{ "Event": { "published": true, "date": "2024-07-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-07-12", "timestamp": 1720828982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "66c41d64-3c25-4fd8-a476-f0968b432b9a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2a04a2-4014-11ef-957f-42010a9c0016", "comment": "Malware payload (AsyncRAT)", "timestamp": 1720764196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764196, "uuid": "8b11d673-61ce-471a-a2a0-1435e710a4c8", "comment": "Malware payload (AsyncRAT)", "value": "7e7b20e421442d74655685583b4036de", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764196, "uuid": "0303a7cd-f218-44c4-b75c-be828784294b", "comment": "Malware payload (AsyncRAT)", "value": "0040de802062e7a83c6f785781873e9c78ec3fe70b8a3c7c3274fdce08b6a6c1", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764196, "uuid": "ac2d73b2-6544-4b20-aaf7-05100d3b68c1", "comment": "Malware payload (AsyncRAT)", "value": "cf936b1fe122c6a5029c07a64a0f8674b31464af", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764196, "uuid": "48411309-4c66-4cd8-ac5c-ff549760c704", "comment": "Malware payload (AsyncRAT)", "value": "3147412eb1a79b0cbdff977f11ec3f3db8c27b83b06691bb6d8f3ef76f8e6065041c2b2f768643541de6445a427293e2", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764196, "uuid": "6b1e00bc-73f1-47dc-adc0-acfebf240e3f", "value": "T1EE51D02829E9511CE2B39F74ACF97165D96BFD669E31CA4F004D460A0B23610DCA1F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764196, "uuid": "5be214b0-0a72-4bb5-9885-9e4e36e2d4ed", "value": "48:8s0KcVnd/l7+z8dQjPLYnFsQ09WO3HA1tCBuQZa:8s0KcVndMQu/mFsQ09v3HAyuQU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764196, "uuid": "ef9b650d-9030-4536-aaab-903b2ddadbcd", "value": 3017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764196, "uuid": "e9b279dd-0ca0-4e37-8154-f761138900e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764196, "uuid": "0e31b722-113d-40ee-9c47-4d4bbc5e8a4c", "value": "0040de802062e7a83c6f785781873e9c78ec3fe70b8a3c7c3274fdce08b6a6c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f68f25e8-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789335, "uuid": "cd32607d-ae98-48b3-ab20-da6d1ca1e23e", "comment": "Malware payload (Mirai)", "value": "a8d09ee9ad215ba19ffd1661ddeda240", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789335, "uuid": "7014ebeb-6d6f-4ff1-b164-c0a30b17baea", "comment": "Malware payload (Mirai)", "value": "00be6398cb276dba6c2506dcee3b7c7ffcca4247795d6c9d0f439210cbcc3d6c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789335, "uuid": "f1fd5a09-32b8-406e-965a-eb0db3dbd048", "comment": "Malware payload (Mirai)", "value": "81e7910e8e703b898b8cf4ff0c52b972e7e8afa1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789335, "uuid": "f53f7f40-4933-4edc-8cac-e2676620aca9", "comment": "Malware payload (Mirai)", "value": "ceac14981dd93dd70b7e8a4c5301d78a2569abfd21a3785a3e2e6be0ed48380611594e1a5f382358993c22a62bc889e3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789335, "uuid": "8328ffa6-d3cd-47ce-ad8c-02f2fe4cb79a", "value": "T178B3D61A7E268FBCF78E823547F74A31865437962BE2C144D15CEF002F21789685FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789335, "uuid": "f38aa7f8-7bf1-4084-9c5f-077d238b907d", "value": "3072:Ib7r1RZaqaUX0V0HgY0ZAIsfTeAV42lkM:Ib7r1RwXUX0Q0ZAIqiAG2lkM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789335, "uuid": "f240d91b-0565-424e-90a9-e648b8990829", "value": 117298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789335, "uuid": "2691d38f-5d8e-4439-b323-dbf92e2df1af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789335, "uuid": "142767a8-5b38-4b95-8e0c-d76e80d75d7c", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6806601-4068-11ef-957f-42010a9c0016", "comment": "Malware payload (Gafgyt)", "timestamp": 1720800395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800395, "uuid": "ab8c0319-9fe4-4ed2-8b09-0b7c867e47b3", "comment": "Malware payload (Gafgyt)", "value": "07e5002282817291e3f3bc24952e4ab2", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800395, "uuid": "55c435d1-0540-4534-80af-0374e87f452e", "comment": "Malware payload (Gafgyt)", "value": "011e7fe6d53874de66d1065f09a0c68376a89a45184be147e2f75b121bf0e714", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800395, "uuid": "4dd914b8-ebb7-47b2-a1a0-c9ab338b5291", "comment": "Malware payload (Gafgyt)", "value": "f8b662cc7c385ddbd5366dde8b402ef117f4c8a7", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800395, "uuid": "04bb62be-e611-45f3-aff6-d50ac648a976", "comment": "Malware payload (Gafgyt)", "value": "8800b0cfbee35e27f3a8cfd60e87da5eaca2ccdf4862102fc143313e2d6ffd159b7b06bd92f361fe3cbc45b1a542452c", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800395, "uuid": "ebc4e8a3-9807-427b-9d06-96b08ba1b8b4", "value": "T10DE30907EB614DB7C85FCE3306E68521149EE5A653D57FAB72B8CA4CFB0694A09E3C40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800395, "uuid": "a1ed0498-1559-42b3-81e7-0bf279347541", "value": "3072:GBB7x4SxdVF0FKz5hg8NzFeRmQ/5ApYDDn:GLNGFo5hgeFeRmQ/5ASDDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800395, "uuid": "63991e83-3ebb-44e9-b446-553e60df6347", "value": 144562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800395, "uuid": "1cca233f-9a7b-4ed5-bad5-485abc13e2e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800395, "uuid": "95efdc37-308e-4069-858c-9ad0cda34666", "value": "fuckjewishpeople.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba83d87-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720790928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790928, "uuid": "6f491e1b-dcfb-4f6d-9915-ff91fe9fea8b", "comment": "Malware payload", "value": "6f151e0e59bca6e3e6971246e8b82b31", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790928, "uuid": "fec78744-88fa-4bbd-89df-9919e87a5e5a", "comment": "Malware payload", "value": "016f87ea7f834aa2876d1c5179f3f212a0ed1573c2694ece91d6a652ff8a75a0", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790928, "uuid": "f4f9dfe7-7dd5-4459-a17b-3830970e4105", "comment": "Malware payload", "value": "5b22eb9ce71cf01a3cb970a0f94657f968a7e1da", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790928, "uuid": "88b027e2-f614-4e6b-8c4a-3c7a315f4920", "comment": "Malware payload", "value": "a9abac1ef0ee661c9cbf19408b9cc6084cf4c498fdf9366ad328f2df039f8edfe472d7e91463951db5faa948a46d9728", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790928, "uuid": "a90fe845-d667-4043-b661-f301787f67e0", "value": "T193C73321F18A98D7E94AD1B1C18F8A1461D9CD5D01234741AC3CEA696BFF2C28D77AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790928, "uuid": "95a50a7d-7196-46a7-982b-f1500cac7f92", "value": "1572864:3HPI1+aQ85jZtDqlleBskxw6PBVO0gMtIGhgXM0Q+1:Xk+aQ8PtOleO8wGUDIgXM0Q+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790928, "uuid": "405568cb-5d18-41f1-818c-254fbc868e35", "value": 53564789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790928, "uuid": "ac6f6487-dc14-4c89-8498-149593c1d5dd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790928, "uuid": "3e0f1670-61f4-4b56-b403-cc0d3986ebc2", "value": "45.9.74.32 Strela DLLs 4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8fcb813-4022-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720770388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770388, "uuid": "5751926e-dbfa-4ba0-b615-e33fbe8ef838", "comment": "Malware payload", "value": "5fa4ed817688faabba91c716ee850a45", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770388, "uuid": "c8521047-3709-49fb-a559-34ec70e7150e", "comment": "Malware payload", "value": "01ac9844518e5f2f659416ab3d6031a67f229972b6cbc413ca9ac865dfd2feb1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770388, "uuid": "5b308d24-7fa2-4544-821e-37fb27e7eec6", "comment": "Malware payload", "value": "216f39c3e738604521572c21ab4a623821985bd9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770388, "uuid": "b089679e-e927-46e6-bad1-9ffee834d559", "comment": "Malware payload", "value": "2ff10ed4114a61a4d31df45bcd7d9502e01e650d854dd3ebfb1e0399f59d514c5c350ea0774ba60b41d303824c4622c3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770388, "uuid": "b8336856-4631-4434-b692-d6b4ce9ab3f9", "value": "T192F40102EC85C997F715023557E99C8243FABE611F209C0BF1DCB6EE1A375B14B72626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770388, "uuid": "c20c1099-ae55-4beb-aabc-0a5d4e8aeac3", "value": "12288:v8a3REsIUg8VfV2uyqFzu4L0MH3Xp6sTlZuoBniEk9GIHLEK:kaB7IUnVfV2izu4L0uJ6s27EksIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770388, "uuid": "26acb251-ed7c-4c0a-b4d7-c8015a71d798", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770388, "uuid": "623ada3f-7149-4864-a28f-aa9da72a0114", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770388, "uuid": "af065bdc-b750-4eaa-baa2-285edb99a64e", "value": "Quotation.