "Malware payload", "value": "e5a9580b4ae06a4d73ec4c89da327d963ea6acead4ffc0972fc52cca5a1fa9f6", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046904, "uuid": "3953e7de-221c-4879-95dd-b61f24241508", "comment": "Malware payload", "value": "444edff8f6945649c70b5e4304ef2dc4a1f09e08", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046904, "uuid": "e6cdc77c-407d-411e-ac6d-8960c561e59f", "comment": "Malware payload", "value": "178939ede3c0d62c686d179f59bc8386cbb6d41c47aa9adfba77e79e3262e430dc638be9cb6620b29539d315629b26c7", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046904, "uuid": "c4d1f4c4-a6b8-4732-9508-fef78d383ce1", "value": "T105753372AF1AAD634BF8D138005FBF1ACB478B42D00986F639DD90854F7AA52454BC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046904, "uuid": "473a67f5-b411-456f-88c6-322d5a994256", "value": "24576:hTHZvWtBjVR9ZbzCBpHWNIklIlIrUSKdCU5DX+xuufj6Y3eqNV2yASHSCILP6M/s:Z2tUSadyNoyASHiHTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046904, "uuid": "941f7fd6-9276-46a0-8ccc-b244243b37da", "value": 1579785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046904, "uuid": "fec66433-7857-4611-a66e-8319b9c04ac5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046904, "uuid": "b2930379-4266-4664-981e-b078e79a244a", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cbdd52-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978149, "uuid": "99e33158-0875-4b2c-b65f-7cacb55467bc", "comment": "Malware payload (SharpHound)", "value": "6e3cd43476731ed35df91921a8d22810", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978149, "uuid": "5ca3ac05-d922-4082-a48c-92884c94c641", "comment": "Malware payload (SharpHound)", "value": "e5d704fc9e5e5f4c4fb96755a66a904da1c8340a36ae3e0fe0b6659993b43461", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978149, "uuid": "3708ab4d-b6d2-435e-a351-5b4fedc7d1cb", "comment": "Malware payload (SharpHound)", "value": "99a75f5e6877194501a318c8d874239656b117d8", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978149, "uuid": "8f7d442c-34c3-49e3-a10c-96da127ddab5", "comment": "Malware payload (SharpHound)", "value": "2366ec5ec6e835cafd570cdbea13ed5b408bbc3160be974b970ec3ac4364992ff641485459f1cd5609c649d6c4d51133", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.0", "colour": "#3674C2", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978149, "uuid": "9c31146a-4694-4728-ac2d-56de7177d90e", "value": "T1C055120983F84BA2F2AF1BB8E0268195C7FA7727F96DEB4D9D4CF4D924853559900323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978149, "uuid": "b516b77a-fa13-4e03-b475-0ec0c16b07d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978149, "uuid": "aba25fc4-b11d-4972-bb27-a9341c16e2fc", "value": "24576:9bLIGEDwgrRvNuXoVIa09WmPstYX3AfmmusRkong/iN9WC:9QzRvNE9WmPDXw9u2FK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978149, "uuid": "b8fd52ff-ea7d-467e-a527-ce7b0e43f786", "value": 1327104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978149, "uuid": "b3c6f24a-4fd6-40a7-b5a7-132c41216aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978149, "uuid": "19034433-485c-466d-bf8e-ec4fd326f784", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b271a8f8-2473-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774021475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021475, "uuid": "9bccd89b-2a13-4007-949c-71436ad7065b", "comment": "Malware payload", "value": "52abdb06d96703eab4d867238fefe331", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021475, "uuid": "868caa90-e029-471b-a810-b1a4c8c91787", "comment": "Malware payload", "value": "e65213981bf43ba6f601b46d40139f6b53b1ce03d885fa8e51f4dd640a86867a", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021475, "uuid": "fc47699c-3bbc-495e-acbe-b305519ff3f1", "comment": "Malware payload", "value": "187f335b6ca52096b7c03dfce436d1b253948a96", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021475, "uuid": "865b955c-4184-401b-9703-cf1a2871ee9e", "comment": "Malware payload", "value": "cae0dba7438953cd3efaf143e7e42a2e82b24ba0bb326d1eb11aade5d00f9f07d9e2b03852dfba9c9661bc7a17cdcf3c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021475, "uuid": "9e488c8f-c532-411d-9883-b4d61058b494", "value": "T1DC96D52F32A991E8C55D857EC0568A009CF3B5B53F32C2E76B90C76B4E029D15EFE522", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021475, "uuid": "27702902-fb3a-4f43-9d9b-268a8e046f6f", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021475, "uuid": "1ada34df-71af-445c-8e3b-603a542f8826", "value": "49152:yEC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0Ppw/MiAyfRn+ByGZ:6YCp2J9/dfsBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774021475, "uuid": "44440011-fe13-42b2-b769-c3e2b48ce4e9", "value": 8843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774021475, "uuid": "9300225a-b526-4ff3-b4ca-a7e6718d4a47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021475, "uuid": "e1264c6f-4f3f-4aa2-94ad-aeb05668dba8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c54bf8-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046922, "uuid": "a81c38fa-208c-4891-ae2c-8ce35cd6ddb9", "comment": "Malware payload", "value": "607e3925c3790f4749896e2a8977709c", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046922, "uuid": "b5a96d82-4221-47f4-946f-2d9b7b9f1cfd", "comment": "Malware payload", "value": "e65b1eb28412dad6aad7cce4f601f74027f60a458cd2333a5ea693d911352658", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046922, "uuid": "66950b24-52cd-4dbb-8f2a-b841adfcbf96", "comment": "Malware payload", "value": "f1ebe9780322c27980ad8269e7b0aaf469da754b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046922, "uuid": "bb7ee9ff-cf2e-40ff-9dfc-3d4923cb0ec3", "comment": "Malware payload", "value": "ca9f50e2fa19547c6378024b8b1c9afd5bcb667e39686f9d1dd47724856a9933c1a8a874bed4855fb1fa57787068a516", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046922, "uuid": "df4377f9-3888-4fae-8872-34db4ea8a51a", "value": "T1697533206F694FB7073C8334169B2F0D86A0AEFB4C8AD6ACB1DE55162F36A514527D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046922, "uuid": "7f6dffa5-0e29-496e-9618-07fdc2cc4fff", "value": "24576:R2BS+jEUMI6OF3kexpldHZc44ggc3fQDLmRKAQyDEc02idumHKV65CGb4X274gTs:0LjRxp/ebX2DBWOECS5ergK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046922, "uuid": "343593d7-6d3d-40c2-93ec-918e9541ad90", "value": 1581349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046922, "uuid": "67533048-1e8b-49a4-a454-4a54c045050e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046922, "uuid": "a83954cf-2e10-4e8e-a743-9b45323ae005", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7281b0-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978217, "uuid": "cb89b95e-ecf3-467c-917a-a71eacd347a7", "comment": "Malware payload (SharpHound)", "value": "c0e1a4c2251d9041b04b1c092ce5d38c", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978217, "uuid": "3b4a6635-5fc8-401c-afad-b8b0a021e66a", "comment": "Malware payload (SharpHound)", "value": "e697cc33cfae9ba5933268a7dbb7a9b3d1b64b172364ca12191269b7386f37ef", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978217, "uuid": "3580443e-8b3e-4cc6-ad5b-fc8c13d59f24", "comment": "Malware payload (SharpHound)", "value": "04a26d90207e80b07a186413962a16204b0c90d9", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978217, "uuid": "227cc96e-c312-4620-8073-74ada8ad8c01", "comment": "Malware payload (SharpHound)", "value": "d5d6ac9fbaf120413983ffa44b322917ee91891c9a579c925c2908fbc5c00bea0798cc22ddbd35a65bdca24f98131dd6", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc2", "colour": "#B28B71", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978217, "uuid": "ab4f9f47-ae8e-4bf6-8396-3cf87d505c7e", "value": "T137753320EF616EAF03785234347FBF9EC3A00953606C59FBB9CF12566FAAE455052839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978217, "uuid": "2155a3b7-4e8c-46f5-94da-2301be60d7dd", "value": "24576:IK8AsHm2lxuB0rHvNgcgPhI4iUje+OGAQOxiy4susm2AMLwTEu2Oj1EszJ78zEO4:IKk8BtXhq8OHrj3FS17uFFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978217, "uuid": "fe0f35a0-5b0a-4902-8bc3-0b7e2b096706", "value": 1603057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978217, "uuid": "2674432a-c1c1-44be-8957-8741b0171393", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978217, "uuid": "011a26bb-8932-4521-8eef-8fa3a6b39e07", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afef198c-245f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1774012881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012881, "uuid": "f2b06a40-4c2f-49b1-8039-bf508c3f3444", "comment": "Malware payload (AgentTesla)", "value": "a20a6d4e29a3749e6a642d006ff9a410", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012881, "uuid": "4d6af634-776f-4c11-a6b4-e5c011dc9e12", "comment": "Malware payload (AgentTesla)", "value": "e87caad17c5ddb66860c9c3f4301fd852502cb7d9e35d320d95c3d2a7b452552", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012881, "uuid": "95a6aed2-64f5-4c23-9a00-af66cdd3852c", "comment": "Malware payload (AgentTesla)", "value": "3a2751a2b02ee40ce51cf18d4436d115b32ba2c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012881, "uuid": "303f68ba-ab34-4932-a578-136faf0af9e8", "comment": "Malware payload (AgentTesla)", "value": "ddcc114652fc7895635b188908458b7e2553c7db003896e42c082ba0cd3a90d01ef775027a61e520a7426c534e034d7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012881, "uuid": "9137b7c0-938f-45b6-aea6-1305812d4613", "value": "T11535AE0273D1C062FFAB92334B5AF6115BBD79260123A62F13981D7ABD701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012881, "uuid": "831af914-4e36-461e-8fbb-d0d0ab831c68", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012881, "uuid": "ecf9d863-8b33-4ba2-82bf-72f9be0aacf2", "value": "24576:G5EmXFtKaL4/oFe5T9yyXYfP1ijXdaFTDJPAme/j3:GPVt/LZeJbInQRaFJPAme/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012881, "uuid": "67030825-ae9f-4296-a61e-38137f0f254b", "value": 1104384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012881, "uuid": "46988f6a-1db5-4dd9-9ebd-e89b4e6f54ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012881, "uuid": "42de6088-d810-45f0-b0d6-5c9953ad9625", "value": "Cuenta bancaria verificada_______________________PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad62806f-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978088, "uuid": "0b05b8b3-f46a-45cf-bc1a-0e6197826a47", "comment": "Malware payload (SharpHound)", "value": "91d1ee19178934d235a28b3bdf4257f7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978088, "uuid": "ea2c6dbd-2b14-46a7-9e80-5cb853bb01fc", "comment": "Malware payload (SharpHound)", "value": "ea1e4040052a2d165c9ae8a4e2e3305cf95b6ba2883b2d810f674d44c3139f91", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978088, "uuid": "26fa1e0a-2eca-4403-b240-73c13370ca68", "comment": "Malware payload (SharpHound)", "value": "d0b9f25d23f054a95786b09887d8cd8e8cba13e3", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978088, "uuid": "b01a74a8-fa64-44e1-bb12-834262e2ec70", "comment": "Malware payload (SharpHound)", "value": "82b58ceeb885f5b5d4e4a11a14740690a35d8c9a5748ee2b685076419589a284f52785e5c38b0a68c553c30e77549910", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.7.2", "colour": "#845C55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978088, "uuid": "e3cd3a5f-b3e1-4cf1-a008-94cc689ff71d", "value": "T1777533B17F4E1E8F0BB88338A6DBAB559BB06743600D666977CD829C2F6799040471EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978088, "uuid": "b1c6e298-6692-4a9d-a2eb-d764535906ad", "value": "24576:ZYX2KtKfquP2qhPef6HIpDtApgcgf1acKA3sJu0+OH7cTIioM8+pOiWW6eP7z/tP:mdQvbgf64h9vccQsHYKk6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978088, "uuid": "b752b747-21b5-4a9a-a69a-2b7420e8b674", "value": 