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b4f27c-4055-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720792228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792228, "uuid": "56142af2-c4ef-43b5-9a7a-787ad05642b9", "comment": "Malware payload", "value": "49a7722ea3d588753a6f90f9a094b84b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792228, "uuid": "ad931add-17b4-40db-89dc-aa9fa7e43b07", "comment": "Malware payload", "value": "0330970ca33b5b0d80e6ac151befc97de78a52135a2e08a907b2a1cd701869ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792228, "uuid": "d37657db-987c-45c5-9d32-77d676f737bf", "comment": "Malware payload", "value": "d21bf72dcbc6fd58ed9c11baf119d13df2322273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792228, "uuid": "7549fe01-6d80-46a0-a5bc-04d2329664dc", "comment": "Malware payload", "value": "c44a0988950d35309d5af570181a7d61024a56736f3e58eba91183ff7bd475f0bd654ffcb215d54612723aa5fe3415e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792228, "uuid": "0c88979f-d88c-4a98-b362-e2c5f2af1ee2", "value": "T10DE3E07725F55A1FC8406678E8C70BAAB0BCDC53EF5F96476A14AA347E363C44812A8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792228, "uuid": "e56223ef-fc33-4530-b7cd-7c4b6e560735", "value": "0d2c1bd59011bde94da10856671eb87f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792228, "uuid": "c640d1ea-f4dd-40ee-a572-0384b691d2e6", "value": "3072:RDuXGSqulL9lKT0ePKfQWQJZ3nIQdVENFEX3TCmFyJW:s0ulL9Q40K8JZ3IQdZD7kJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720792228, "uuid": "1df506d9-a486-465a-9e3e-cae25ad44927", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720792228, "uuid": "9ab24c6f-f880-4896-ad70-ff54668a2c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792228, "uuid": "b61512a2-b643-4dd5-86be-719a2b200594", "value": "SecuriteInfo.com.Win64.MalwareX-gen.15091.20507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d97eb100-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774254, "uuid": "f56dbed9-14ba-42b8-916f-c99d8ec5e370", "comment": "Malware payload (StrelaStealer)", "value": "174e0cf6e24f363f9b58317ffe6e54cd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774254, "uuid": "78c8d794-844e-4aaf-813b-748a0e3f9503", "comment": "Malware payload (StrelaStealer)", "value": "03fa08d7f397c92484e0305f1dc43be610b47ab2204ea6b376171d779a06a6c5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774254, "uuid": "c0f6473d-9471-4698-b0a0-c275d2dc8126", "comment": "Malware payload (StrelaStealer)", "value": "559e1be1644e6722aa972319aca74dfdf3ea82de", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774254, "uuid": "c42a7f83-6809-4a33-a2ff-19b0ec24af9b", "comment": "Malware payload (StrelaStealer)", "value": "90dacc8ae6c802c44876ccd10f052391b878f1f5aff8d86ed357a2153738ffe347e856cd502240825f2fe3c62a4be38b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774254, "uuid": "18426704-02ec-4079-8e23-38a53e9205a4", "value": "T17741B3D0CA3D14FD9CB9984B379A6B82D165C92D6543E04EDCFDA984DB5C4ACB01CC47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774254, "uuid": "95eaba43-3098-44ce-97b5-ed45768bb116", "value": "48:PyUoLzsp/MNibwAUEUenxgSGRto1lOVRLX5sR1boXnO0Q1Pf1B3:A3G1fn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774254, "uuid": "c9b3e410-4dc0-4947-ade6-a2d9b18e2ca9", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774254, "uuid": "c57fe3b8-296d-4528-8b6f-1f56983d8be3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774254, "uuid": "79b06c4f-7d7b-4f29-bcad-033b1516ff9f", "value": "1341712860234816463.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb569af0-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720769506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769506, "uuid": "ebd16771-2d7e-4e9a-ad80-8e5500ca7b7d", "comment": "Malware payload (RemcosRAT)", "value": "a4ada4d174edbc7a29ab1989d365cb08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769506, "uuid": "caa1016a-6f77-4870-9d7d-159c6a124d15", "comment": "Malware payload (RemcosRAT)", "value": "054a14f915649b7812d6677bdc110a078570d23417c8fcd96dcf67f7546a4bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769506, "uuid": "e03ed7b4-3060-4a85-8671-4eb9d985efee", "comment": "Malware payload (RemcosRAT)", "value": "a8a5785534b6a05c0fda182ecad4c324c5255b31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769506, "uuid": "d7fffc18-5479-4b32-b316-771c13a5bb5b", "comment": "Malware payload (RemcosRAT)", "value": "33e3c054ed744ba7a582d25fefef78bd53ee9a5d49ca15f4a960e2ad6c36154427001bf36fdfa0e44e219d3fb7e4bc92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769506, "uuid": "473dc0a5-e9f7-4589-9c8f-60248fe944d3", "value": "T1BFB4F0515106F5A6D5218AF06BF8CB7C0FAA3FCB2847D145EE97BE6D7832342029E4D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769506, "uuid": "b7b5654d-61f1-4a1e-aa21-4c7b193470ca", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769506, "uuid": "84397086-1e69-40b5-9155-7ff2950086a3", "value": "12288:R0Nwzz8LtOAbgfIEYD0qoLjfZTU2V2kkN/4zY9U3Bbv:fzzSOAbP50BLrJU2Vn2/UR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769506, "uuid": "da7a5210-a7b2-447f-9955-f45a2e7a3ac9", "value": 506088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769506, "uuid": "a624648c-30be-48e0-99fd-2b4ab9aedc50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769506, "uuid": "cd924d61-4351-4bb3-9925-da022dec552a", "value": "IT01879020517_uGIim_xml\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b834425-4019-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720766419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766419, "uuid": "597ec408-2411-4479-95c3-ea5f4bcd3dd4", "comment": "Malware payload (RemcosRAT)", "value": "7921681c6200952fdf2db1a77381ac24", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766419, "uuid": "e498cf01-b281-400a-8d28-b5d263a15427", "comment": "Malware payload (RemcosRAT)", "value": "06051fcdf49ca8dc96fecde6f1477cde2994a01f899ea063072e3c77789845fc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766419, "uuid": "ac4dbad3-d0ee-49f1-88eb-3a95e825b4e4", "comment": "Malware payload (RemcosRAT)", "value": "96e6385fc9c0b8b485eba5bc8f45420ea84b38e6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766419, "uuid": "81f702d4-7b77-4c4d-97a4-55323aee0171", "comment": "Malware payload (RemcosRAT)", "value": "ce1e8513d75190b29782b84ea1129df4089db3e22b5d37dda93e71ca6e6354b74af720aa2308dd640e165920636869b8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766419, "uuid": "99df7125-586a-4bdf-bd85-710bea63a650", "value": "T16AE39E4663EE4108B5F76F589A7691344B67BD99AD7AC25C008CA94E0FF3E40C970BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766419, "uuid": "56aaedc4-1398-472e-bdb8-099d53febde8", "value": "1536:yZccvQGghdpPZp+ogsUJW4Wrle/PhG+/kery+bGsvky38sv5HnIgs:QghdpP+og0S7e9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766419, "uuid": "5e656ddd-805d-4a06-be7b-34566fb4e951", "value": 153842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766419, "uuid": "f99f6d93-3bad-4d91-9d27-3fbc141caab0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766419, "uuid": "4236cf92-ff1d-409e-916a-c0499bd6c30c", "value": "crosscheckrosefloweronhairbeauty.gIF", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf227c8-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720773854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773854, "uuid": "767f589b-3646-47a8-9961-f362bd6b0fa4", "comment": "Malware payload (Formbook)", "value": "d67825bcb9dac14a0d3f6bc54de023a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773854, "uuid": "c06993db-2ab6-4db0-a76d-c33b67fb987f", "comment": "Malware payload (Formbook)", "value": "075c3cdd24b65c7237271228a2757a4880e778d791689dbaf1652068cc032b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773854, "uuid": "3ecb49c2-bb81-40fc-877e-7d6eba5b7407", "comment": "Malware payload (Formbook)", "value": "953e7d8648012147dac67223af2ca3fc92d84225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773854, "uuid": "7b7e0713-cdf8-4bf3-8028-d80ca0c57520", "comment": "Malware payload (Formbook)", "value": "8b6b2e924049f49683a7747dc76669a9b256505770079b0a99014edd822cc60455400741d310599ecbbe8a376d412a9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773854, "uuid": "ca87b1fd-e74f-4b5b-b879-bb6c580e1441", "value": "T1EA45BE0273D1C036FFAB92739B6AB60556BD79254133852F13982DB9BC701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773854, "uuid": "9585aa2d-5a22-4519-933f-d52e114dffc0", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773854, "uuid": "23ee7cd7-9992-4465-bbb0-fe4fec2dbaae", "value": "24576:nAHnh+eWsN3skA4RV1Hom2KXMmHaXOwNNTNu1PxdWJsY/z5:ah+ZkldoPK8YaXHduBLWJsYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773854, "uuid": "a1efc714-6d4c-4259-94d5-7de3f31b6054", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773854, "uuid": "2aaaf1bd-aacb-4f9d-96bd-b6598ff5f8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773854, "uuid": "287c6cec-6ff1-4cf2-8a16-1eb7b24fe2a4", "value": "PO RFQ-HL51L05....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9022e673-4098-11ef-957f-42010a9c0016", "comment": "Malware payload (AsyncRAT)", "timestamp": 1720820946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "1dde450d-153c-4547-b5da-e294c02ba745", "comment": "Malware payload (AsyncRAT)", "value": "0de5b94b56fbfabfadb685d981e5ddf3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "00be829d-544c-49a7-b400-05697230b479", "comment": "Malware payload (AsyncRAT)", "value": "07d846946a8e0531e4f8ee0fe1056ba265f1d2da017f32ffbb4cf65f82199a55", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "68050420-97ba-4d2f-a71c-ae5581902675", "comment": "Malware payload (AsyncRAT)", "value": "cec8aabf31a9b99d090f9a28cd6bbfeaef5dcd6e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "39e63693-ea43-4a42-abdc-3c4a01a039e7", "comment": "Malware payload (AsyncRAT)", "value": "150c58fa4386033948ba7ac9ae1772bd0bc955676aced3093950ee44e5010ee3982b72592361615b938822faab316d6c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820946, "uuid": "78bdcfe2-2b01-4b7c-9b68-af7732b870f1", "value": "T108236D403B9C8137E2FD8BB4ADF296418275D1275D03CA596CC855AE2B13BC9B6036FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820946, "uuid": "4c2c980a-bb08-4bde-9838-886d963737dd", "value": "768:dRZSfTKR6Wf3f4aZDIUo0ZWn7V5Nt4YbpgeL2RivE3K/JVv9a6KR:dRKGR87UtZqt3bmViGkJVv9alR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820946, "uuid": "4d2b3a59-1c0b-4c61-8b34-8ef6741e84f3", "value": 49156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820946, "uuid": "3889cc51-98b2-4be2-9c40-03ea2f0b7cbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820946, "uuid": "fc729e89-f1e6-43c1-855c-204f0a6bafce", "value": "1720820945b578c3ae8c0f4d9b9878e4f484666e05b17e95026efbdc3c95c433292c116db4128.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9078f730-4098-11ef-957f-42010a9c0016", "comment": "Malware payload (QuasarRAT)", "timestamp": 1720820947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "46a13001-53c1-4ecd-a9c2-b1eef8048ca0", "comment": "Malware payload (QuasarRAT)", "value": "80f17cd6ab06199c2accbe3a97486949", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "4712936d-f820-4cc3-aef4-fb91cc835880", "comment": "Malware payload (QuasarRAT)", "value": "097f800cca7e0ea57b1f9e8b934dc9c450ac9d5b437da9da26deb66a503c446d", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "f8bb1565-ef57-4946-89e5-bac52e4eb8c8", "comment": "Malware payload (QuasarRAT)", "value": "c61390cbb85f37abfc776aac41c65682418ed0ee", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "16f59992-253d-4cba-a626-705a59080b0d", "comment": "Malware payload (QuasarRAT)", "value": "f000bafc7a2c35576d8ffa72d7bd1fa37a93b7bf039a0f4734e74ba2f2360fb83580233d688a88abfdac02b2ab3d7820", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "aea4d79c-8d40-4b7e-bf27-42ddd3a80e07", "value": "T152747C2377A8E93BDAFD8739E03206155BB4D617B616F38B5A1C51B82D333819E443A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "5fd8b23d-1449-4835-a538-72b938484b6d", "value": "6144:bxlMJmfKwiDsAykUbKW6BeENwVv/QTg6ILiE6qWae2uGR:Vkmys9kNbsIxzvqWC5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820947, "uuid": "d1e95949-6813-4484-9e91-323f859acd34", "value": 370809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820947, "uuid": "7d7194ef-5b92-4150-bbeb-b892ca17a7fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "aa5090cb-681b-49b7-a45c-49c0af9bab27", "value": "17208209453ee42a6a293df81d52150e4a00134cc41af7a60a9c6256abf0b32ed6793a3329933.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e296489-4036-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720778772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778772, "uuid": "e93b3499-cdc5-4ea8-8688-48cdec5a74c7", "comment": "Malware payload (Mirai)", "value": "c50312e8d65b9b2fb191a2b1398eeb33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778772, "uuid": "c87edc2f-102b-47bb-876f-dea2bdc43917", "comment": "Malware payload (Mirai)", "value": "09b0784978806d99b1f2d911e986fa8393f6d9694dffe36437f559bedac0b0da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778772, "uuid": "e7f56ccf-54cc-4595-ad1f-7e508e8f5f58", "comment": "Malware payload (Mirai)", "value": "0b04f10f61b065b1cc00b74316fb3ec394cf50e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778772, "uuid": "fef073f4-54cc-4565-8fc2-f15ca30a9d03", "comment": "Malware payload (Mirai)", "value": "c45996ad16048f6076c0010c8e12d6096bda9210c1feb8a6356654abaa80a506f270874584b2bc391ed18252fd6bee78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778772, "uuid": "e2a27316-28ce-45ef-9376-dbc4832a0896", "value": "T1A6E3B34DF964AB29C7E332FEFA5902CE322A0B9CB3EA70219E344B5537C9F555935120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778772, "uuid": "f5277c0e-b508-486e-bbac-47a2b788f325", "value": "3072:wQ3qOg+N/ljsKkuRMSRZjCJl5w9mUYhqgn0ZeRahSO6Ev46n:wOzYuRvRZjojumUYhqgnEeRaQC46n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720778772, "uuid": "de91925b-0a59-4620-845e-125a91ce62d6", "value": 146980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720778772, "uuid": "c5c77ecd-564d-4d07-91b1-5b7385c4ea2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778772, "uuid": "c077767e-468c-402a-9616-86b0904fc74e", "value": "c50312e8d65b9b2fb191a2b1398eeb33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c261de-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773488, "uuid": "3c9d3b60-429b-49e6-a413-e4dc808919e4", "comment": "Malware payload (StrelaStealer)", "value": "aecbde8208f32ddd3e94a1bb6e29ab08", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773488, "uuid": "4c16c318-01ca-43e2-84ac-fa90d7dc3925", "comment": "Malware payload (StrelaStealer)", "value": "0a06700828c78633a9a6872cfd06ad7adea01a9d5b8f5e3ddbb84d91635c8210", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773488, "uuid": "23bd72e5-3b43-4ec6-adca-c5e51e3935d0", "comment": "Malware payload (StrelaStealer)", "value": "76d58feb0b18eae6b98b7522dca5c90df780cdcb", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773488, "uuid": "6a851626-4e2f-479c-974f-227cf5e010ae", "comment": "Malware payload (StrelaStealer)", "value": "c08806c113719ba0563237ef3aef7536068c4be5e1f563ae01d6f737b34802457ddf3460d1986123ddb6ffa9cd4e1573", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773488, "uuid": "655ef1ef-fc2e-4860-906d-20de8dcde396", "value": "T11241F5C79510FADB380AF156F8B4455353D584303EC2E08CFA683FB6F1A8E6F490A066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773488, "uuid": "8f42fb15-9d9e-434c-ae29-0bf60ec2910f", "value": "48:/A3dt4n8/l1w96Vk6ZTYvZNnK8fcuD73qootVNsKSqootVNs0zwV:Gdt4hBNnK80uD7aootRoot9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773488, "uuid": "5e893e84-7944-454c-8397-9045713d88e8", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773488, "uuid": "1d38daef-3536-463a-9f31-4d553fccfb3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773488, "uuid": "6e9d0823-f327-4f7f-9b4f-2597a88ddb1a", "value": "0a06700828c78633a9a6872cfd06ad7adea01a9d5b8f5e3ddbb84d91635c8210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ceb9aa-401f-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769071, "uuid": "5e03ba7f-575a-430b-9fcf-f3740dce6e95", "comment": "Malware payload", "value": "99400fcdde887927df2e6ffa56c4dc84", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769071, "uuid": "e088dc02-5343-4778-bc51-1ed38cd06ad2", "comment": "Malware payload", "value": "0a6b11d2843feb74d95cc3f518533d1afd76e44de013633910daf1fee0d65856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769071, "uuid": "0c3cab8a-5554-4605-a440-b4c578262b77", "comment": "Malware payload", "value": "c0eb68afc3f5f30f4af6a3304d2afc33f2b068e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769071, "uuid": "c8118c3b-4227-476a-939c-6b059e0611d3", "comment": "Malware payload", "value": "2ebe5fc99569ae069495b45899f16a442812a88a6894af83dedb88e81134ba9b6172771acad7cf63a25e10189f14d50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769071, "uuid": "fd0c33cc-9430-4937-a136-371474317f76", "value": "T1F5722B47B7A649FEC13AD13CC9D34929E272B852572297CF53D1062F0FBA3D06A36905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769071, "uuid": "942f4eee-815f-40fb-9f76-6c0bf71ccf69", "value": "5510b70a8b130b6154967b6f86ff2743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769071, "uuid": "abf7f39a-6986-4088-ad9b-68e33727eb64", "value": "384:LICaWXf8s2WDQZ/f8GrCwfGJfegOD2lEg3d+gV:L/Z8iDQZ/f8GtGxegnlb3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769071, "uuid": "134b711a-43b0-4259-af11-dfbc1fc4e218", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769071, "uuid": "78f3bde2-d19d-45ef-951a-ea3c582694f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769071, "uuid": "73a29cbe-c0cd-4ef3-88fd-5c68110fb3d4", "value": "SecuriteInfo.com.Trojan-Spy.Win32.KeyLogger.3698.29139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b630fccf-4045-11ef-957f-42010a9c0016", "comment": "Malware payload (PureLogStealer)", "timestamp": 1720785362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785362, "uuid": "cc3c0550-b7b9-4ed8-bae6-3c6d224abffe", "comment": "Malware payload (PureLogStealer)", "value": "649d933b5573743ecc3407beb94f7cee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785362, "uuid": "7ab0e7fa-d0b1-4102-bf8b-f9c559f79b77", "comment": "Malware payload (PureLogStealer)", "value": "0a9ad0bf3a79d6344695b245021ac7939d4660b7099241013241210b88eaee45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785362, "uuid": "f83774e6-1629-4296-b4bf-93b94d79038b", "comment": "Malware payload (PureLogStealer)", "value": "8da727158ebb15289e5d49c404916e2ab1e9419b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785362, "uuid": "6170f4f7-c3b7-433e-8ca7-8985bae23fbe", "comment": "Malware payload (PureLogStealer)", "value": "e141ea459bdcb3252e345f9642cfecc42c56e4f11b10fc3a1db96f3c961c8e78d18ee9af85f17d7b6c676671f33fe497", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785362, "uuid": "d9ef5ef7-58aa-45b7-92c3-557652e2bf9f", "value": "T14072E61C93889B21C5EF057EC9F367440339A6961753D76E3CCA6AE76F23B821B05A90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785362, "uuid": "66acb99a-c3e4-4646-a4dc-95fb2f50335f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785362, "uuid": "ea58107f-f5f1-4451-abd4-2ab850b80d5b", "value": "384:ar/l6ju3GtlhMZ/ftkezdz5Woy+Sew4uRx35:ar/wxThMZ/1BWnQw4uH35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720785362, "uuid": "847939bf-af84-47fa-b6fb-34aae06ab52e", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720785362, "uuid": "ba6f6648-960c-4c61-969f-ca8423c96790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785362, "uuid": "fe492bf1-3b38-429b-a5eb-d4dcb78a7b99", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.987.3852.14194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf239d1-4018-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720765749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765749, "uuid": "a26903fe-80b2-4bfd-bf45-bb1574134223", "comment": "Malware payload (Formbook)", "value": "8e9b751ecbb040e9893199329566c826", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765749, "uuid": "14ac71f8-a646-461e-9514-2ef0f0919daa", "comment": "Malware payload (Formbook)", "value": "0b2881dffc8cd0c36764d955f9478964c95822672da0f5ba29a5af5c16059b16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765749, "uuid": "661a0d62-05a3-421c-b6ed-f925e31f7fe9", "comment": "Malware