1622881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978088, "uuid": "665bb634-6ade-45ab-856e-806e5b5b95c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978088, "uuid": "45a8683b-9bd6-4d79-8431-88b216f9f44c", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a495b613-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989240, "uuid": "adbc3b65-b1ea-477f-bf1b-a7320c254b17", "comment": "Malware payload (SmartLoader)", "value": "a9ac2a0996e36d2018205675c68e29e8", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989240, "uuid": "d60708ed-43a8-47fb-8672-2d60468f4039", "comment": "Malware payload (SmartLoader)", "value": "eb4a305f186a9e97209b977fb3ae4ec44b7dd4d2be0dbf81292c0780de511d26", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989240, "uuid": "1b2a80ed-8433-403f-a853-dac76402c6ec", "comment": "Malware payload (SmartLoader)", "value": "cbf4e519a8f0de3006b323b89ac7cd54ee79e4fc", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989240, "uuid": "ce8a85f7-b96c-49c9-890c-40bfc1ba56dc", "comment": "Malware payload (SmartLoader)", "value": "3c97fad7162af1581fcf863811d3df47bb45da8040006e79ae842e669011f21cf1bec925c008d10cfd77cec8198a83c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989240, "uuid": "41f89d9a-e18b-4c53-853b-26624d5bb20f", "value": "T1DCC4239603689664787407B197BF9F8DC6028E1329921BFD9FC8BF0CA1356489D5FBC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989240, "uuid": "d37bc90f-8523-48a2-95fd-b1ab6f3aa048", "value": "12288:EOCBcIqB+liubzqtYBpfsz4TKPozt4CTo4Pl/2Ar5x:EZ+9ubzqyB9sz4TKPE1l/Zr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989240, "uuid": "d71f8b03-2be4-4e27-b109-b0d6754671be", "value": 546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989240, "uuid": "302ba8d9-b140-4f4f-b0ac-b0c16215e8db", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989240, "uuid": "71332854-c2b3-42e1-b8c1-19f9255bbbe9", "value": "cdp-browser-cf-1.2-beta.4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd3473d-2493-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774035000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774035000, "uuid": "b875bbc1-14b7-4c9d-9918-02972f104b28", "comment": "Malware payload", "value": "a690c98406e8c81b55a9fa1eb9781d1f", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774035000, "uuid": "8e4cfb27-7ddd-4b32-98a3-6088fd2fb365", "comment": "Malware payload", "value": "ee8fdff04d552d6d5781d5f3893231582c6f6e367ff2c4deaa964476331a824c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774035000, "uuid": "4e95bf0c-6320-4afd-9672-23b98c6795a4", "comment": "Malware payload", "value": "b8761b07680da80bab608b6cf72d3d1d23fc5ef8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774035000, "uuid": "e17ecf49-bb5d-4661-a470-287efa60951a", "comment": "Malware payload", "value": "13f59c4b4a219e1935172733addecd49c46d874089d0ae57a929e4b7b949e43feb25b47a6340bec3f340b3a62ccd13c4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774035000, "uuid": "7169a910-b1e8-47b2-9820-fc1bb5b89f07", "value": "T1C8F5AD213586C236EA7E45702A2DCB7B55BD7FE00B7184DB63E8992E1EB09C14235F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774035000, "uuid": "98520269-16aa-4be0-ab8a-ab00074191d9", "value": "98304:Mq+gYmjSTBCMV390AIAfwrty64veHjPMNayX:Mq0h7neH90", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774035000, "uuid": "0d766a5c-05ca-4758-8e68-425113832ba7", "value": 3345408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774035000, "uuid": "ab2b13b1-03c9-4fd3-8cc5-06b0f42c04e2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774035000, "uuid": "33500991-efd3-4ae0-898a-1c7bdd95a792", "value": "game.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9c1fe56-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050291, "uuid": "57b58dc0-3287-4c67-b9a5-c4ee7775c8ea", "comment": "Malware payload", "value": "b5917f0c64e70f56cbd9870447a6db6e", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050291, "uuid": "d0c0e66b-f76b-4564-8f85-fd0236cf30bd", "comment": "Malware payload", "value": "ef1879ad7debb3fddd8b2826a061db46ebe3693eee8364ca559013008b816dfc", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050291, "uuid": "62dc21b4-df2d-45e5-adda-8ef63549e9c9", "comment": "Malware payload", "value": "d8522298bfcdac67d6a8b9fd243fdfdfaecbd247", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050291, "uuid": "5622e702-a4ab-4800-9cc1-a31a464665f6", "comment": "Malware payload", "value": "36502bd182cfa63b241d57a4a4d5590c853fd8f49c29cebf2d4f112df848993ec99f1100b4e07cbfd948834971ff57f0", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050291, "uuid": "778ac6fb-b39a-429d-a964-7b8f32d5b53f", "value": "T1B1D64B43E86555E9C0AED13486629713BF71BC495B3123E72F60FB642F32BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050291, "uuid": "d5e57274-941b-4afd-b33e-0d014cf261fb", "value": "98304:Evw36f4tHZ8ntpVXvDtbeEG5W4hElsKu2yUQaffwdzwvZVB1Z0E+AG:Ek8tpVfDtbas+EqKu2PQaff+ON+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050291, "uuid": "e2dc4ddd-62c6-4f3c-9363-a0405d36ff1e", "value": 13474688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050291, "uuid": "76c8f70b-248c-4668-8577-f8b7a3d934b1", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050291, "uuid": "d8b8da1b-a6b0-48cc-99c1-b9c2bd616156", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "329a50c1-24a1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774041018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041018, "uuid": "cb953fd1-88c7-425f-ad6f-d515ad9d243b", "comment": "Malware payload", "value": "cd1e4cc8cd33c8dfdc66a81160da28ed", "object_relation": "md5", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041018, "uuid": "98614836-fe22-4bf9-b964-32fcb1236f49", "comment": "Malware payload", "value": "ef28eb64f5608d8c3a502bf213e2abe6e0856e7179ae871f87e8114cff575c49", "object_relation": "sha256", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041018, "uuid": "f81ac063-666a-461c-b174-6c6c6eab390c", "comment": "Malware payload", "value": "74dae2c0742f7491625a3a3f6a519331e7ac5740", "object_relation": "sha1", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774041018, "uuid": "7954f9c8-18d8-4c29-b917-3766f02c8a45", "comment": "Malware payload", "value": "461182b26ce11582e092ec2df5acaad3d46b13a1f1b002ecfbcd60f184c1a849af144e8194e85ddcc57f549bb4f1ee4c", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-bc2fd58f", "colour": "#8B2466", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041018, "uuid": "cb669e3c-70e7-46cf-9e08-334ac7346368", "value": "T11E25FA5C740DEFB25025C97C1C950E7D19A3AF0F2665182870ECB61C7FECCAE60B65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041018, "uuid": "c66c94d4-f251-4fcb-95a2-d9ccccd893ae", "value": "6144:hYc2KAOymMym+ymcymuKXzymBymQyloymcylGym0ymQymAy2mymKylayhMVHpaoz:jWgihTiT2a3n+LT5YDvX/rlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774041018, "uuid": "228e384f-c57f-4bca-982c-79a8ad4b7824", "value": 1005683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774041018, "uuid": "ed87e165-63be-4681-ad16-d6ddad9797c1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774041018, "uuid": "b5f5962b-53ca-4b07-aa5e-2e9f9cb6f304", "value": "linpeas_fat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd705ce6-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040929, "uuid": "b2671f1b-c0df-48aa-bfc7-b73f858fa483", "comment": "Malware payload", "value": "444d2492815fb9725ac4be4c8e4ee3fa", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040929, "uuid": "b0813694-43da-4f8a-a74b-2c8ac75933ca", "comment": "Malware payload", "value": "ef599527a9d828a44ad23b5a2bfc5eef447c6d72f66f237b20d53cc40de856b8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040929, "uuid": "1a4d6a2b-1bdb-43e1-bb9c-bba1823bb12a", "comment": "Malware payload", "value": "1647e21628dd6a42eee1ea29bf0366ea20d5fc71", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040929, "uuid": "d6c78599-0466-4e22-ac9e-38e3d895b505", "comment": "Malware payload", "value": "ef662cff996329623a2ba06cbdc5b502b75e98e75e9b3a127b4877c6dc15cdb159061fb9b0a1eb9da22ecff6a15e02fc", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040929, "uuid": "057852ce-cdc2-4f78-a46e-c5672c7455b5", "value": "T136924CB512896C79FBD1CE399F3C7F4CADE882C42124E3ACBA4F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040929, "uuid": "b2ded9a0-c558-4287-8f83-92e5ba4b33d6", "value": "384:hFcuQpWx+BL0SWL0gQzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:hF8i+BL0SI0rzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040929, "uuid": "c1c10342-e9b7-4e43-a457-dfb29546d908", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040929, "uuid": "78da0b39-1ec5-4275-83d5-e58a3239ec5c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040929, "uuid": "91c2af8b-784d-471c-a2e6-7483b1bf56c7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b5036b6-241f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773985171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773985171, "uuid": "13f78c84-ede1-4040-b7a2-0a6ccc5ee6f7", "comment": "Malware payload", "value": "979114ef8d46b8abec7c0fdd4bbf3ede", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773985171, "uuid": "e0b31fa1-1bcf-4c05-9c06-a99a3f1d34cb", "comment": "Malware payload", "value": "f034f4756f307c1c27424059cec7bc7f975493377588e086ea94721b38a68999", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773985171, "uuid": "0c453cb8-e05c-4710-96ff-33172cbcde90", "comment": "Malware payload", "value": "eb1422761c2fee11117a85f09fe7b3e35ebcdb95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773985171, "uuid": "02bbfb15-ae20-4773-a5e7-fc162ef02a14", "comment": "Malware payload", "value": "b82e90cfd699c88e524919c1ab598200731981ba95e2b0904debf6749391b2909d24a5c8e56d048a2380ec371358f701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773985171, "uuid": "50313dae-4cda-4b24-9be1-d707fa96cfa8", "value": "T1CE751255A766C813E8AA1776C4D2E9B41370AD4AD913C35B6BE43FEB3C133634982387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773985171, "uuid": "a0b9e85c-c159-4484-ba83-d60caa32e8a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773985171, "uuid": "abed2779-ef00-4417-a904-575229a5492c", "value": "49152:I0J7MJq+J1uMQTxNgcbmv3dLbB8yil7CJecmj:BJ7MUkYMqzgcO14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773985171, "uuid": "f8dc2994-903a-4dbd-95ed-72f6130130ae", "value": 1584128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773985171, "uuid": "93499d6f-c8cb-49a3-ad64-0243582d590d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773985171, "uuid": "efb9c4c2-541c-4f46-b3be-eabc7dbcb690", "value": "SecuriteInfo.com.Trojan.MSILZilla.246312.16567.32010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79aa59ee-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046720, "uuid": "8fd7d27f-2c4e-4302-9bfd-aaae3f0b0e1d", "comment": "Malware payload", "value": "c556774e69ef1d603ce4baf432828966", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046720, "uuid": "6ec091fb-d99d-4c76-a49f-63a0b4fb65b7", "comment": "Malware payload", "value": "f045a077cf69a1c4f05d37e9131c8648bf5b7b8f7dc8cd4522948bc36cf7fb5e", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046720, "uuid": "f8e72785-ba02-450c-ab68-efab01e1512c", "comment": "Malware payload", "value": "c14285f0968554374192a41fbf631c5b709a6ac0", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046720, "uuid": "85ac4b02-5ecd-4ee1-83dc-5f7ce7763ab9", "comment": "Malware