payload (Formbook)", "value": "dee40b465783386a418bd5c4dc529b07659e1827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765749, "uuid": "fc28d877-5db6-457d-86db-72e1bb94ab24", "comment": "Malware payload (Formbook)", "value": "88d90450d92efed1d39b025029cede11495e01b4c3c9f2adfdd9f6456b323efe0e0eafc1b96a28680de3e898e415f1d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765749, "uuid": "c1accfd9-4bbc-48ed-a974-daa802691aa0", "value": "T1B5E4F19423BC5F13F4BDC7FAA8A5540503F6B51A2931E78D0DD260CB2976F804A52FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765749, "uuid": "b82c5555-a0ff-4d78-87ba-82b38ffe2629", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765749, "uuid": "4344adfe-fd68-4b65-90e1-9812c0279852", "value": "12288:BnMN4Np0xC0eQiLEX6e51HHZt12FhT0g5kklyEhxcN5GJohLTo:BMN4NpECrREX6e51ZGhT6kgEjcNwJo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720765749, "uuid": "fef85f62-9530-4761-9e62-e78319e32675", "value": 697344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720765749, "uuid": "3532217a-f6a3-4a16-9928-b248513a0413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765749, "uuid": "266f8ccb-2afb-4e27-92f4-1e0cc4bf5b50", "value": "vNrcPvMYLZmn2cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f85d1ebe-4064-11ef-957f-42010a9c0016", "comment": "Malware payload (PureLogStealer)", "timestamp": 1720798787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798787, "uuid": "2a6067a3-d76e-43bd-9d9a-6cbe06294a31", "comment": "Malware payload (PureLogStealer)", "value": "23cad24465d730936b5c3d2b7de5bfd1", "object_relation": "md5", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798787, "uuid": "bbb71bff-3788-41b6-ad7d-0cfb592c753b", "comment": "Malware payload (PureLogStealer)", "value": "0d0c3719afef2b4f8c02dd291702a558008881e49df5d47c1c76c12f070b9f37", "object_relation": "sha256", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798787, "uuid": "b7e82a95-4c6e-4686-a32a-2ad9073facd5", "comment": "Malware payload (PureLogStealer)", "value": "66e8fa9f4ca2e01281826f2e9f304de4a6ba0c97", "object_relation": "sha1", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798787, "uuid": "c27367aa-ad8d-4c67-9afa-5dfad226ed7c", "comment": "Malware payload (PureLogStealer)", "value": "ef3ba92ba00c35cc85380fef8f575fae44fd18c19fd46a979ba0ab3c444e267cf18d0069d49b2c87c94bcdecc77b021a", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798787, "uuid": "6767f07f-3e94-4a6e-9b0b-986b89703f54", "value": "T17DB3123289F51A1BE9ADB0BCDB594DC1A52FF0E1642C219DE648AD38FD43BC64332A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798787, "uuid": "abce07a7-45cc-49bc-91db-78c765836a00", "value": "3072:vL5xU6ADGGQw8B6LCgvdxmyKy5XptysjihJA/vzsz:vLrwEBICgvdMgXjnjIJ4sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720798787, "uuid": "f09289c7-b539-4d2c-98e0-b2584b3e5ca6", "value": 114800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720798787, "uuid": "a07f1e59-c21a-4747-bac4-3415e4d915df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798787, "uuid": "60bc2245-9d16-4ad3-bd48-d13a489d2df4", "value": "23cad24465d730936b5c3d2b7de5bfd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3104c7e-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789330, "uuid": "7d37fef5-b354-4ca0-a705-039f75db16f0", "comment": "Malware payload (Mirai)", "value": "6097364436a152f1e5de49bcdd7ec3ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789330, "uuid": "9ccb750e-c7e0-411b-acef-1d1c8b3116a1", "comment": "Malware payload (Mirai)", "value": "0ee08f586d00649af8a141525e6136c77af90abdd691fe61fbb4d105fa494656", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789330, "uuid": "8ba7c6e8-6f4f-4d32-ab87-31c1efd2e55e", "comment": "Malware payload (Mirai)", "value": "0bb4b796f008a91614cabb2e8cebbf9fc5ea3f22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789330, "uuid": "31aef694-53c1-4621-ac7e-f6fdcbf9b518", "comment": "Malware payload (Mirai)", "value": "10a6ac25816a5b62ec4a6834475593cbd85b1f297ddc70cc7e80260739e7dc4ee2dc9e83791063db2f5fb1e3ace00a81", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789330, "uuid": "9b3a3c20-1e64-4cd2-a3c4-c5f50d12dab4", "value": "T1A9633B41B8859A56C5D412BBFABE01CD332563A8D2EF32139E216F1437CA81F1D77B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789330, "uuid": "6f3f3808-1a93-44fc-804a-f863ffa237fa", "value": "1536:3AZpJDqNYfQT+QQGmddKbT8rEN1LmPv9aLZ7NgFdbqxSI5:36pJd4T/QG0yT9xEwtxgFsxSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789330, "uuid": "83ab40e1-bdda-4221-bef5-d35325cc5be5", "value": 70804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789330, "uuid": "e1fc6670-c685-4e03-856d-2643338f3975", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789330, "uuid": "3461a7d5-df8a-46d6-85d8-72a899c500a2", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb25344f-4017-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720765721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765721, "uuid": "c12807c7-1bd8-49e0-b4a5-68f95478d773", "comment": "Malware payload (StrelaStealer)", "value": "190ddc5ad2cf99604d7b98fa133595c9", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765721, "uuid": "203ab51f-d09f-4d24-af67-bafda8e8ec69", "comment": "Malware payload (StrelaStealer)", "value": "0f984ec3b5eeeee99a5c2bb1fc100c1ae65491bfef23c36884a2ce0af3eb5b42", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765721, "uuid": "116d7626-9648-41dd-9204-c915c727b536", "comment": "Malware payload (StrelaStealer)", "value": "ac5f4778d1ce1367cd8951c8daa90c509fa3d65f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765721, "uuid": "eec4a017-8427-43d8-b0e2-dfd25bc6fea8", "comment": "Malware payload (StrelaStealer)", "value": "76e0eebdaeca9eff9fed21e26b5ac64bc2eb6e78dc6e12b8ca9349ea99940948df0d4ed54d63d4e12204d744d1c1a9a1", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765721, "uuid": "ef594a36-1901-4955-a7d4-385df6b23708", "value": "T17341C4D4A62C463E81412848F1455BE604E6FC6095D3FEADAE8B20C7D36D4BDA4C973B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765721, "uuid": "48707a56-6e78-4914-a002-467903d13b5c", "value": "48:P9PuWCrQ5b/k0H//yNhJXZRWdTGHEaau0dTGHEaahEZ:PJdC8mPla6HK6HcEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720765721, "uuid": "4fbbcba3-174f-411c-98e9-6799f928442e", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720765721, "uuid": "e75419de-e98c-48f7-928d-c7b96c021fab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765721, "uuid": "f4402356-3120-4a35-8c65-258c3baa9ef6", "value": "461533101808126305.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acf4c8f-4019-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720766203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766203, "uuid": "c813c14a-c352-4ba6-9a78-899697a9e948", "comment": "Malware payload", "value": "72070b165d1f11bd4d009a81bf28a3e5", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766203, "uuid": "07b6a161-fb89-454c-a3c8-c0401cab16cd", "comment": "Malware payload", "value": "0faddbe1713455e3fc9777ec45adf07b28e24f4c3ddca37586c2aa6b539898c0", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766203, "uuid": "2ab744be-6515-4a7a-a968-fd8b37bd2429", "comment": "Malware payload", "value": "3872c38625ca62de3bcbe29740c1a0b8921fcf48", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766203, "uuid": "013fe569-e6a3-4e25-8d48-365f1d7e6c69", "comment": "Malware payload", "value": "c928322e39c0b54f1aef5e0eb876f6671016b79b50be24a44ddc07b2b436152470c8d64cc8ac9af286207353d04e77a6", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766203, "uuid": "8d99c196-cc5c-415a-a99f-ef754c17ea53", "value": "T1E684F11B73A000BBD5778338D8935A42D7B77C1446269BAF03A0476E1F67784AE3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766203, "uuid": "e90dbd69-7a0f-41ad-b5d6-2309de907e0f", "value": "be777e91e3c42ac62471cfb7239be471", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766203, "uuid": "f960f46b-a41f-4cfc-80da-a8a7083c58fa", "value": "6144:Ry5L0D/GsA39rcUV13JlGhR3r9t1CozqP0ICuznw0SzN94NT+:05WxA397Vn4hRbXMuIfnwbQNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766203, "uuid": "53847d41-4486-4bea-8d9a-510a1eea7d0f", "value": 394256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766203, "uuid": "4fa7c00c-7bc5-4b7b-b362-3296f5fe8f04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766203, "uuid": "89ae2233-1542-4056-87d0-fd3b29453aad", "value": "0faddbe1713455e3fc9777ec45adf07b28e24f4c3ddca37586c2aa6b539898c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d61583-4011-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720762784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762784, "uuid": "0d772c9f-ad3c-458e-9248-95d4abd8ca7d", "comment": "Malware payload", "value": "3d2fb2e111412d2d844d223b79fb5c99", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762784, "uuid": "fb23b7b5-87d2-462b-80c1-ae8b999018e5", "comment": "Malware payload", "value": "0fbb21dd4fd0e0305b57e64f18129682a0416cf852d6bc88b53960e6b48603eb", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762784, "uuid": "08ec7f45-64b0-455f-a4fd-e7397f0cd106", "comment": "Malware payload", "value": "bc269330c84dd786384738712f98c0edf9a47917", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762784, "uuid": "20211edf-bb48-406c-86a5-0d6cee134a5f", "comment": "Malware payload", "value": "2136df081cc543efd81445917957c2e7225ff373dc86291fe0fa3cb45b1981f4a759360b31c126dcf3348f48720cc96c", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762784, "uuid": "c90b29b7-b012-4572-84c9-819ed62d0480", "value": "T11BD4E034F3D3D698EBAB803E843E7D77871DB4E2A6C8158319A70D209910F35AA175BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762784, "uuid": "54bc1aa3-acba-4e96-ba18-8dbdd3a7f80d", "value": "12288:Gk6EWzQbUt7KIFeFTzscStmtRo/pqLayo1k+bsLiRKZQ0oJz:GjEWzDF8rTo/UKoKWQ0oJz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720762784, "uuid": "fbd2d4f0-84a2-40f5-a03e-7ed05629c354", "value": 621112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720762784, "uuid": "305b969b-5049-4c70-9852-e74770e75624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762784, "uuid": "9d938365-8813-44bd-a105-fa806e55ce9a", "value": "faultrep.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b7073f-4047-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720786004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786004, "uuid": "f3956f22-5ec0-4c16-ab94-68fb81df1627", "comment": "Malware payload", "value": "e1d70bb9d5c6045dbd8e10f544a8ab70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786004, "uuid": "81c599c8-bc42-4964-a31a-f8da247c1fbd", "comment": "Malware payload", "value": "10d5759fa3899001aa1fd20c4adec01792bbecb2046886a7cf75030c10f58dd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786004, "uuid": "9ab15b98-4c5c-4ea2-9258-425bcd48b99a", "comment": "Malware payload", "value": "b5418d7f5311f78eb63531c4e21d7ac085399ed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786004, "uuid": "a84c5aae-6956-41d0-b23a-bf1cb3a66a54", "comment": "Malware payload", "value": "cf69b5c93ee31cc124b32f7968ae9e2b9bed0d4dccaf4c5511221c5108eb747e72a80255e02506746564587b4a1717dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786004, "uuid": "0f2ed7d7-a8fd-4c12-839a-803351de1e32", "value": "T1E845BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786004, "uuid": "4a5ca62d-002c-4e4b-b4e8-c4b200df670e", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786004, "uuid": "fdb1a4a5-f6ec-40f5-8a4f-88e8e024f187", "value": "24576:7qDEvCTbMWu7rQYlBQcBiT6rprG8aLn2Sbly7TWEPje:7TvC/MTQYxsWR7aLn2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720786004, "uuid": "aa99f817-5d96-47a6-bddd-28d15ff08ee6", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720786004, "uuid": "b20c7b80-c7dd-4cb2-aa7f-e5e2c5bd6f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786004, "uuid": "3b6e8c67-b618-4c54-8ab6-59dcaf4ce8a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6649053-4047-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720786248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786248, "uuid": "ddd5a0a7-d862-4cf2-9a62-722c7753678a", "comment": "Malware payload", "value": "4d8a3573e74cfe7811de1d89e708ccd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786248, "uuid": "3a37bb47-b4da-4f67-bb16-f44dad6703ed", "comment": "Malware payload", "value": "120d8d66e0ed9f6a32f4a2e90546b145460ba79fd2668e9897ca262a4e27ec7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786248, "uuid": "a6e0841d-e121-4f9b-a518-f3b94f8f31e6", "comment": "Malware payload", "value": "55af9ab459e6e691174da9bea4feb417bc9c79e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786248, "uuid": "7f858971-35fd-458a-8814-c9d22b65765f", "comment": "Malware payload", "value": "189aeff8d0ef77f8d5ac7ccffb7d4eee47f4a42e57bf9ed572e16c8dea344e834ba959f514b871612c6772647b71f3b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786248, "uuid": "276b2f1e-694f-4055-ae1b-9487423cf3c0", "value": "T1EAD5BF07D18440FCC49EC1B99747A726EA76BC890764B2CF27906B222F76BE09F2D754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786248, "uuid": "399f204a-1749-41ba-9eae-7cd2f8eb6f7a", "value": "a6c766a67dbe82f8695567666e9dd9b7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786248, "uuid": "5669f9d9-2a18-4751-9a98-1d26da3c10fb", "value": "49152:qJZwNWWyhaT2BME+0NSGm42F7keS15tB1ofewx2WhDeu0Rje:qPwNklSUjeSvtofeUey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720786248, "uuid": "15c754bb-0889-47c0-bfe2-865c6305b12c", "value": 2749456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720786248, "uuid": "3883d4b9-a787-4044-ab83-982171a2512b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786248, "uuid": "673e36c9-8b11-4909-bb1d-84703bc8673d", "value": "launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cacfb3e-4075-11ef-957f-42010a9c0016", "comment": "Malware payload (RaspberryRobin)", "timestamp": 1720805693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805693, "uuid": "a13ef41d-42dd-4099-8998-58af7e8d48af", "comment": "Malware payload (RaspberryRobin)", "value": "f01d915a0c569ae15a3b52f363f46bd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805693, "uuid": "af47efe8-58e4-432a-92f7-64320f34495d", "comment": "Malware payload (RaspberryRobin)", "value": "12324f72479e205a07231862c6a35a38d90ce51db986e4f95ba2a96a839d45c7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805693, "uuid": "0f630d4b-d0dd-40c4-bb54-1e21b060ceb4", "comment": "Malware payload (RaspberryRobin)", "value": "e601fb1bbbe7820322b51dc3bec847179165970a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805693, "uuid": "74ac8ce0-77c8-438c-b232-76fa2646262e", "comment": "Malware payload (RaspberryRobin)", "value": "ade0f3239c2ea13c0fb6b5193c48069756141d97265643dac9bcdeb1066f1ab322f315f61fad01ef1ceb8b69e2eb6d57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RaspberryRobin", "colour": "#B085E7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805693, "uuid": "0310b3c8-0ef2-4981-986c-110aaaf4e5a9", "value": "T150C512AEFD5E339DC92588FD376CAEC4D3C98181D1499CA8BEC0C5F54217864A878A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805693, "uuid": "5427c88c-45e3-4bbb-a052-710f487bebd2", "value": "a83940dda422779d7c5f5c051d3412bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805693, "uuid": "73d97964-536e-4bb5-a9cc-476fa93d6a15", "value": "49152:WzinmAzNkBw05wY/CpILVDt37N7LZV421RfaxqhuNLVwD6PC0ra:2itzNEjyY/CpAt37hvTJmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720805693, "uuid": "9b0af193-2ff7-46d8-8da7-456888a9dceb", "value": 2580480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720805693, "uuid": "3ce47aa8-b52a-4330-9e48-314081b4a92c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805693, "uuid": "63c0c19c-b521-4949-a2ea-c743702531df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efd93d1-400e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720761620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761620, "uuid": "23f1531f-492d-4a3b-bfdd-0916008b4104", "comment": "Malware payload", "value": "9441ee81236c508d5bef4a029f067e55", "object_relation": "md5", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761620, "uuid": "1c2d1e9f-fe7b-4b62-95fb-a1820fd2d9a4", "comment": "Malware payload", "value": "147e7953d3b54a9e8367d9e9670a4a182824f56cf30d35a315799a1953e5cdb1", "object_relation": "sha256", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761620, "uuid": "5402bf09-a1ac-4a43-9b97-015955f3f86d", "comment": "Malware payload", "value": "d0a7df0a2d363da176c569f20ad4756a72f2a066", "object_relation": "sha1", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761620, "uuid": "e69e397d-cd88-4382-a403-075ecdc982ae", "comment": "Malware payload", "value": "8859e280bb310033f54f65f732f7816c8c3b3ee3e5aa44f3929d96b2685bf91b437f06cf4d87aa2129b70aa218d7ee10", "object_relation": "sha3-384", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761620, "uuid": "00e61ba4-9a0d-471b-9df7-1614972ac589", "value": "T18F82A10439713BAF098B3EB38C6A7FB086741CF38577E3A15928B07C2924655BD1D1EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761620, "uuid": "f1531357-6de1-4e04-9d12-a49a3c41aaf4", "value": "192:bTxoz2Qoh/LvIdCurkHzv5Y2flOTSLg9Me2Z+WcdvRwqOf0i3IykU/7CcLOPpFB/:JC2QSzWA3ktg+prVSIsGdFBnuzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720761620, "uuid": "3636826d-de8d-4a11-8fbc-691867567e06", "value": 18868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720761620, "uuid": "9473e0a2-5c5c-4aca-a8a6-dcb0153be2d1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761620, "uuid": "6d49bfea-a4a3-4a43-8876-0887589b3e9a", "value": "147e7953d3b54a9e8367d9e9670a4a182824f56cf30d35a315799a1953e5cdb1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2320966a-4085-11ef-957f-42010a9c0016", "comment": "Malware payload (GuLoader)", "timestamp": 1720812603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720812603, "uuid": "ef7747a9-95d1-42c1-a547-60ff242df4da", "comment": "Malware payload (GuLoader)", "value": "4778e666c0776a614b0c3482a34874e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720812603, "uuid": "372f9859-f561-467c-b481-99c700899bbb", "comment": "Malware payload (GuLoader)", "value": "14f52da07995de5bd50d4ab4989741ffd5ced7f77b8c7e4c86f82939cebae8bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720812603, "uuid": "910f0300-d69c-4d05-abc1-a83d8976f92c", "comment": "Malware payload (GuLoader)", "value": "94055440790747bd0247a15e21cb64e617c1f0fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720812603, "uuid": "98dd2b61-cd4f-4086-84bd-ea18c4e92be9", "comment": "Malware payload (GuLoader)", "value": "b16f4f1ce17acaf093b7a00f74889d5bfeb46110c09d7bb831d8937db7be196fc4f432b8151d72e9bfcdb1256b89eff0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720812603, "uuid": "6dcffa20-d202-45be-969b-9351d5b5e811", "value": "T126D4D03071F09693D463B630FA6ED22159D1DC6FCFC2CA47EFA07E295DA2AC1065A50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720812603, "uuid": "4ed27e11-ab45-43aa-8c9b-68197ae6829f", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720812603, "uuid": "9602242e-14dc-45ad-a300-5ecde8acbc4c", "value": "12288:O2Vmby5Q6ItAfLm+ws1ypZEuFQ2o8cpFw:O28SQ6ItAmdjny2o7Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720812603, "uuid": "3bdabb83-43b0-4389-a43f-f47398da722a", "value": 633712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720812603, "uuid": "e1c38aaf-be94-4fe9-ba8d-28dc61e1735e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720812603, "uuid": "cb4591c1-0788-41c9-a2e3-a7f473e2e48f", "value": "Price