payload", "value": "4c0e985547af31617305afb92f4a904c82ba3ecec8eb1df980088edf66a91c0949ef7b93d0f760c4441bac10b3f85f3a", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046720, "uuid": "d42cd778-d9bb-4b5e-a038-a330dc2eba37", "value": "T12D753370BE965BEF0738833935DBAE0F67E06B46505889EC329F45892F75BC4866312C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046720, "uuid": "c6ab533a-ae11-4057-a767-1be3103d2ab8", "value": "24576:8EJU7dzJc+SCThckgcZfyNyiajtfEbjdLcJXjIKU6nrNC7BCMEJAjz/e90Qqi:opz6siGG7crNC7Bp8Bmdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046720, "uuid": "f17c2362-a483-456e-8396-41be6223ade8", "value": 1631805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046720, "uuid": "ecb5575c-a0cb-4e5a-9212-110582b1b3c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046720, "uuid": "c507bd5d-2426-4910-930d-8d511c91489d", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82fe1a10-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040723, "uuid": "90593770-1855-4c82-b397-5fda89fc4493", "comment": "Malware payload", "value": "6e7bec4ac3373df8ecee9a56a33ab4e3", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040723, "uuid": "5dd09ba4-f771-4114-8893-49ed8402dac1", "comment": "Malware payload", "value": "f07cde4f6d0100101818d32e95396b4a64125219897829832c8beb5540303034", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040723, "uuid": "d1842d34-ca60-4261-9188-f3cdbfa458f8", "comment": "Malware payload", "value": "2ced6687e42519f4372e9638f4a4393c6965c329", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040723, "uuid": "9611493d-69fe-4529-b275-e2aea6d6f24b", "comment": "Malware payload", "value": "468b7bcdbb44f98bf2db907168258cbf9b6f2f76c9377d55a25c7bf4835b0e9eed976caf56fa7e5f280976c83c2c8f73", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040723, "uuid": "8de25f29-f1a7-4b46-ab41-37d65c90ecfb", "value": "T114B6D044A2D90929D5AF4E3D806212335739760A53DA8BCBFBCC82980F57FE6C776316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040723, "uuid": "1e4f5adf-cb5b-40bc-af4f-0676e3fafbc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040723, "uuid": "789ece59-7089-46d2-bdfe-06ee06d9c6b5", "value": "196608:pvyxUbTVBFUcwti7TQlyVN8iNISRTRmW5Qv:AcjHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040723, "uuid": "1d4f35ef-f69c-4d57-996b-3bd6c763dcee", "value": 11114496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040723, "uuid": "f5d65fea-a0e3-4607-b813-bc7c02abeaeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040723, "uuid": "9c174add-1da2-4c6c-89be-9d431bcfb169", "value": "winPEASany.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050e6bcf-244a-11f1-a769-42010a9c0008", "comment": "Malware payload (BumbleBee)", "timestamp": 1774003575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003575, "uuid": "0eab7a1a-1ba0-4c4b-9b3e-ba24e52de6fe", "comment": "Malware payload (BumbleBee)", "value": "ab5e48db976ff58523159bb5bf10dda5", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003575, "uuid": "c4c646d8-967e-4c62-8ab0-f8cf44ed563b", "comment": "Malware payload (BumbleBee)", "value": "f0938d8873f1cd195798d5c2db7edca33acc62e89a53b0727f1c4b27d8205d06", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003575, "uuid": "5a5420f4-1283-4c12-8bbb-95af38d06031", "comment": "Malware payload (BumbleBee)", "value": "64d16b986d25907a4c6193e34ba77908397d2808", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774003575, "uuid": "0d07d2cd-4688-47f4-8ebf-b3dbb90bf948", "comment": "Malware payload (BumbleBee)", "value": "dc16285ed93719be3ced6c0467f6f30ce2ccd7b78d790474971a0edbe4802c49a5dbf019c6680c14a408994bb2f6661f", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003575, "uuid": "79098c0c-05d7-40e7-b8d5-a0d185cbab46", "value": "T10585338FA032D782E2874EFD72C6FE2EA7B69CA5E6E5594705342210CD8DCE17494227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003575, "uuid": "023dc4d7-fcc6-42d6-9b07-98290b8501f2", "value": "8e9e805eb172ecfc99f7aeb249768cce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003575, "uuid": "3a473603-a228-4095-9e91-a95f8e9cd668", "value": "24576:TOFcx+669MhyTv++nx7tJayxVy7x9p5TWmJkaLtcAHM1uf8f5apADV+j88fc6Fi:+ihq++nx7tf+jtFsM/pm6907", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774003575, "uuid": "e2ad6d0e-5f80-4745-ac7b-f3d35a1b39eb", "value": 1852656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774003575, "uuid": "5fe254a9-39e6-486c-83de-700de742f456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774003575, "uuid": "57a4706d-1e41-455d-a6d9-212ce738f532", "value": "CUsersuserAppDataLocalTempzblcbgle.qc3Azure-C.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee780299-24b6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050352, "uuid": "7941f23b-1b49-48ba-9c9e-d1aa3b00f90b", "comment": "Malware payload", "value": "80718ea157d7eb49e389ff3f16b9d4d1", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050352, "uuid": "fd00b881-bdd2-4e64-bd0c-bfb0c9ac303a", "comment": "Malware payload", "value": "f0964133628387b9fe3499c9e9172768c20b0d2acd50c007e8f0bca0fef8af72", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050352, "uuid": "a1f09a16-4454-49c2-b25c-f576b71e9e34", "comment": "Malware payload", "value": "a499bea09045f16b5ae15f8ce22dcef3a8ac3535", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050352, "uuid": "1694f7f4-8803-4af2-a4a4-385f2fc106e9", "comment": "Malware payload", "value": "dcaba98b95554ba021da81c6a64955697c3aa060ac4a94c12f0454fdb3f72fb7ccc239b16a0a2de6e10aedd9446d6fbc", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc2", "colour": "#F91193", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050352, "uuid": "5a016b27-401c-4af0-9f4c-a62686cbf5f8", "value": "T13DD66A49BC1D7062DAC979742B2213547338FC459B81C3266624FB7DAEF2398CF636A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050352, "uuid": "fc486e2a-9db2-4266-87b1-5216fce63238", "value": "98304:hvYrRElAF9w7DOte0ILwcV0jzwkmJbEfIKNzIYt4Y0kxukUhSaI4ds9oEjGxdf:hQrRElArw7SmLwtnwkmonP4W9BaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050352, "uuid": "73de1ca9-d5f3-4ea1-879f-c81afe381f7e", "value": 12774882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050352, "uuid": "9612508c-311f-413d-91e6-97db8ab6ad7f", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050352, "uuid": "fdfd9181-7a5b-4201-aadb-374f9bcc5bfd", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad82746-240d-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773977386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977386, "uuid": "f4e2764a-f72a-43ad-964f-593fc18238ce", "comment": "Malware payload (CountLoader)", "value": "b6e5531d5582cca81994730596d78b36", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977386, "uuid": "d451eeba-1999-447e-a37f-b8c470277a18", "comment": "Malware payload (CountLoader)", "value": "f130dff598cef6ca33fe7d5a76e4604d9f2e206d82de5f24378a8f7166c2e8ae", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977386, "uuid": "80e4669d-98ce-4ccb-b1b6-05414b423bc6", "comment": "Malware payload (CountLoader)", "value": "1048dd5a4d38f2f8bf021301293e0f92deaa7b4e", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977386, "uuid": "fb8f9c19-def6-4335-9885-cdecb9d6d40f", "comment": "Malware payload (CountLoader)", "value": "9548bb5ec61e1c42390e43baed668a352fa8d927bc1966e72f3367f67b69dd004260064c2c5595853be9b0a7d2c00707", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977386, "uuid": "f0e0a768-edd1-44da-856b-bbbe9f363e4f", "value": "T15CB3238C699A84759B9F306D055F3C0BAA9D7212013DC490BADE7EC87F21EF471B99E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977386, "uuid": "2c12508e-bf89-4d5f-8255-c2ad2eeef343", "value": "1536:+lwI3a9NDmG5IGiDglYs/9X+MSmFB4/ZoeVYEE:hB5LmglTX+MSmFB4/ZoeVYEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977386, "uuid": "499c40d5-1ae1-4fd7-8456-ae81ff195e01", "value": 116156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977386, "uuid": "d93bf4b1-5e2b-44ea-961e-fdd057458146", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977386, "uuid": "9de32c02-9d7f-4732-970a-2df5985f5460", "value": "Dataset_Winter__12.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d090b5c1-2473-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774021526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021526, "uuid": "358a0ac5-c076-40c9-be34-687b312981e5", "comment": "Malware payload", "value": "5e1758f7bd25fbd12752fad885c40bb8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021526, "uuid": "2303e924-0a3c-4569-abfd-f4001ad002ba", "comment": "Malware payload", "value": "f1385cd6c1ca941eaf6c6ed0d7402de547f40403718e4f698a4dd81cbd3f8878", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021526, "uuid": "db6d0c42-f2e9-4421-a0e3-0c5abcdc6d24", "comment": "Malware payload", "value": "913092afa1ea03d9ebacba7dcb29272382cc0993", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774021526, "uuid": "a2aedfef-401e-4ffd-852a-3a2c8d3abf11", "comment": "Malware payload", "value": "0a3e173257f9ff6bab13f98004a8ec472185914a32185963d92c0f60afb1bbb760eb0a69695e2259d2df0c93518040a0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021526, "uuid": "e1a6e8ee-493c-40ce-bec0-d3c2429c6186", "value": "T1FB96193B226D912CE59D853EC0938A40D8F375750F33C2EBA6941F958A12FD1DE3A9E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021526, "uuid": "8f6b668c-9348-4fcc-88ef-1e27bd8b88d8", "value": "04f25cd06fe127444a170e0a217a1fc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021526, "uuid": "f9c736ad-7772-42a0-8d63-e703d186c95f", "value": "49152:cEC/oSzmCvbToKylXH0FezMSuwEQ8VDYNaWS93mi2yWKe0Ppn/MiAyfTXBaFNs1S:UYCp2Jm/dfbaSX2nRll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774021526, "uuid": "7f5cee3d-ca6b-4b5d-9284-9a12dce2f6ce", "value": 9043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774021526, "uuid": "d99e8264-24b7-4b33-92c5-03c192fd80c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774021526, "uuid": "28a07627-532b-4042-88c5-291405c24267", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c605c6d4-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046849, "uuid": "bdf0331e-d3f7-4b0a-9f62-d9102f789932", "comment": "Malware payload", "value": "4c95da3f27f997cd1ec1528cbd88a119", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046849, "uuid": "03fca00c-0098-4ecb-8225-541c1124d8ca", "comment": "Malware payload", "value": "f1c7f552887dc15254c7a12825c9535e8136ecc8d454f261ce521bc6ad891234", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046849, "uuid": "f1cc7907-bfcc-4bc0-83d5-87f56b1ff482", "comment": "Malware payload", "value": "0835bb2ca4855ba99c857b47448bf2c38d2d9b44", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046849, "uuid": "a6334fb2-de0b-4d2d-813e-836e0fe7fe2b", "comment": "Malware payload", "value": "16ee218e1f128f10d2ad1ab8dc4b06a91b0dd17b06f6c6eb9f46548949fa465a7c974e810811df862fd8da3db442df29", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046849, "uuid": "15d856e8-92a9-4e22-8ffb-d53dcd84caec", "value": "T1317533306FB66E7A86F8413C21A72B6DC7705BEB5119D5DDB2DF85430B72B60402A87C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046849, "uuid": "59a67145-e195-41a6-b506-25aa796ec2a0", "value": "24576:7S9S6O5ykUvp2xGiGmqsgcGfMnTmQVArqJwgBdDE64sQaBUH0PUQEqOk05gngBWE:7ovp/nS0mCQDNvlWb5lscbozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046849, "uuid": "c0eac671-b232-46de-b61a-bae696eb4f70", "value": 1591613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046849, "uuid": "f920eba7-1f9e-49fc-9d90-ae233dd84895", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046849, "uuid": "1876b8cd-cb9d-4dd0-a5ef-32e0fafe45aa", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79554bb-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040919, "uuid": "03912803-c78e-4863-a66b-19e4db854c17", "comment": "Malware