Offer_1200R4 1200R20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d4f7f5-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773785, "uuid": "0f7e8351-aa75-42cd-b9dc-61620a032a26", "comment": "Malware payload (StrelaStealer)", "value": "06a0b61a247cdb50c6aaacb2c6c51d1d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773785, "uuid": "79c3f60b-f8dc-460c-af7e-20bf8672f783", "comment": "Malware payload (StrelaStealer)", "value": "1501815abed4422713c70ded415f92defa6605cfb534d3630e7fa5e99ee41947", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773785, "uuid": "0de995bb-6321-4aea-b7d5-4ea68ef09e36", "comment": "Malware payload (StrelaStealer)", "value": "e691fcb8e74edf1deafe96aafe20aa0dc60a6cc2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773785, "uuid": "66cb7844-904a-40e6-9f0b-483aeef63ecf", "comment": "Malware payload (StrelaStealer)", "value": "ce00d63c0cf66a68a10c5b9ce820001c87bfeb4f26b2691b8d005f9003da942723af9a0b52070a937e4c273db903cc25", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773785, "uuid": "261ac850-220a-4556-be07-b07401e7a1bb", "value": "T17B412693160D0F282442964BBD223216F3F3C7F63A60F7CAC475E889C40159DAB5AACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773785, "uuid": "253f6042-c92b-4926-85c0-c6ac5bcd4980", "value": "24:Rjh+D8K2tyGZA0PnLQYTdOEfE1EfEWTnE8KAE5qGlIdPdPdPjllZGlIdPdPdPjda:1IhNAACs+dOpqjCVhItttfqItttpa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773785, "uuid": "dc39474e-fab7-40ff-8270-d144ca9f0b12", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773785, "uuid": "c738098a-074c-4edc-9c11-4a0a70f4dcf8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773785, "uuid": "8c964681-dae3-44dc-bc15-e0215dc23b6c", "value": "14329809218230713.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f5eb22-4037-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720779072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779072, "uuid": "d750e08c-82d8-4c62-bd5e-3392f16071d5", "comment": "Malware payload (Mirai)", "value": "39c4d104285bf683d881855368b127e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779072, "uuid": "7ce221a1-4d03-49a6-b2cb-3a0f4841874b", "comment": "Malware payload (Mirai)", "value": "1654981f41a3d2d42fe2bedd6b366849866a1083b23704d6a217ee0c7a876fbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779072, "uuid": "8de26c5c-56b9-419d-8726-a5eed71b59fd", "comment": "Malware payload (Mirai)", "value": "e29d18e02f82f367f728a5686986714c5c46e8be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779072, "uuid": "3351e3d3-c730-4baa-9d09-0ad860dec122", "comment": "Malware payload (Mirai)", "value": "cbc14c7ca68977a0015027395a7240defbe5bd84ba43fc138686489ee67803556e6f336ff3a771f58efb6574033f86f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779072, "uuid": "fdcf657e-8cd7-47f6-be54-4cab4180aa23", "value": "T19FF38286BF903FFFD81ECD3742959B05129C99192295BFB62A38D508FA4B10E49D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779072, "uuid": "7370fe8b-20a6-4a7f-91f7-d77b31aa0f25", "value": "1536:TUdq3/BAhhsTVTjaaE0uJa5XqKn4v9GRbDrMfK20k5uqcElaCMrg:TT/BRTUb0uJOXd4v9G6y2HUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720779072, "uuid": "656b4c53-7f9d-4fca-ac80-6d3a4689945c", "value": 157408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720779072, "uuid": "0217d08a-f120-4dbc-88c7-383c68407319", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779072, "uuid": "3ae28dde-e97e-4904-8346-7afc59fa60c2", "value": "39c4d104285bf683d881855368b127e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1305fd6e-4019-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720766190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766190, "uuid": "c784c098-9619-4d54-a5fb-2185e16c9a26", "comment": "Malware payload", "value": "f062183da590aba5e911d2392bc29181", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766190, "uuid": "ce103aa4-78c6-49ef-93d9-c5e60c94262c", "comment": "Malware payload", "value": "166b6dcdac31f4bf51e4b20a7c3f7d4f7017ca0c30fa123d5591e25c3fa66107", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766190, "uuid": "8f501049-6a83-431f-92c9-e5a2717b907b", "comment": "Malware payload", "value": "ba6d77f358b4fa00dda5d0e2fdd21c761d154f95", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766190, "uuid": "a53b98f5-c8c0-4490-8460-6f91d00f3db6", "comment": "Malware payload", "value": "bced06474af2002aef0aa77cb090887454f29fcef80046b3b3528db6f2345087d88565ebeca39b61d6a56e52cd84b043", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766190, "uuid": "f1f8867b-d6fc-46a4-a839-8559fb96c768", "value": "T1DDC36B1B73A400BBE4778238D9531A06D772781047619BAF07A0866A2F637D5FE3EF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766190, "uuid": "e0470aa8-d0f9-49b1-a8a0-2a96cf70ec38", "value": "0cd7b92b97ccc7e255df1f46b5299986", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766190, "uuid": "acb13412-6662-4b99-83b9-12605395b112", "value": "3072:PalH1G0i90gNTx0IWm14glnAL93QwItaAy2dKNqs:7egNTxMm14gNtaydK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766190, "uuid": "5af64534-ee40-4b4d-9ad6-3211abcca319", "value": 127488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766190, "uuid": "4f154db2-3491-4965-bb36-f4b00136c233", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766190, "uuid": "5e88b69b-1922-4637-9174-47d7772924a7", "value": "166b6dcdac31f4bf51e4b20a7c3f7d4f7017ca0c30fa123d5591e25c3fa66107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02c3e86-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769434, "uuid": "c98b0755-2d5b-4547-9647-5925db27506f", "comment": "Malware payload", "value": "908ee64a744bbcbb3836dbf6db8f8b39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769434, "uuid": "98605e73-5be8-4f89-b64d-d666511de3ed", "comment": "Malware payload", "value": "16a7d6353fa23913a2f861fc152c390a9b7b0edd9dbb9999d65aba53c4827f63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769434, "uuid": "3d373c27-e12f-470f-b883-3bf1d3c4dc4b", "comment": "Malware payload", "value": "aa2bf620eb79966f3842f696aabf2db5925dcbe7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769434, "uuid": "764a04b3-3581-430d-a234-4408886c65bb", "comment": "Malware payload", "value": "5df129eaa30e99d3641b31cd2b95db8f8ae7fab01ca7a47fd18d7c8a31e21fe180be848e0db4d54cf18c432e934bc2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769434, "uuid": "bf00422c-eda5-438f-8a1f-9792299f8a2a", "value": "T17074CA5A7674A132ED00CA3419F69E11D2DBEE6C6BF0951924D8F66D1B322FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769434, "uuid": "aed944ef-bbce-4845-8375-faf4046c4c82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769434, "uuid": "a4d36abf-f6ff-4817-9a05-d129f5c04198", "value": "768:HjEMB+Q720zEjss2Hcg1Ijcn0sspAlpq8WLyg1uMN0+dzsR8+eE1:Ho++QLUWpqZLy0uyL+f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769434, "uuid": "21a157dc-2c7c-4fbb-8d4b-ce125ebe53ee", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769434, "uuid": "dc256a98-4caf-4506-ac51-36d49ffb0287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769434, "uuid": "a5ec7926-362a-4b38-b279-e2bb9b5edd11", "value": "QUOTATION_MAYQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c54342b-3ff3-11ef-957f-42010a9c0016", "comment": "Malware payload (TiSpy)", "timestamp": 1720749858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720749858, "uuid": "8c3ae9b1-df09-4275-849e-d6d0a36269f9", "comment": "Malware payload (TiSpy)", "value": "7c4addaed9dad7985951d81d377b7343", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720749858, "uuid": "299ef018-35a5-49d7-a8a5-5c05f00e2763", "comment": "Malware payload (TiSpy)", "value": "1733625b4976afb39f3c68bbd4b9b51695aff9810db15394cbae873909067f23", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720749858, "uuid": "007191f4-55bd-491e-97aa-1967ab0fd325", "comment": "Malware payload (TiSpy)", "value": "5ed8bf700cb6bed532369122760c5a09514e5cb6", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720749858, "uuid": "e845ce9c-6bad-461f-9494-a8e3b93c69e6", "comment": "Malware payload (TiSpy)", "value": "e30dc13cbb9097313b9527251c824f1502711ccc3146b81b819c53906add1aa346150c13911a040d47fc7e85503be663", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720749858, "uuid": "3fedd5bd-1659-44d7-ac7c-0aa8fce7ef4f", "value": "T18E06DE62F3D3C741CBA7927D103D7D3712558DE046C6A647241B3EAA26BAFB40A431BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720749858, "uuid": "91a93a3e-ed44-4452-9d40-3fe7e40a4e1a", "value": "98304:ylmK1/BjthXPCKwXaGZsOjFoMfGvzW8O4R25qGJ1:yTlBjTXqKaZshMfyW8Oc25qw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720749858, "uuid": "496ba2fc-05d5-439d-a2e4-46d59011e657", "value": 3848215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720749858, "uuid": "5b85f43e-ca1b-4546-82fc-6fcec5484867", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720749858, "uuid": "9fcaf0bd-876f-4fbe-bd70-f643bf48e200", "value": "k.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f76e290-402c-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720774425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774425, "uuid": "28758898-5d45-43cd-8c05-e36361bd796d", "comment": "Malware payload (Mirai)", "value": "bacddbcffbce76c70bf1db8a97ab98a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774425, "uuid": "8b11df20-8002-4efe-8b78-dbe67822d815", "comment": "Malware payload (Mirai)", "value": "17ec214d02664cfaa169aec635dd0fe41c811befa5c3412f63424f4e0a9ab3e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774425, "uuid": "1de11f36-3bc7-497b-bfab-fe2991c1f001", "comment": "Malware payload (Mirai)", "value": "061a6a83377de7884eb1c321e6efcc35fd5ab23e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774425, "uuid": "8dc9f94c-c8ce-44a7-932e-40d952a77b3a", "comment": "Malware payload (Mirai)", "value": "c648c3b19d81c376c3f8ec81b5a9c34222036166ed3cf9683bfc8a7dbf882b2d2a068b9f7c6a6949fefbd9f1be89c510", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774425, "uuid": "a9ab9f37-2823-4c33-bd7e-c864197b8d66", "value": "T119C2D1332AEF38B1C2A460B6FC7C86C7625F4BB965F16521765057A1CEE1003927A8F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774425, "uuid": "29c70933-aa57-47b3-954e-6df820a1062e", "value": "768:ijKX9vt6GqA3Q0jzV7EUyUq9a46s3Uozg:ijqtBqoB7EUByzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774425, "uuid": "b3887891-7e1f-4173-b5ef-15714a541f8b", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774425, "uuid": "627b0c8e-a79c-48ed-afec-989eb265ba71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774425, "uuid": "697e8af5-aa4e-4eea-90cf-07c166e22f9a", "value": "94.156.66.188-sora.arm-2024-07-12T11:13:31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a556af36-400e-11ef-957f-42010a9c0016", "comment": "Malware payload (LummaStealer)", "timestamp": 1720761711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761711, "uuid": "2188573f-ce5e-43ac-be02-25e3eddcf23a", "comment": "Malware payload (LummaStealer)", "value": "64ae8807b8359c84c00444c2cbab6236", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761711, "uuid": "c324cd56-bf20-4b4a-9f9a-15c7097e4a93", "comment": "Malware payload (LummaStealer)", "value": "1850a11acaede15b70cf7fc93830cd13ed4855f5e6226ef8110427fab9651ddf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761711, "uuid": "eac1fa8c-4de2-4150-bdfe-ca314cfab616", "comment": "Malware payload (LummaStealer)", "value": "db15781e8050dd032b0bd67315283089aef9dd3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761711, "uuid": "6dc3af46-1847-422a-a236-9ba4d26aff33", "comment": "Malware payload (LummaStealer)", "value": "64acab18a824833ff9aa398f14c79b3f464b038e89ff08852f57a4636368ef6ca9e0e36da366f00177fe5c7d9bf1dd67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761711, "uuid": "935870a5-a59e-4799-8a3b-3bad2e643805", "value": "T15EB4F10575C0C472CE63153209E8E7B97E7DF8300EA28D9F67A81B7E4F642C1963666B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761711, "uuid": "0fa0f1fa-9c57-4345-ba4b-accb2e66d832", "value": "54a5cf5c66bf4d0985703442865d04af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761711, "uuid": "56123b79-afc5-4f28-9fa4-e4295eb320f6", "value": "6144:K/YU8Hd8WCoWM5qcOotxvqzdCODY1eIQfHc5/mcYpTH5vQATH+2+dU739nNjp2M7:7HvComlwToHcfoTZ9Te2Lnb2MDaMScEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720761711, "uuid": "97f5f19d-9efa-42d3-9ea5-a0e14aa4bd84", "value": 530984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720761711, "uuid": "f4996384-0fa0-476c-8629-6c0167a80b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761711, "uuid": "5beff328-52a9-4c6a-86df-0194bfa6c90e", "value": "64ae8807b8359c84c00444c2cbab6236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e62d73-3fe3-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720743115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720743115, "uuid": "5a26f1fb-33e7-4b14-b2cb-296bd3461a81", "comment": "Malware payload", "value": "31113f00145ab7d3773884f091407bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720743115, "uuid": "870dc040-e972-4592-b411-b8e8a776a637", "comment": "Malware payload", "value": "189802cc7a8f5b8d260da48398835c9926b489fe0c1074e32dcf1fb3bad2e569", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720743115, "uuid": "a6474386-58db-428b-8f92-e760295b665c", "comment": "Malware payload", "value": "061d2d06ce1cabde79ee392645c3568df36fdf17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720743115, "uuid": "0318a360-ec4b-4005-8b1a-6857b9991017", "comment": "Malware payload", "value": "6a7d62b9399c057409f3c165921db545108f345eaed9ce827c606010686ec886863b821f95bb582fdd8d46f72e78c667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720743115, "uuid": "fb2c7e70-01ef-4111-9530-e214b3426191", "value": "T14844B0EB8D514AF3CB9DF5B191A37B3E636A897D2BCB9E5C908F3D56073400C9560A80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720743115, "uuid": "cb36dd8b-0e3f-4604-8f6e-5ec60a2c421f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720743115, "uuid": "c570c0d3-eaaa-4e00-a97c-4dafc4683f31", "value": "6144:30Zsou1/bXPDtA5h2EZ4LTbv1mV8/XdkpU7Ws8zNJf:30Zs71DpA5h2Xvsa1kpBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720743115, "uuid": "d038b847-cd91-4e85-9620-2ae035638625", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720743115, "uuid": "31cb6947-e1c7-49cf-b24d-97ec1432ad07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720743115, "uuid": "1c840e2e-3d23-405e-ae73-6d2f42b70ce6", "value": "OneDriveUpdater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b2fa66-400e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720761632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761632, "uuid": "a75903b0-57df-4fad-a9d9-868001786fdc", "comment": "Malware payload", "value": "c652927fa30836add56b1c767de19548", "object_relation": "md5", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761632, "uuid": "48e5a8d2-c5b8-4856-b301-d5f924c4ff0b", "comment": "Malware payload", "value": "19c968f716107aea4fb7bf7fdeb9f8821b4aa1ea8593137a08322356c80460cd", "object_relation": "sha256", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761632, "uuid": "8bfc0c73-9a29-4419-854a-fbd71bdba827", "comment": "Malware payload", "value": "a50b9968e36ca0a7e52e5b1ecd601ff605f22700", "object_relation": "sha1", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761632, "uuid": "4a82e783-126b-443f-b5ed-3b1a80b5ecbb", "comment": "Malware payload", "value": "58a79e31aa7bbc87d8034257be62388e46418d4ff82f7c76f7322a019c3b9c36556dbe6c50a504b0aec02366fa5c1ff1", "object_relation": "sha3-384", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761632, "uuid": "d5a3167b-2c14-4a6d-8409-c3ae323d70e9", "value": "T1B082FAE0D5622B9C1C4733F39C75B7BCC6248CF66433432B99A7B4695D063892DAC4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761632, "uuid": "974772ef-a5f4-488d-8a31-dfdae5f10ce0", "value": "384:9G6wA1T89Hi6IUAxq19/Aj1M07MA+zOTNE4SQQOhVp6:o089CI2S/ApD+zOTNE7g6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720761632, "uuid": "472225e6-2459-4cfe-9d72-09b70c5c9da7", "value": 17973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720761632, "uuid": "9779b091-f6e4-415c-9651-4fb576a006ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761632, "uuid": "a06e0d0a-17ec-4c6a-9064-4df284c919f0", "value": "19c968f716107aea4fb7bf7fdeb9f8821b4aa1ea8593137a08322356c80460cd.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50263d5-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720756154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756154, "uuid": "993e90fc-25be-4afb-8ce2-3ee88bef033f", "comment": "Malware payload (AgentTesla)", "value": "1b15a7c807f3ab3c57df474a72589098", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756154, "uuid": "47f4e17a-11ab-42b8-bd16-1af752eda69e", "comment": "Malware payload (AgentTesla)", "value": "19ca104dcca902adcec76f5ef59e6c613b9edee2c3b136acea2a7985c350b2e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756154, "uuid": "ce0eae56-f072-4a17-ad32-ee2be7fda5c7", "comment": "Malware payload (AgentTesla)", "value": "4bc28409053304f778de0ea39d5e21a3a5d54a74", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756154, "uuid": "f3172757-8629-4822-a44a-ce9da7645c70", "comment": "Malware payload (AgentTesla)", "value": "9b104df1dc34670b4f0f1dd4b027afcbdd0dc20dc93beef1d9aba40e29e4ffcf86f698bb76617809184f3626a5e762fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756154, "uuid": "d0884b29-de3a-4bde-a882-18e3ed3125eb", "value": "T167C4232B424507089D4D056957BEEC22F2FCA65D70D8E63F81CA3FCE894C6B9971AD0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756154, "uuid": "31c17313-31f6-42a5-a3db-d8613bdfcd15", "value": "12288:XTkmKahx8aVqMap6jYHQlYUMACr/lklsKW5W7z6mKUSWJ1GhWSQ:Dtx8+q76jYHQ61/lcsC7+mPPSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756154, "uuid": "148b3d1c-3767-445f-b43d-947bd224410f", "value": 556073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756154, "uuid": "a2662335-d206-4037-8c17-c81bb10ec723", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756154, "uuid": "d0bdfd37-53f2-4057-b704-43473d0e928b", "value": "REMPTKBS00120240712.