payload", "value": "f1334af21d96823de46b8f14e76d8cb5", "object_relation": "md5", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040919, "uuid": "49019f7b-c534-428b-a46f-e0e06794aa81", "comment": "Malware payload", "value": "f275ba8d04e3b412c30aae7de5aae3a078e1742d52beb40fee4b512904fc88bc", "object_relation": "sha256", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040919, "uuid": "1b0a1c0b-7022-44b2-afab-00d3515bda67", "comment": "Malware payload", "value": "69d69a09561c773935ca40916c943f0321f820be", "object_relation": "sha1", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040919, "uuid": "b1f24128-4d8a-4e0e-b335-7236f0733a88", "comment": "Malware payload", "value": "c4aea38a84d8dc0faf3b2e3192bf4315d7c79a3939cdc3b87971356ccbb7cc5a9f09f6b0d45b1af841b2e996c5fa394e", "object_relation": "sha3-384", "Tag": [ { "name": "20260315-4ab010a8", "colour": "#B078DC", "exportable": true, "hide_tag": false }, { "name": "arm64", "colour": "#0864DC", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040919, "uuid": "f171ab9d-77f8-4043-a4c0-2ce705c71403", "value": "T17506AE9ABD683940D659663E5FEE47C11B3CFF4B3F1287173904B7AE1AF221A49D1220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040919, "uuid": "2da0454d-47e0-4324-8bfc-4871f40a5c2b", "value": "98304:8zoyoKKNdXKPns1AyeOO/NyTK8G/bu75RsxEBk4N7hvdYelTjYfdmo4ijDVIx+z+:kh2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040919, "uuid": "460a33b0-5fab-4331-bc9e-9d9da08c8cbb", "value": 3844482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040919, "uuid": "d0019c19-5ae5-4652-bb0f-dc3d2b10f63e", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040919, "uuid": "24c13536-825c-4308-b7a5-cec5c4c252e5", "value": "linpeas_darwin_arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc7d0ab-2428-11f1-a769-42010a9c0008", "comment": "Malware payload (SmartLoader)", "timestamp": 1773989252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989252, "uuid": "38deea46-0ff8-44eb-afdc-67579ffa428c", "comment": "Malware payload (SmartLoader)", "value": "2d816b0448c351aa0e55f01de878df4a", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989252, "uuid": "dcdb7598-b8e8-4210-9128-1d819486ebb0", "comment": "Malware payload (SmartLoader)", "value": "f2d1d180f8965ccb3fb7f8484d32f36606c2def8e0e77151d06994c97b99a1cf", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989252, "uuid": "f1dbc5bc-d224-4feb-9ab5-7e6177f3c074", "comment": "Malware payload (SmartLoader)", "value": "f983a28da70d741bca75fac2ef9c04d0ee4677c3", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773989252, "uuid": "b3e0fa26-f4d3-4bbd-b0ab-5638c38fd8af", "comment": "Malware payload (SmartLoader)", "value": "f76355ec74e3e29a08e1c5ad55b129ffaa70dfd126c61fdcb02f315941f45e996187133941f7d3f32ea8f6f73d720a90", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989252, "uuid": "bd1fd47f-c45a-4793-81b1-d715173dd760", "value": "T1D5C4238BA3FD845390BF1F58AA5BB48D091976F34722DC93146A3313D9CB323B752698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989252, "uuid": "19e3c0e5-beda-4d2a-97cc-54a9bd25b14c", "value": "12288:7+A7qlRP8eHTCW+TNYOONPTi1wCgU3EOsT9vL2by9H9I1P0QKw6FEN:7+QqldA/TSO713u7xn9H9IaQKHE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773989252, "uuid": "d3ea4543-3395-4c36-bff1-0dcafbbaa4f6", "value": 587686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773989252, "uuid": "6c1d5d0f-c38c-4fc9-93de-5425a1f420d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773989252, "uuid": "d02e8dd0-07d1-4217-9b76-125a64ccb67d", "value": "powersub_demo_1.5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b1e163-2433-11f1-a769-42010a9c0008", "comment": "Malware payload (SluttyStealer)", "timestamp": 1773993798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "851f6f33-cd01-4690-94f6-c6b236ab8885", "comment": "Malware payload (SluttyStealer)", "value": "eba0ee4cb394699ce7409cfcb7a5d681", "object_relation": "md5", "Tag": [ { "name": "SluttyStealer", "colour": "#D22AE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "663fe728-ff1e-4e8a-aefc-aa9a113e488b", "comment": "Malware payload (SluttyStealer)", "value": "f31dcba623e524a41cd1bcadb793601428a003e735fb47db6fa60ae3c5cd9024", "object_relation": "sha256", "Tag": [ { "name": "SluttyStealer", "colour": "#D22AE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "6359f593-227f-4619-9c1d-6bea95c52ff8", "comment": "Malware payload (SluttyStealer)", "value": "346a32a89ac0a5c5b6329f577931acd8bf739f98", "object_relation": "sha1", "Tag": [ { "name": "SluttyStealer", "colour": "#D22AE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993798, "uuid": "56ee96be-5283-4e9c-88ba-5423921d6f41", "comment": "Malware payload (SluttyStealer)", "value": "7bcd8fbb78c58383ea2d28b0d12a9c4b4e3dd931c5a83b8e63d348a2ee9ab3bd782f72212532bd28ce4183bc7c68df96", "object_relation": "sha3-384", "Tag": [ { "name": "SluttyStealer", "colour": "#D22AE3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993798, "uuid": "2dd525e6-5ca8-442b-afd1-1692be0dc738", "value": "T1C2E733B4D5A127BF1D7AE4392B36ED32425664F248AEEE0F603F63E2C8C06913D75055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993798, "uuid": "616f9862-d6e4-4c2e-8dbd-b669c935a7a5", "value": "1572864:coT9E1oFsvg8SMjgtTWM5eU7nymL1/xzOQKhum:5RiftctaMQay61/0QPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993798, "uuid": "ad59a0b5-a3a8-48ac-b82e-c3c3c7501c0a", "value": 65185774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993798, "uuid": "b3ecd677-5a33-45eb-918c-e272f773c25e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993798, "uuid": "6ccd725b-85d2-4cdc-a1bb-82eb63a84f1a", "value": "ff.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43442e9-2446-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774002151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002151, "uuid": "912347b2-489d-415f-bb85-ae42d3fd6b4f", "comment": "Malware payload", "value": "1c0aa2d5a91dbe6cb1f687b8a3619c89", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002151, "uuid": "d05dfa3a-c50c-4f16-8e50-99c31bcc500f", "comment": "Malware payload", "value": "f3eb7eec922bed969e7e971af94de816f03fbaaf2093e504c4c7a925b4e728ac", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002151, "uuid": "3ec4654f-26be-4423-b3f3-79a2ab81b653", "comment": "Malware payload", "value": "c42668f8f7ea619e87e60783e39bacbaf7aedfd5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774002151, "uuid": "c4f28a26-f4a6-42cc-9a7a-986fdc95d449", "comment": "Malware payload", "value": "902e7206cb84e7582171c484ca305450a75b92ac5a5614a954564b44f5dd88c8add4b0473ecafb82c73de4a3a4babd4c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002151, "uuid": "ac64022a-62b1-4cbc-9675-0dff73a34025", "value": "T13106339E8F35EC51EBDBE97D8E5A86EEF49ADF0C004B100E08F874625C590E72A84D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002151, "uuid": "7dc5227a-9b51-4198-a15e-54d03a5b7650", "value": "98304:4/A3u2kCHk5HVt2NTXPoki3qA695FYBbVirqy6BSP2c0FfRQEXT2L:4z27Hk1/2JP63qAQ5CpE6S2c0FfRpyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774002151, "uuid": "21b41331-ab78-4dae-ba9c-cac4a32ccbb8", "value": 3706489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774002151, "uuid": "9ba72cf9-4f73-4ddf-bc3a-f70495bdfa89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774002151, "uuid": "0cbd3e4e-ac7e-4e85-9750-68eb46cc918f", "value": "Glazed-client-n15.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b437edbc-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050684, "uuid": "513257b7-b35e-4fa3-b1c2-9786187c9c47", "comment": "Malware payload", "value": "e848daf6c6be3d87ea804d2b13fcacb7", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050684, "uuid": "c45a6e42-c4a0-4bba-af7f-51e2a83b6f30", "comment": "Malware payload", "value": "f3ed006da0b5f8402f70647fc7dc8dc28f3f06f5b4f00913761c96e6b5377be4", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050684, "uuid": "f0a3c4a1-2f3e-4ab8-812b-2aaf93e71033", "comment": "Malware payload", "value": "ef8afac870c37fb2158ced1c523463a42a01e73c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050684, "uuid": "7e016dae-849a-49f9-aa28-6656bf4d797f", "comment": "Malware payload", "value": "10f7e3fd25d540a9dbff9ed1969f3ce3a122a7f40a52ea9addd38d2b25b121d1252ea00eaf4bdf013ad99d9ec8624f75", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.9.0", "colour": "#E5AD1B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050684, "uuid": "187a27c3-b0ca-4090-a688-2c0a01a02fbc", "value": "T1DCC67D55BC1DB262D9C979347F665258323CBC449F82C2272658BF7DAAF2348CF23261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050684, "uuid": "9d8dd215-26ce-4c99-bec6-65ac340335df", "value": "98304:CxsOMSrQZTvYir8YTfQM8QKIjuYWmdpAWgfRxs/4wRsmWwQ2boGjWtZhqu0CdqbC:CdrQZTxoYdN2W8a4wRJwqGqbD3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050684, "uuid": "dc024e95-5403-4783-94b1-6303dcaa02ad", "value": 12320952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050684, "uuid": "d9c28bfd-3c37-42bf-9df6-2d7dd9c8106a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050684, "uuid": "24276637-2927-4392-bc9d-f9ea139e4a8a", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35530eae-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050471, "uuid": "7b74e321-d295-436b-844d-1f18c63d183d", "comment": "Malware payload", "value": "8265ff72e4b5242acf4aba27d7d8469a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050471, "uuid": "3411844a-55a6-4014-a77c-552f75295976", "comment": "Malware payload", "value": "f3fc60a8c6435bcbfef9d0f4c8be96b3f7dd22a1fa07c3959d0f20daa8731eb7", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050471, "uuid": "f4bb9938-1574-49db-ae90-d05739a4dc60", "comment": "Malware payload", "value": "29cf1a8d91ccc6a53fd1f1d626c6f29a17b07c6a", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050471, "uuid": "7c2681f3-9860-4e20-9b9a-1b0df9cc6481", "comment": "Malware payload", "value": "e46f67f2cdd30d72177f2663466e9f8d836300aa70a855efc4cb835d0630dec4f53315affe6110ae5c97cb3b13ea43a9", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050471, "uuid": "e546d810-0f30-412d-9a60-739ea1f1809d", "value": "T12DC67D557C1DB663DAC979347F6192943238BC089F92C3277618BB7DAAF23488F23251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050471, "uuid": "bb71eaf4-0808-4efd-bcb6-397e7b4f997d", "value": "98304:cnlQ7ykK1tp9xr0DkSaw6sZ/c3IlFmslSQJiWNImvVatVlgNq6lVmEj:cW7yk8tLp0PaOcYLlSQdvqcVDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050471, "uuid": "93b24393-2f25-41e9-8101-2fdb2fce2345", "value": 12320952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050471, "uuid": "0536e0ca-7990-4387-814b-27f0ae1bf4b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050471, "uuid": "7a64ff58-eee7-486f-99db-ae209487c8f1", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf71c245-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046864, "uuid": "ab8b7605-d4a8-46cb-9ce9-dfd4b16c27ee", "comment": "Malware payload", "value": "60e6caaf8016cf842fa460bf36b07944", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046864, "uuid": "0469d6fa-2ad1-4f0f-83cd-59a1f8fa770e", "comment": "Malware payload", "value": "f44ff3a2d54aec84aa91a673f71ccbdb859fb06222a14a96f9f10e9d95b86d44", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046864, "uuid": "499f4996-66aa-4126-9b42-be6c71c7dddc", "comment": "Malware payload", "value": "2f876a1fc46a20fbbbb7752394920193ff5e46a7", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046864, "uuid": "e111d383-301d-454e-931c-fedf214a9be0", "comment": "Malware