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0088270a-404f-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789352, "uuid": "2dc2ad46-662f-49f5-80c8-562b7dce5380", "comment": "Malware payload (Mirai)", "value": "bc29d6b18ef9fb22dda9a8a12dc7fcc9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789352, "uuid": "f20814a5-ee3e-403f-9000-28e2b9486f40", "comment": "Malware payload (Mirai)", "value": "19f6eca9277b8e4b69e4c01e4e1ec2865a1208af25797f7761f228b498b83d62", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789352, "uuid": "8fe04e61-8998-499d-a0ed-bc4868f90f2d", "comment": "Malware payload (Mirai)", "value": "ddc30acc4f2b07bba73b984280e0612a2178c497", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789352, "uuid": "c7ac194f-780a-4523-8a84-4c4e05a64e5a", "comment": "Malware payload (Mirai)", "value": "b9d8269328f3fbd433b07ee9b042481d96e7e97bc638f0dcd1d83d99b7a1d18df377a9089d75f81b300bbdb048274e28", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789352, "uuid": "965dd056-3188-4950-860c-31a38a5e70c3", "value": "T197D2D053E084A797CA3292BDCCEEE9E70930EC38795524B66484D0B2E43B7E1651E789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789352, "uuid": "970b03e4-ac90-4067-bba7-45c770281f63", "value": "768:mH4U61C/tREq04B3zEVZ7E/WCI5ujy0Hm5ESEPWO7nbcuyD7UHQRjg:m9wsEX4B3I37SPjLHm5EluO7nouy8HyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789352, "uuid": "2f19edcb-676e-4619-a57e-32840227a7ca", "value": 30164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789352, "uuid": "defde96f-ea31-4c9b-ae6d-7d529126746e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789352, "uuid": "bfdaf7b4-f2cc-48ca-930d-1f90feb4626f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4c42ca-4008-11ef-957f-42010a9c0016", "comment": "Malware payload (QuasarRAT)", "timestamp": 1720758960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758960, "uuid": "67144ddb-27e8-4140-a5b0-61c8364968e6", "comment": "Malware payload (QuasarRAT)", "value": "df24de49146b2451ac1d1f97b42210ae", "object_relation": "md5", "Tag": [ { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758960, "uuid": "e127e082-6ac2-4d1d-a001-dd90dc005293", "comment": "Malware payload (QuasarRAT)", "value": "1aab08aa24404555cf3b04f40cefe386ab5e0e937699573277bd502012bf3374", "object_relation": "sha256", "Tag": [ { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758960, "uuid": "51f32904-4448-405f-8f94-44afa249e2e7", "comment": "Malware payload (QuasarRAT)", "value": "e708a12577b86ff5b65aa0776859441fc589293a", "object_relation": "sha1", "Tag": [ { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758960, "uuid": "7f2adc1f-f044-458c-9c9f-ed4c3fe7f339", "comment": "Malware payload (QuasarRAT)", "value": "b7fcaac50f29dcc8e4d79d42053a67c67e4f4df5fd0471a8b8cd3d9aa6c8203f6f233f36482cd5d4778899b21040044f", "object_relation": "sha3-384", "Tag": [ { "name": "Quasar", "colour": "#D17794", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758960, "uuid": "cd014bd6-ec65-40a9-b713-1bb5c7d6d579", "value": "T1663701F2B7D7C293678452AD93A38654A9A30F00707C0E181B50858EE7CF295DED9FAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758960, "uuid": "d891c233-fa59-4a3d-a118-5305caa2d0b6", "value": "c09e0c6f5ae0a9c659f4ba8a6daf724a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758960, "uuid": "135180aa-0b83-416b-955d-d0deb19dbbe3", "value": "393216:AJvs+1Ca2KAQXdsfNsi2+tZuv9bMLm4vVhceN5BkNwVPlKPZl/GGVCnyh:As+1XsL5A1kl/c0UNwVPljKCnS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720758960, "uuid": "a9221156-685e-41be-9ee2-88daacd0cb84", "value": 23568672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720758960, "uuid": "42bb9a5a-643f-4f11-ada7-915a0a27b8e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758960, "uuid": "b3c771b4-138d-43f1-95c9-9262951b5c7f", "value": "Cami.bak.cbk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa28523b-3fee-11ef-957f-42010a9c0016", "comment": "Malware payload (RedLineStealer)", "timestamp": 1720748110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748110, "uuid": "91fb9967-ba39-4e22-a459-c4587164db4c", "comment": "Malware payload (RedLineStealer)", "value": "715d0979fbadb19889e7963f7c33f501", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748110, "uuid": "79c62f5f-77fc-4187-b801-291a7780f039", "comment": "Malware payload (RedLineStealer)", "value": "1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748110, "uuid": "02e3fa98-015b-4c90-817c-3440f2755d19", "comment": "Malware payload (RedLineStealer)", "value": "3ad746befebb85f942868a1f5338cb4e36f355e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748110, "uuid": "86157498-cbb7-4028-bb17-e22c05ab7235", "comment": "Malware payload (RedLineStealer)", "value": "08357d9c56003ee44f4d6a4337856e39f94b166ff0940efd28b7e0c22d7494a28d045a0c16a977958df90d76f6901d6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748110, "uuid": "e0122d5a-3063-43e4-84f6-221dc979b398", "value": "T1BD358C0273D6D022FFAB92739B69F23196BD6D240123852F13D82D7BBD701B1166E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748110, "uuid": "fcca8c9a-9bbd-463e-860e-ba51eaa6a9b6", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748110, "uuid": "84d5bc6a-ac15-4b06-b7c4-c8b5d1a0b90c", "value": "24576:7AHnh+eWsN3skA4RV1Hom2KXMmHa7cGNS5Z5:Wh+ZkldoPK8Ya7crx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720748110, "uuid": "cdfa5cd9-0acf-4351-9ed6-0a33e19c7dea", "value": 1067520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720748110, "uuid": "be3f041a-943b-40d3-8bc3-aa3f2b361b51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748110, "uuid": "389f8fd6-17ea-483a-932e-56f8902223f6", "value": "Contract Quotation Details - Rotational Suppl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf47a49-3ffa-11ef-957f-42010a9c0016", "comment": "Malware payload (Stealc)", "timestamp": 1720752945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752945, "uuid": "2b89f94f-0d0c-4643-82a3-1dcc0bcc2e7a", "comment": "Malware payload (Stealc)", "value": "b5f67083e086299287f0dfb2a7bef96e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752945, "uuid": "76f8ba88-24e6-4e3e-819a-0a9bb1727c79", "comment": "Malware payload (Stealc)", "value": "1b6722f558bf4483253663180682caec67066261bc0414d12d6e1622cb848d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752945, "uuid": "4721884a-3831-4e0b-8512-27d9c502dadf", "comment": "Malware payload (Stealc)", "value": "dccf58d99cd7153859d1ad5a1c3f7e348e2ebbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752945, "uuid": "bb7544bb-14a3-45ee-be50-871ba3804a7f", "comment": "Malware payload (Stealc)", "value": "d0193e3ffead3479ea4f1869172bc0af888c97c59bc6b73920d782065369774839299bf829636aab4aca0c1abb208fe5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752945, "uuid": "ee37428c-020a-46f4-a39b-4d556e532b58", "value": "T1A3C533E3DAE93220D4C918F2A6F75AB750DD4F1614B95AAEC5BB9B580BBC4303C2035D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752945, "uuid": "0aa6eab1-7f58-47d3-96c3-480d1e548f00", "value": "001806c33a6e9fe5fbff34bdbd79b591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752945, "uuid": "ae5f60df-c76a-4967-88f6-e60aea9f48c5", "value": "49152:EEKU59C+b8stxJK8rWjiw8+gz7RGkV6ladMPlgFUfEIb017XKzyB6su:DKktejS+wtJYlaGIsOKzyEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720752945, "uuid": "c1af63e6-9053-44f7-bdb8-489bb4a260aa", "value": 2504192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720752945, "uuid": "ff5691fb-672f-4aa6-9c04-3be0f3985fde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752945, "uuid": "2c878f43-be06-4dcb-9150-f3bfb29cebb8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0bf39cc-4002-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720756630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756630, "uuid": "0a40d3bd-d321-4363-992a-c3c88f3e5336", "comment": "Malware payload", "value": "fd0b9abb452747cdf5b01aa567ba1bb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756630, "uuid": "7d812e99-f00f-4899-a064-7024a65cac87", "comment": "Malware payload", "value": "1c269084aaa81ff27f94106ab4572d394b2a467956f5bf0fff6fd130d00214d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756630, "uuid": "d436ce08-7510-4ec7-9035-12dcbd6225cb", "comment": "Malware payload", "value": "10964d022c5a21e53ec407facc763ba7b155b674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756630, "uuid": "8f4ef9ea-6632-496b-b758-952db8df22b3", "comment": "Malware payload", "value": "e1023d5e9ac2366bb8f9b918d385282016c2d1e1a23a397adf359dc21635dfa7184059b34f6bbcbcea5fd1d472679130", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756630, "uuid": "376f817d-3444-4fd9-8185-7ea9e4c327bf", "value": "T10545BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756630, "uuid": "be4e328e-10da-4bc9-a36b-a83c3e564f85", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756630, "uuid": "ee20ed2a-1e35-4db8-ae82-84ef04bb3107", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8aLv2Sbly7TWEPje:UTvC/MTQYxsWR7aLv2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756630, "uuid": "29fd8832-032f-4313-a848-742a020043e2", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756630, "uuid": "7b01f1dd-c4bf-45f7-ad63-562eca2b4b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756630, "uuid": "65c4304a-5b0d-45a0-a225-305d30aeed7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c02af39-4019-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720766179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766179, "uuid": "6eca2e8a-049d-4689-8797-289428f8aecc", "comment": "Malware payload", "value": "f0953ed4a679b987a2da955788737602", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766179, "uuid": "b3d3db12-bbfb-45d1-849d-fb9544348837", "comment": "Malware payload", "value": "1c88150ec85a07c3db5f18c5eedcb0b653467b897af01d690ed996e5e07ba8e3", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766179, "uuid": "16665fad-7bd1-4cdd-924d-cfdbafc3c15c", "comment": "Malware payload", "value": "5b46b63e31f307757cedf305005ce9990a07cbf4", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766179, "uuid": "b59839f3-edb5-43e8-91e5-b6b22566509f", "comment": "Malware payload", "value": "b9ec4a515c4dfc1abf88c0046588b50b4a29f70db929194e889974d562771d0d1fc64c41d0bcd92f9cda3cf3a6c11982", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766179, "uuid": "b2d57ae1-fcdd-4820-aa09-913bd98b2a29", "value": "T11084F10B33D410BBE5BB8278C9A35A46D772784157629B9F03A0172A1F637C4AE3EF51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766179, "uuid": "6d27a583-17a1-4083-a737-dec982e08ee3", "value": "be777e91e3c42ac62471cfb7239be471", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766179, "uuid": "d6c6b6b0-f6de-4562-8074-dc121673e8ea", "value": "6144:O657EjBj39XyaAsVnWukq5p2C14jgxCtUncUiexiGG3/UPy2Onp4WsET2p:d5WR9XyU441lxCtUnDMSSSEip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766179, "uuid": "01e3aaea-7241-4006-bff9-79dd07dc162a", "value": 389648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766179, "uuid": "4b266f3c-9c65-43f7-a7a4-b9d7a5c4c025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766