payload", "value": "766c71d96ddea2bb876bfeb5a49a0e7b6d7a9e8de26f12200be6621980321a5bcb17c7899387eef91f133e51f83893f2", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.3", "colour": "#B1340A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046864, "uuid": "a7146ecf-6aba-44bb-bb43-6301054cb683", "value": "T1307533729F0AA9634BF8D238406FAF1DCA474B42D10986F638DD90C64F7BA12855BC7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046864, "uuid": "6519dd7d-c6b1-4c8e-b4e2-083ab0a2d2c1", "value": "24576:FTTHZvWtBjVR9ZbzCBpHWNIklIlIrUSKdCU5DX+xuufj6Y3eqNV2yASHSCILP6Mb:52tUSadyNoyASHiHKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046864, "uuid": "a242d32b-2930-47ba-be79-5eea14889a34", "value": 1579789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046864, "uuid": "e74f6697-d9d8-4c5e-849a-6b7756c1d8cb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046864, "uuid": "8034cfb3-8b4c-4615-9d50-b7bad682ec80", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6312e9f-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046929, "uuid": "f6c86d53-1cf0-4513-9a48-ceb3fa216233", "comment": "Malware payload", "value": "e91ca5175f2246c9648854d7c241588d", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046929, "uuid": "f8a128bc-580e-4d14-87f1-da24dcfa8571", "comment": "Malware payload", "value": "f463a71aba9e3cdf82eb11eae826d5469ffbf2efa82c739cd3028ca0a7bae47d", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046929, "uuid": "1b0a1afd-3806-436a-a043-52462ce7418c", "comment": "Malware payload", "value": "059dc610ab2a4cfe923989f58cc85ef01b5824c3", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046929, "uuid": "97ae1fb9-323d-44da-a336-7d16af7bc6d0", "comment": "Malware payload", "value": "222d89e107a127fd657bf4bb3fbf1444d74440bfc207a6ea06de01859c8415308f113249e35dfb103222a735bb4b3485", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.1", "colour": "#683835", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046929, "uuid": "2728c3dc-8ceb-4064-b7d1-2042d805fbca", "value": "T1FA45122A53F88B55F66F1FBDA03142598BBA6757F9ADEB8E988C70ED1443700D841233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046929, "uuid": "8553b23f-2b97-4e66-a6d1-7f3ae2f84e99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046929, "uuid": "f5d865e5-9137-4b2d-8373-e97e4d36ae90", "value": "24576:SWLIGEDwgrRvNuXoVIa09WmPstYX3BkR9nk4Bkong/iN9WC:S5zRvNE9WmPDXi9nRBFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046929, "uuid": "c6865efe-6a64-4a79-a74c-c615e6c36125", "value": 1276928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046929, "uuid": "d859ac4e-3158-4a18-8bab-77ad3d501e5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046929, "uuid": "655a3d69-b7d0-4c68-891f-e5c830fa92aa", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5031bc56-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050516, "uuid": "c7cbbd01-5c92-4e9a-94fc-b3ee55043c8b", "comment": "Malware payload", "value": "bfa32ad63406967e7d33ed29302d4115", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050516, "uuid": "d482ae09-1628-40e2-8b2a-eb4e25f1c642", "comment": "Malware payload", "value": "f4b941e7ec22e5f106494d66a3e181678f6435069bc3446207c5b9e0c7a38282", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050516, "uuid": "90ef529e-6712-401a-a654-82dc6ec721e4", "comment": "Malware payload", "value": "b246df914c43e3362fc0b1b6ac9257ba02f40057", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050516, "uuid": "1d9458ce-2e75-4ad0-bc68-52db83aafeeb", "comment": "Malware payload", "value": "8bdcf18665813bfda42cea30413e9a86a0058ac3e8f9c0daaaa5c38fa6331ffda7543b79b0b1bf083abf205f238d0873", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050516, "uuid": "5cfdd035-0425-4849-bfcb-c53327b7a02d", "value": "T1CBD63913EC6545E9C1ADD63086669263BB717C499B3023E76F60F7342F72BD0AAB9700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050516, "uuid": "881d1394-e882-4d40-a415-94970eb4c93a", "value": "196608:M7wH1n+W6hugleVWI33KTyy9JEQqT18meS:M746hFeVWGyoqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050516, "uuid": "a6ed9ffb-e401-4e2a-8ff4-fba686adc31e", "value": 13164836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050516, "uuid": "61476616-14c9-404c-b067-0f0c6190ff17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050516, "uuid": "fe89b79d-1070-4c1c-ab0b-96b0b286e497", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd1c030-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977951, "uuid": "28ba8da7-2c3d-4f25-bc28-078d8c99543c", "comment": "Malware payload (SharpHound)", "value": "6a1174d3e88103a899cd37baadb91e09", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977951, "uuid": "9a6110af-1796-4b8f-b8d0-c0d864840642", "comment": "Malware payload (SharpHound)", "value": "f5009a72d3e5259a3221316551d902e609fec05e7e063a87b63a83ea28eb3100", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977951, "uuid": "7c7d5030-ca8b-4003-8d79-64e1e12bccf3", "comment": "Malware payload (SharpHound)", "value": "301a1cdf5f61e046d600c6198bad8b12f7e7c25b", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977951, "uuid": "a45a6f7e-4270-492d-8dc9-7733a86d1fc5", "comment": "Malware payload (SharpHound)", "value": "1888296c69d5965fdae82e9fd2c0146b15639315bcf0b4d3623e18d0bb8b6508ee1a9f7783a3a16abbaeea49165b09ac", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.10.0-rc1", "colour": "#0ADF55", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977951, "uuid": "84773cc5-711b-44ee-9b4a-80230e2254d1", "value": "T193753301CD574DBE06F49139783FAF0D8B714AE7805954E6FBEE22870F676D4406A2E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977951, "uuid": "3c89da07-0542-4edf-8928-87bbc36625ac", "value": "24576:a4gUKleKGLIjCHldFXR1v7B7gNDVDJwXOTIAbYV96B88mZ3mRggT8OrBjO1+:UsWjW/7B0VRT5babN3mNoOrBC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977951, "uuid": "fc89ef5a-6b7f-425d-9a96-220711917b3a", "value": 1618213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977951, "uuid": "64ab303e-1e53-453d-a515-f4cde7d859b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977951, "uuid": "09e86aa3-2237-4b5c-9d2a-5e85324a5aa6", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86038a9f-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050607, "uuid": "9e266e93-face-4b63-a536-7afe8ffc65d8", "comment": "Malware payload", "value": "26734955b390e041abbd007fdd7b37e4", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050607, "uuid": "4e23d4dc-48d6-4912-bb96-33175820e0a4", "comment": "Malware payload", "value": "f53d8040d84edd75ebe9e232e6d4b020e9368b9477434d91889ed1ec48fa558e", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050607, "uuid": "3c5ce3cd-ae06-4458-9495-c88cc928daf5", "comment": "Malware payload", "value": "11027a8c3862899be8a1c0c4537f4339798eac66", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050607, "uuid": "a29239f2-e838-4df4-a439-0b3a837bdd90", "comment": "Malware payload", "value": "1241f98c541d47b8b967ce9eb0b757346bd0f6f7511b5c1fa31cb1600170882d72bd7ae1774b5f2f32937836543e285e", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "v2.9.1", "colour": "#E7AAE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050607, "uuid": "8014c6e5-17ef-42a8-8226-9ddb00056c1b", "value": "T1AED64A03E86565E9C0AAD23486669313BB717C495B3037D72F60F7382F76BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050607, "uuid": "f485442c-aec6-415e-b881-335452559721", "value": "98304:Xsysph79XIOggRxB2NslihnxyueVHpxuT2oMzX5Bd1Tw1mV9dxPU+EdtWD:XIXIOjRxB8BxylBbuCoEB67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050607, "uuid": "bad7627d-9e9e-476e-853f-a8d6cfccd1a1", "value": 13437664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050607, "uuid": "a8623178-878f-4aa5-84f2-05d8d302f3b2", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050607, "uuid": "1085e2e8-8d5f-4334-a3b4-b88d7f106076", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de72b918-2425-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773988048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988048, "uuid": "5f68e563-3f1c-4c40-916d-367e2bd1e599", "comment": "Malware payload (Mirai)", "value": "d86825f4669d4079cc7d875cd807f53d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988048, "uuid": "4c199cbf-e892-4e4c-a242-5a8bcac6f931", "comment": "Malware payload (Mirai)", "value": "f571713c2e41ceeeaa6eaf69fe7b7aa0cef49e53a2afcb32544062ceea6cea9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988048, "uuid": "ee0d7d13-d818-4a9f-a2c6-e95e1159bf45", "comment": "Malware payload (Mirai)", "value": "7e1f4d897622d98c54dc53800045b07b6726b3d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773988048, "uuid": "173ec743-6df8-44e7-8fcd-e32a88730b56", "comment": "Malware payload (Mirai)", "value": "fd2cbe37366446305cd0d03dbc28f91cd4c875a1e2b5c74c624969023d6703df63493fc247ebe3338ede8ca2ecee9214", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988048, "uuid": "697eaf32-9d4b-4e5e-8e23-cd2de1fafc01", "value": "T1AF830995F8814B12C5D512BAFA1E118E3313177CE3EE73129E206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988048, "uuid": "5640358d-b1b9-4f79-824c-67734c418d86", "value": "1536:+jn1iHnpq2BwjHboUl1TS3Wab8RYJQWM/iPfrJgba7tN5lY1s/bD:JnptBWFZS3WabtfrJgbahNvFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773988048, "uuid": "06594595-9ec9-4367-8a50-77554da1a466", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773988048, "uuid": "a6f37404-4261-482e-9ea4-db78147e2c6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773988048, "uuid": "332a458b-20bb-44c4-8080-28e34cf96970", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917ef3d8-24a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774040747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040747, "uuid": "00eebb66-c798-43be-858d-b8891f4e6a57", "comment": "Malware payload", "value": "ee215ce3bdb2bde2d8c2542ce2dd42a6", "object_relation": "md5", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040747, "uuid": "bcc256f1-f7b3-45e4-bb0d-c94781183b61", "comment": "Malware payload", "value": "f78d0b6f5cdd30b2a989f78239de64037210719c7be607a7c30ca7f4249963e1", "object_relation": "sha256", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040747, "uuid": "8a08c2bb-4730-4c77-938f-1ae3b18f9ec3", "comment": "Malware payload", "value": "92d371896d6308b2b70e4434a79b58fc309f7f38", "object_relation": "sha1", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040747, "uuid": "2b3d9f39-53e7-4a5d-b486-8f6f213edc81", "comment": "Malware payload", "value": "19e0632ebcce8e3f40306ee6f6fca005d551b95cf5b1fa74bec676eb2681ffdd8aa366fe3861cd5e6c262124579078f4", "object_relation": "sha3-384", "Tag": [ { "name": "20260319-1b930a61", "colour": "#C362F8", "exportable": true, "hide_tag": false }, { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "peass-ng", "colour": "#7A321D", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040747, "uuid": "68f78197-da1c-400c-ad22-69b3ff3120d7", "value": "T100B6D04062DD046DD6AF1E79906202324B35761A179A8BC7FBCCC0980F5BFE29F76726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040747, "uuid": "2120f1b2-2959-4d12-aa1d-300dc0ecda70", "value": "196608:EPzdVBFUcwti7TQlyVN8iNISRTRmW5QK:ipHwtQQlyXOOQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040747, "uuid": "873b1231-0fda-4798-a033-ed279477001e", "value": 10959360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040747, "uuid": "8f9aa1bc-1fb9-49f0-899f-442630dfea3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040747, "uuid": "52a46748-df5b-47f1-96b8-7ae9ae16a2c4", "value": "winPEASx64_ofs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a5d289-249e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1774040056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040056, "uuid": "af7f8e86-8a8d-4974-a4ad-906b39a05a38", "comment": "Malware payload (Mirai)", "value": "c5dd8cdbf92a422827921a1e39adefcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040056, "uuid": "ef696da5-1351-4264-af73-85891f1a99d4", "comment": "Malware payload (Mirai)", "value": "f7adb6895681b0a3d24a2d0780cf9c9e719a8a3a2cf3cca46bed665610139016", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040056, "uuid": "a003e58d-dc2d-441f-bab8-2cd2b4506cde", "comment": "Malware payload (Mirai)", "value": "ab4a7f1c99ace6692a8c48f1c29a1ef2f2dd6abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774040056, "uuid": "ac221973-d086-4c68-9e5b-d95bc8dbac87", "comment": "Malware payload (Mirai)", "value": "67a3f857519479ccac097d5a7987c6f263b9c2dffbb842fb15bdaaa5f61c7b932d9f5a1d77060cb0daab707771bd8fa6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040056, "uuid": "c5c2dfd2-d3e6-4f41-a9dd-886458b0a0e3", "value": "T13804C70AAF510FBBDCAFDD3702E90A0139CCA55722A53B763674D528F54B50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040056, "uuid": "8948e4e9-41c4-4699-af28-bc7336a8e420", "value": "1536:hR3ynCmOtuIjSdAR+B+1L6JePXxc20gw+nz+K5NbPHSxGZli/jCl0ByzIotQR5qi:6CmOtuIjgBqLrVNToGTuAzqR+db8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774040056, "uuid": "6a5bdb48-3793-4ec4-b376-8d83856ab732", "value": 174999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774040056, "uuid": "e7ea6fa6-ee69-43fa-8381-09583d7410f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774040056, "uuid": "b98065ae-acc2-4187-b78f-6ab27a1f7c81", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6606fe0-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046876, "uuid": "066a7652-40af-4d91-b963-90b2191c1168", "comment": "Malware payload", "value": "a4b599f40a93f70a6345fcde10807566", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046876, "uuid": "dec55eee-35d6-450d-89d2-4301f99bba95", "comment": "Malware payload", "value": "f7fd6556b828114d6d81f0799b45082108b2c4ab92d5ec98eee1cb3cc7819d7a", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046876, "uuid": "23dc45e7-750c-4b2f-a656-2cddb8ea8fb2", "comment": "Malware payload", "value": "fcaf821f041db2137cbd59e85ed683b1c0d8fc7c", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046876, "uuid": "1e192699-f4e0-457c-a4eb-0953d14d6517", "comment": "Malware payload", "value": "fc20dabfeabf9ed4b62e125af09eab3585b28578987b89ea2b0ce379156841f25460a6e8c18795349e620b07a9e852e4", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.2", "colour": "#35870E", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046876, "uuid": "0d05aa45-d39d-4c8c-b634-cdc2b91b7990", "value": "T1D655121943F49B96F6AF0FB9A0664059CBBA7617FC5DEB8D9A4CF4EC1482350C950323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046876, "uuid": "2d61ffe6-cc8c-4aa9-a96b-e1e94ff3e8f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046876, "uuid": "682220f0-902e-4636-9a7a-17320864af2b", "value": "24576:KhLIGEDwgrRvNuXoVIa09WmPstYX3HcVIGtSljkong/iN9WCH:KezRvNE9WmPDXXs1gjFK4WO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046876, "uuid": "3928c76f-2073-4a6c-8e4e-b50b3e3b0915", "value": 1304576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046876, "uuid": "99dd0038-612a-45a2-a672-18ee0f9fc51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046876, "uuid": "6a0ae8ae-ab03-4021-ba66-50f15f3d5e28", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53f2757-242e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773991952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991952, "uuid": "2dda2152-d673-4aa5-8d9d-e0cbf65ad7c3", "comment": "Malware payload (ConnectWise)", "value": "cf4dcc4c95913c8f16628a34b3f348bd", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991952, "uuid": "2f830513-37cb-4717-b05f-aa5e4d4e0472", "comment": "Malware payload (ConnectWise)", "value": "f82bd5500ac7b83605b746db603f9ff4c008ebfb185c006cd52b5d02f04f3b08", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991952, "uuid": "aec12422-1fc8-4433-9205-800f2cb5acd1", "comment": "Malware payload (ConnectWise)", "value": "81cad5852de5bc9d125a5bfc4f637ac1d7cd9393", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773991952, "uuid": "911622a8-598c-41f4-aeca-80a45554eec1", "comment": "Malware payload (ConnectWise)", "value": "3e7baefb0de642948b68865ef122dac1ea0fa20bcc682286859a5a218b8380198a736f3c80ffb08769edeb439fa2468e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991952, "uuid": "b430b49e-038a-4a00-bad3-15b26a9540a7", "value": "T17F646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991952, "uuid": "e046e167-6d8d-447c-b019-12a9e2a12b54", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991952, "uuid": "6f6857f4-b737-4d07-8ae1-5b01e6d4208d", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9a:41iw7gryNkSV1hy1Z1u2JLu9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773991952, "uuid": "6aff6812-1f76-44f0-9e80-b34838a630f4", "value": 312600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773991952, "uuid": "644ff422-0a97-4683-af0b-bb1467a72fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773991952, "uuid": "0e13d137-f530-4778-b28f-9e88561c6ab2", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441ee159-2450-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1774006258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006258, "uuid": "bc8d27f2-0429-4c2b-8a48-8bd83bb17f71", "comment": "Malware payload (njrat)", "value": "72c297e50d3e1caab1d1a0aa5ffc2290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006258, "uuid": "c8dddabd-411d-4a60-9b4c-dfca5d7b87f7", "comment": "Malware payload (njrat)", "value": "f935592ac13d4f34c75f9d2baaeaa8f181c8930e11889b8f3dfa8dd6413e534b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006258, "uuid": "062c60e9-cf0b-4129-8b74-4f638f45d14f", "comment": "Malware payload (njrat)", "value": "e497dc6f39db0c5f12ad48b84d1d06233ea5581d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774006258, "uuid": "fc7f8e14-e53e-4c5e-89bf-1d8617332c62", "comment": "Malware payload (njrat)", "value": "f95b913e5a4c2072d9a7846bbe22d63d71cde0226739d8b8909cd654686f85c6273035e35a291b2de9c59e4fe841b336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006258, "uuid": "95b9b245-4769-4519-99ce-6ec3a3bf80f8", "value": "T1AF032B4D7FE18168C5FD067B05B2D01207BAE04B6E23DA0E8EF564EA37636D18B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006258, "uuid": "c5c035d2-277d-411b-93c8-34abdd2551a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006258, "uuid": "ac37d089-2162-46fd-8717-3b87768c2f67", "value": "384:I8qIiuVjtD+P3V+y0bf2TKtvN4suKvNrAF+rMRTyN/0L+EcoinblneHQM3epzXjj:DNmV10bf2TKtClK1rM+rMRa8Nudht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774006258, "uuid": "793c36f1-601d-4c2d-88fe-d797f305c20a", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774006258, "uuid": "c37f92bb-75c4-4767-ad65-014068f9c92f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774006258, "uuid": "e347aa29-b2c1-44bd-87ea-fab599b30a7a", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db912db-24a5-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1774042728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042728, "uuid": "d4fd356b-f2b6-41ed-a656-fd1268c838b1", "comment": "Malware payload (RemcosRAT)", "value": "4850e5e6e7afaa638500e12234966f99", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042728, "uuid": "5d1f29e1-ef60-4d59-9829-81d78d49c78d", "comment": "Malware payload (RemcosRAT)", "value": "f9c8fe3d801da3f2d25298c6a607a1a87de173945d0dc7f8e8a014131ea47cdc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042728, "uuid": "2e07406d-9035-4475-986d-d35fafa010c0", "comment": "Malware payload (RemcosRAT)", "value": "65247846e68c4ccf2223f32a3e0cebc1c219a7ba", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774042728, "uuid": "c0bb61b4-511a-46c5-b409-3c7a8a2bc3d7", "comment": "Malware payload (RemcosRAT)", "value": "c4be6bde053d314b7b17bd5530f6ed311618042c3fe5a6e25feb12feedf173459abd6c528aac7db7b0f2e99e83634b79", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042728, "uuid": "8e3e7225-3cd4-4a5b-ada5-18529ed47721", "value": "T1D7E2F1F92E279019EE168FB4F15B30F3A7EF887BE5D462303416659357F28A06D602E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042728, "uuid": "a6b4e3eb-251f-48cb-b3d7-c502f9ae3695", "value": "768:1qO9ARYif6+XgoC0TJ/1a8tjqUkhzC3oGXXhkIUH24nyCFM:kTfwvSB1a8tjqwjG24nVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774042728, "uuid": "933f1e79-b63e-49ac-b56d-bcb4df22072a", "value": 32480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774042728, "uuid": "3fa73fc4-9031-48d7-a4b3-2781a3ebfef2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774042728, "uuid": "783b5588-6c2b-40c9-86dc-cf3d5a2bd79a", "value": "20032026_6375.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481f396c-245e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774012278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012278, "uuid": "23ed59f1-e3f6-402b-b798-8d2a14377b81", "comment": "Malware payload", "value": "9fd5920fe1fe407dc8ba6871550ca012", "object_relation": "md5", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012278, "uuid": "06f2548c-9325-43c5-873c-e73bdbbb0a68", "comment": "Malware payload", "value": "fa22e94a98d19959c82580dc1cafcfc6ec762ed57dea9f48e3b7d0f9279a8cce", "object_relation": "sha256", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012278, "uuid": "11067772-1c4c-4491-8c5c-60c029fe068b", "comment": "Malware payload", "value": "7bea05f752d46cc4f6b2f4969de0319f8c44af37", "object_relation": "sha1", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774012278, "uuid": "b0295c42-6852-4c52-b5b1-96dfd0ba1d66", "comment": "Malware payload", "value": "4e6a0b0152996f71e9fc8d1c52e9411a0e843c81e703549bae99708bbc9c79538a0693c05a544f8398423b0f5e632aa7", "object_relation": "sha3-384", "Tag": [ { "name": "43-134-7-102", "colour": "#7038FC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012278, "uuid": "bf3cc318-a793-4aa4-ae8f-4b1dafa78884", "value": "T1DD16121AE7560AFAC47AE17889975516F7B27CA94770A7CF23B5026D0F273F04E3A201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012278, "uuid": "bb899a0b-02f8-4bf0-b94d-c0f184bbf374", "value": "4df8f6986a70e63176c1c5d97e6192c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012278, "uuid": "07b14ea2-03c4-442a-9398-8f9cb5fc0973", "value": "98304:mWadOBfKP4QT41wUbqTA0AxVSYIuU+LzmTOYOM2IJ7lETr3dwBkR173g:HaTgQ1Oqk0AxVSN4zwl2IdlUNbR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774012278, "uuid": "7b358328-6b64-41cf-b840-83088c55a361", "value": 4377605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774012278, "uuid": "db40ebc5-2477-4602-9b77-8c6a5bd793e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774012278, "uuid": "1b5b17d4-7b07-4679-99a9-80570010aeab", "value": "vulkan-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077726e9-240f-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773978239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978239, "uuid": "2363c14d-5fce-4a9b-be1d-4e355d8dc0d6", "comment": "Malware payload (SharpHound)", "value": "d40def037bec8125a39b617fe4fa4644", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978239, "uuid": "2a989780-e624-40c0-880f-63addef8749c", "comment": "Malware payload (SharpHound)", "value": "fa6f13b29ea58d838e0696882d93f4e166fa2c0bf5a5c192210df2d8eb268e83", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978239, "uuid": "77501cb8-f28e-4a03-a095-6490c2ed5215", "comment": "Malware payload (SharpHound)", "value": "efd2193a10dd9c686ffa311db89a18d7c2ae20ca", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773978239, "uuid": "b1d26358-0c60-492d-bc0c-c18ae972a28b", "comment": "Malware payload (SharpHound)", "value": "98f439c2a8627202f65ac05bbff2dfd51fbe0bc40c400e44170f2d6a5136e43c5dc677adbbe603fc56fc782cbcae9753", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.8-rc1", "colour": "#B8E5EC", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978239, "uuid": "03f71a75-383c-43df-9151-c75521576ee0", "value": "T1C37533302F696F3B4BF84738768B6F2AD79006834095885B76DE618E5FF1F42846B02D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978239, "uuid": "5aa5f530-d9a8-4d39-8d70-030101582c71", "value": "24576:ejIBy8cwyf3EWaiLHmKHRMgchfrbA+yuvFUi5ZsjsFy+3VHzlB4GtEJHCngrZJBI:jQJhu0nOUyAYzT4s8HfrZvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773978239, "uuid": "fc06fa48-dd27-46a3-a6c6-f3be32a8e97b", "value": 1604689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773978239, "uuid": "dd15703c-e6cc-4caa-8884-b292cb12ac54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773978239, "uuid": "21081059-920c-49ed-8d75-4d57c7079c3f", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b8ba13f-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046777, "uuid": "e3d45635-b05c-49b9-bba7-ae6624a150c6", "comment": "Malware payload", "value": "ec75043035f5bd0c1cc7191c9d184e67", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046777, "uuid": "7f1f5a11-fc7a-4bf1-99eb-b6eb8d3e0ad2", "comment": "Malware payload", "value": "fc487c5db96e328c60c945ee31f05790e6ff2d057676919325d23b7414465f7d", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046777, "uuid": "1bd24126-ee9c-45db-9a5e-decedca88e44", "comment": "Malware payload", "value": "5224f30f850fbe5c8d9d5b485d45f6f3d2886444", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046777, "uuid": "c31a6578-0ca1-47eb-a149-f824cfa307f7", "comment": "Malware payload", "value": "1acb8faa6be233cf4f49df76cac40d2c3c214c852feead7883f4cf26a56e925df865bac47719b261fb93dd0c16b6cd12", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.5", "colour": "#5A4344", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046777, "uuid": "3a5c9098-ca7e-4b95-8982-a4c40d5e5bd7", "value": "T15955125943F88BA5F2BF0FB8A4758159C7BA3617F96DEB8D994CF0ED14823248950323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046777, "uuid": "73af9cdc-156e-4041-99ec-bb9cd37326b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046777, "uuid": "3ecbbeb1-caed-43eb-8c5f-fa75733bb381", "value": "24576:ipLIGEDwgrRvNuXoVIa09WmPstYX3vg8Wi9yclJxkong/iN9WCF:i2zRvNE9WmPDXDWHcbxFK4WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046777, "uuid": "5ea98bfc-edcb-4946-ac5b-7c47a3ba5482", "value": 1305088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046777, "uuid": "62e8a9ff-3bdb-40d9-b215-7e3b5522aa33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046777, "uuid": "3a63689a-f61f-4391-b2bd-dbf42ee390a9", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf42199-240e-11f1-a769-42010a9c0008", "comment": "Malware payload (SharpHound)", "timestamp": 1773977872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977872, "uuid": "f55164bf-860a-4d35-8c42-edd0e53ecf9d", "comment": "Malware payload (SharpHound)", "value": "bf46df16027b7d584a6f496af9a825f2", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977872, "uuid": "48002c26-54c1-4c51-9cc8-162d035c0446", "comment": "Malware payload (SharpHound)", "value": "fc8f879fbb56d4868cbfb4c2e9be6b7f73e4731f4c0d5f7dc0746dbb6a21331b", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977872, "uuid": "9bb56bcb-24da-49cd-b785-e0e72e1cfc27", "comment": "Malware payload (SharpHound)", "value": "16435e3701fad2b618d96647c31cafb5211f7272", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773977872, "uuid": "2c8eeb29-08d2-4e8b-a4c4-2a2953158e0a", "comment": "Malware payload (SharpHound)", "value": "1bdcdb8e4287c2dcb4964c9f475206208d49970cacf4cfa2101ecd2052a1515d126889122cff86b8c72f63df5d257167", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0-rc1", "colour": "#E8B5A0", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977872, "uuid": "519fc48c-2264-49a3-b73a-c331839464be", "value": "T13F553330FDAB9E7606BC923471AB0F2E9FB5AED3648501CFB18F51A21B636450413A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977872, "uuid": "3ea3906f-711f-4652-8530-00f247009869", "value": "24576:wTR0sRmbkgL5R3gccf5wxHSZSH1qrNhCSVBJlVHOiT88ngAWJ0Dnwds:aVRmbGqE5NQTJjs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773977872, "uuid": "0687aea2-a28b-4026-b9ab-94da0c33dc99", "value": 1359261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773977872, "uuid": "d2c72506-7662-4ca3-b04a-48231cf73bb0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773977872, "uuid": "a3140e78-f7bb-4b0e-aeac-4f756b2aef4a", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf5aae0-2432-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1773993413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993413, "uuid": "f3b4b3bf-ddd2-4885-8782-eb49c6445be6", "comment": "Malware payload (BlankGrabber)", "value": "d759e05f7ea9ca73e2c200e261767186", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993413, "uuid": "6684dbd6-b761-45d3-ab18-836e9abbcf85", "comment": "Malware payload (BlankGrabber)", "value": "fc9bad75faf0f7d6b17d953cf4d5ba9acf3f9bc8273824327db61f07e36deab1", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993413, "uuid": "0ee7f3cc-d214-46a5-8c83-92c1387e13d5", "comment": "Malware payload (BlankGrabber)", "value": "f35fbbff60633f6e8fcede78955bcbd9cb6e26f7", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773993413, "uuid": "e1999a59-aeed-466c-ad7f-0db1060be4f7", "comment": "Malware payload (BlankGrabber)", "value": "c5c9377ef9bd2ebd554aeffba76384083e4bf55f189973b768e280cba47fb15eb7515308558e212f777aa3690625a1ba", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993413, "uuid": "f6c27916-e416-47e8-ad6a-abe6204c79fb", "value": "T17BE6338443D18EA7F6E7E13E46A79054D2B3F4405B728ACF4BA847692F1B2E14F39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993413, "uuid": "e4944c09-b39e-4bc9-aa8c-2e39c6458485", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993413, "uuid": "bbb0484b-8781-46dd-84e4-5a6b180d5b15", "value": "393216:5jec1yNdq1B7iR0gpHskqSPjZpiqbH4a7:31yNg1ABoS7Zp9bH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773993413, "uuid": "c4a23798-6975-44f6-8bad-b43cbc60b774", "value": 14045624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773993413, "uuid": "a5bb6146-1060-4df0-81c3-f7df6f4f44d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773993413, "uuid": "17f9d5a4-9e2c-4da6-b374-fb998291cf9e", "value": "xx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcced587-24b8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774051128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774051128, "uuid": "5c0b13c2-f5a8-42ef-b51e-c7165a90e8c4", "comment": "Malware payload", "value": "cb68d054fc08f146bb8c1332d1c16d1c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774051128, "uuid": "c7071830-3bc4-4dcf-8fda-e23f2366b48f", "comment": "Malware payload", "value": "fcdbd61ecd787b4911d79ef7bdbcbfc78fc94c41c68c05dc318da317e925718c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774051128, "uuid": "223a495c-655a-4cce-8528-eb6eb260ec89", "comment": "Malware payload", "value": "a1889718e059d6fc2f2281288bd074ff2de915d6", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774051128, "uuid": "f00b9c3a-ec55-421e-b462-f0c6a0587a07", "comment": "Malware payload", "value": "06d43d25ba8fb49e8d32201a647f183602161b818ed7899c2fa8fbc23cc24b68c04b8317317a32e1bc5ef3370cecfb6c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774051128, "uuid": "924f7c8d-c391-408e-9f4e-5ba329763cb0", "value": "T16C05122ABA5454BEE51BC07CC3A58572AB7170CB0F32A9EF026111343E9A6F61F3D275", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774051128, "uuid": "6ab59e11-d069-4038-b76f-5313cb56fa31", "value": "ea99bb4db84d6b4e393fc3023853ac82", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774051128, "uuid": "77cf0e3a-adea-43d5-9b30-fb66e75d7be7", "value": "12288:rr2WpIalXDD97GLqDhXcHOCBW0qG9aGUAB15y1cr3jmkWm:raehlXP9CQXcHjoeCAb5y1crThr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774051128, "uuid": "a86db840-c9aa-42eb-ae4a-17a81de0196d", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774051128, "uuid": "93fe19cb-27b3-4dbf-91a4-a4854deefe76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774051128, "uuid": "324cccdf-5df9-4aff-8340-1137b95d1e40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6bdc8e5-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046823, "uuid": "a8ca01f9-d617-4020-9e1e-b2409cf1ed91", "comment": "Malware payload", "value": "f4629de63a23b8fe20b585503356513a", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046823, "uuid": "27c4127c-a544-4197-9d54-bb4896b0e095", "comment": "Malware payload", "value": "fce997199494af20131f9dfa43a7a01afcab812c93c84f5f6e4629f4a3052a27", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046823, "uuid": "0d6fdf29-2de7-4797-95d9-bb3fbb58af5f", "comment": "Malware payload", "value": "a13ffa74cf731d8b28050f937176861455223a96", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046823, "uuid": "5a3119e5-0434-45e9-ba0b-b7cba11b5db6", "comment": "Malware payload", "value": "e2888a03f1241e93a901202e582c71577d0054f87d4ff9a52f3b005ed2774b2ce719c7be04be28a7a0fd04d990c97fc5", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.6.4", "colour": "#EB76A1", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046823, "uuid": "91d06b3e-7f04-41b3-acbc-de94190c7310", "value": "T10455122963F88B54E6AF1F79603142694BFB7717F9AEE78D588CB4ED2482304D851233", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046823, "uuid": "bb328585-5408-4c87-a3f4-422901412fb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046823, "uuid": "92dd92cd-bc65-4de7-bf92-9bc72643ff23", "value": "24576:0jLIGEDwgrRvNuXoVIa09WmPstYX3Rg8ZV4CtrLlZkong/iN9WC:0IzRvNE9WmPDX1ZV4C/ZFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046823, "uuid": "a9008c32-d198-414a-8cc9-2a903c5049d2", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046823, "uuid": "e0d9f2d4-fd3f-4422-9821-75c07eb26658", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046823, "uuid": "b3dab2d4-30d0-4f82-b510-f90f8adce6a0", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5229880c-2444-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774001128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001128, "uuid": "b5d6d054-e36d-49c4-a963-17292864c0a0", "comment": "Malware payload", "value": "8460c097aa1f391ce96cb9381e2b1299", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001128, "uuid": "238f0c17-cefd-4f02-b83b-dde6e1b69072", "comment": "Malware payload", "value": "fd30ffe9c1179292644f5d8bf8b5fbc95651f97569dcf55cd24a1132caf00571", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001128, "uuid": "ad83406a-6722-479e-bb31-d946c0320ae6", "comment": "Malware payload", "value": "e8d8e0521ba7cdf8c466d8123059be6e87d53ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774001128, "uuid": "7eed0ad5-63c2-478c-8edf-e1b73f1a7eaa", "comment": "Malware payload", "value": "e2d0047944e7e636b512538f5c134ba6a3a8d5eb18ef6e24a30a9220c344f2eb267f013a1512e769cb9cbde101f07e99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001128, "uuid": "32a9e5da-83f2-4785-89b4-62b241063a82", "value": "T1A9A3F845BC919B1746D562BBFB5E428D3B1A1768E2EF3203CD256F20378A85B0E7B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001128, "uuid": "1489c834-c46c-4990-b025-0443c16a370c", "value": "1536:vh3XRomWbR7hcOydxKAMvus4VFIzNTsAhaJsm8VephwMdnlsOwywJsDvitcCoTI0:Z3+bphFWxKDh4EzNQAhaO8ft28t5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774001128, "uuid": "46a42c12-cac4-458a-aaec-632d69371cc3", "value": 106943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774001128, "uuid": "b2c11a3c-f971-4e0d-9e45-947d64210461", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774001128, "uuid": "921f516b-5de2-415c-8cfd-60279ba900e9", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15aebc5b-240b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773976545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976545, "uuid": "5f4bcbad-e931-4cf7-8030-d23e439e193c", "comment": "Malware payload (RemcosRAT)", "value": "3df907e4ef8aa7b9d8c04a307c34c57b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976545, "uuid": "e94eae26-af89-4841-b872-9f4100fac575", "comment": "Malware payload (RemcosRAT)", "value": "fdc4416c4836f996afbe02d1f1ee21e8437c8b5e49b3cc01ea2f1255bccf59a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976545, "uuid": "fcb5f84d-48f6-414c-b07b-4bdaf3ca1afd", "comment": "Malware payload (RemcosRAT)", "value": "d6a410ac6a30cd62c8430e3a715d260f1d083100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773976545, "uuid": "8195ca37-56fa-4850-954e-487b62176e29", "comment": "Malware payload (RemcosRAT)", "value": "de1112fb7f1c7359b6022d7c45f04468e5af53a9596befe0e6a677c3ec68375cb8686d07f87c22d3c80bc67f7dd71bc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976545, "uuid": "d1d81208-aa3b-4a57-9616-40058c3b6486", "value": "T128B4BF01B6F2C172D976A4300935E774DEBCBD201835997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976545, "uuid": "02cca547-0655-4169-b037-13066d431061", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976545, "uuid": "70facc9c-814d-4934-8df9-23b9cb8e43a4", "value": "6144:eXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBcej:UENlHV9FGeDWv3jADnyYiCNrsPZl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773976545, "uuid": "aaaaadc3-b620-4522-8d01-2c9b4e0dca28", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773976545, "uuid": "e93ccbdc-24cf-4c75-b083-fbfb23baa101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773976545, "uuid": "14703b9e-54a1-4d51-b73d-62edb484246a", "value": "fdc4416c4836f996afbe02d1f1ee21e8437c8b5e49b3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ddfded9-24af-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774047050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047050, "uuid": "f78c3c56-278b-40b3-b4f3-d4c6cdec3d11", "comment": "Malware payload", "value": "10a21b468bf83434b76a25fb31e6e6fc", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047050, "uuid": "2130bdd4-2bc8-49c8-8234-02b58dfbe18e", "comment": "Malware payload", "value": "fdde316e70798f776967b9e75cc8bb01ce4b6b0721bfea1b63372ca64ede54d3", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047050, "uuid": "1fc55358-b6de-465e-a2ca-c2c1862c8428", "comment": "Malware payload", "value": "a11575f128026b6e55ed14dec3031b326dc1f875", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774047050, "uuid": "db6349a3-c703-42bc-b4a4-2c136da609e1", "comment": "Malware payload", "value": "d90d6e58452ac587c55863de80e15f050bc4392733f3935f5d86b1784e70c09da429d1aa703eeb3af2cab9ca053636fe", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.5.9", "colour": "#DAB4D4", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047050, "uuid": "737aa211-9acc-4933-8e92-7338306711d0", "value": "T1A09533719FF73D2D4D78843B34276E2F8AE01B933199E14AB6AE4042673BB84854F917", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047050, "uuid": "1a0dc9d9-7974-4c0f-a66f-9d38344aa580", "value": "24576:TkPmZXDpGHOOtbWP/5HbRYD4Tb2GkKbCz17vVBU/JnPK7ZXzOYiGiwrpJRY8bsCY:V1pcaN7TRL/wtXzOYEYT9LqRDIQ4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774047050, "uuid": "44b5d278-2cad-4d9e-a583-b639f0ca3494", "value": 1951877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774047050, "uuid": "65815364-6dbf-48b8-9268-11b2b88a5268", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774047050, "uuid": "fce82093-558e-40f7-ab8b-ebfdaa60b103", "value": "SharpHound.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75312f2f-24ae-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774046713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046713, "uuid": "5a7a848e-74b3-4db6-be21-fc47a48b9e64", "comment": "Malware payload", "value": "182760c7d44708e257aad4049d80bbc5", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046713, "uuid": "ec96b58c-c3ae-40d4-8df2-f432bfd31235", "comment": "Malware payload", "value": "fe66fcb0ab0bef5c9a811d57671e7a166168572631fdd03a353f0aa51dee6cab", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046713, "uuid": "e74c67fd-12bf-4639-9af5-56b75c334e1c", "comment": "Malware payload", "value": "7f5ca122eb5c476c87f554b46eace9df5eb025f1", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774046713, "uuid": "d52f92a6-25c0-47ad-8b5f-744bb4193a27", "comment": "Malware payload", "value": "d83f61f1c5e21606350eaea7c388afabe07d7313eb9682acdb6d56216578441a89b7928ffef5672173cb91f875d5a5b9", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sharphound", "colour": "#A9B4FF", "exportable": true, "hide_tag": false }, { "name": "v2.11.0", "colour": "#9F438A", "exportable": true, "hide_tag": false }, { "name": "Win", "colour": "#1EE934", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046713, "uuid": "ab661acc-f278-4b4d-bbcf-61b0aadd60af", "value": "T18855015983EC47A6F6AF0BF9A42191558BBA7627E92DEB4D6D4CF4ED1C82351C800333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046713, "uuid": "051f84e8-6acf-439c-97c8-bf89e3ebe424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046713, "uuid": "7d8a60a4-5ac8-4804-ae7a-1e76010dc897", "value": "24576:e5quLIGEDwgrRvNuXoVIa09WmPstYX3wrZviCZkong/iN9WC5:e6zRvNE9WmPDXArZaCZFK4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774046713, "uuid": "fc7094a4-dad0-45e0-bcb9-30d844b22f25", "value": 1341440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774046713, "uuid": "a8b3ebd0-d9d9-47a3-982e-f0003b2aa1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774046713, "uuid": "76bf50c1-f3fa-4fd0-8984-45175447a4fd", "value": "SharpHound.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e22151-2411-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773979152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773979152, "uuid": "a3781e0a-3167-4174-bcb4-bf4df00683d7", "comment": "Malware payload (CountLoader)", "value": "f0c8f8adc8041b7b0f15b3deb46ebe35", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773979152, "uuid": "9a67e2e4-b2dd-4f40-991b-df7324678cd1", "comment": "Malware payload (CountLoader)", "value": "feae0f8e003e8e2f450160570284537cdb153b94bd50775ff2286da9c8e49375", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773979152, "uuid": "8738aa97-7eda-450a-9c7e-72949b9e4458", "comment": "Malware payload (CountLoader)", "value": "d8a318947c7ce62412a48c26e29ad8c0596e139d", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773979152, "uuid": "ca6edd02-4199-4020-825a-eee4f4b14bab", "comment": "Malware payload (CountLoader)", "value": "1e118ebc360c8a3f408ac622dbe93070f12836101cac114cbf7448d832ad77446bc2a0b0fc956b6016ffa6bd59bdeb5b", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773979152, "uuid": "939f562c-ef0d-4147-9f25-42bf31deb49d", "value": "T104B3F2884A8E8474AB9F7034451E5E879A9DA31B411EC6C07ACFAF553F139A071FB6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773979152, "uuid": "f7882dd9-ce45-4896-af81-ea89d45c742a", "value": "1536:vJ3rpaNB+1KIS5koy1Ep/Wj5AL9yUwMFop5NqAfOv/uY:UEKIS5koy1WL9CMiNqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773979152, "uuid": "2515bdf0-0183-4a80-97d0-212e9362cf11", "value": 117329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773979152, "uuid": "b9d73f91-9612-4212-bc18-6de2a1c45492", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773979152, "uuid": "d40bb9f9-164f-4408-9ef8-02a96914feb9", "value": "Fusion_Session_Tokyo_7281.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b87703-24b7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1774050464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050464, "uuid": "1f20c957-7888-44da-ab4b-0acfc208807d", "comment": "Malware payload", "value": "1d479213c5833772e6cc09e5f576a19c", "object_relation": "md5", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050464, "uuid": "c389a10b-b5bb-4e92-85de-023dd08ec5a7", "comment": "Malware payload", "value": "feaf55d3f152ff5561af0501686776648ec89ffed411006b85bade0cfa73b99a", "object_relation": "sha256", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050464, "uuid": "91627d87-772c-4757-a980-374608dd725e", "comment": "Malware payload", "value": "ad0dd34dd50aecfe7e58c33a5b8b13c244e0d087", "object_relation": "sha1", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1774050464, "uuid": "285b1052-1f8e-466c-9ef5-f6ef06ef2169", "comment": "Malware payload", "value": "3a46de39a898ed27726f2e0cb8757b96e45c9446f8362a8bbe7ca76b81505c35e2b2665c377b5e3bc2a5d1919b778738", "object_relation": "sha3-384", "Tag": [ { "name": "attack-tool", "colour": "#C852E0", "exportable": true, "hide_tag": false }, { "name": "azurehound", "colour": "#161FBC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "v2.10.0", "colour": "#C6E2E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050464, "uuid": "532bcfbc-4ecf-4bc3-a4e0-2d995bdcfae8", "value": "T16AD63903EC6545E9C1ADD63086669263BB717C499B3023E76F60F7342F72BD0AAB9740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050464, "uuid": "5ddb6c9a-2b36-4270-9213-4fab05cef68e", "value": "196608:QoEHtn/A7hUi3ebZAX01Try9OEQqT18cOx:QoV7hzebZny30x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1774050464, "uuid": "89ebc8cb-f5c1-457e-9874-465ed0c89b2d", "value": 13164836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1774050464, "uuid": "eb66d16d-8af2-4268-a313-81f7f219d834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1774050464, "uuid": "3da21b05-9299-48cb-8035-434bfa9cdd6f", "value": "azurehound", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037bc09d-2436-11f1-a769-42010a9c0008", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1773994983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773994983, "uuid": "c0c543d0-239a-451b-84fa-671c6318705a", "comment": "Malware payload (CaminhoLoader)", "value": "4f524088ca2f7394145a358f45a8efe5", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773994983, "uuid": "f02818f2-5e40-47e9-abb9-d224469c84c2", "comment": "Malware payload (CaminhoLoader)", "value": "ffb3a2239bfdd3373db080f2b89dc5064084c0962353054b3e92e53eff33373c", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773994983, "uuid": "53eb9a27-1b34-40ce-8ee9-79f847a54d65", "comment": "Malware payload (CaminhoLoader)", "value": "bc31439b5dd76b427fbb12358e0a0bbf3ab5f6d8", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773994983, "uuid": "5060702c-ac82-4c85-9f45-f8e62ed1cf4f", "comment": "Malware payload (CaminhoLoader)", "value": "abfe26ad5ebe018c3d64770f29796b52bbc11681fae523b1a0dac2a6b8eb316d014162c32129a1c83388e655040a4480", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773994983, "uuid": "2ccc5264-befc-4188-a0b6-d694ffcdc99c", "value": "T18BB50297F971464F4DC85FA2786C6580DC112ECE1426C24AFA7BD8F72284B8CD1C69BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773994983, "uuid": "b6b466e7-2f46-4749-b479-526884f9d141", "value": "96:4WJYUNL51NRzyKA3dBRjoLjSgetW10Pi/V9uzVK+wZjT59DjGtfQ3BveEIzOSehQ:3AP54e6AHhMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773994983, "uuid": "da5c8e21-fc73-47da-b8a5-fd081ec28196", "value": 2358973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773994983, "uuid": "c20b2003-296d-413c-8039-6737424a147c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773994983, "uuid": "40bd749e-3f78-49bd-9e73-959b1f556016", "value": "update_system32_windows-lolcajxyh4z7fw66.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }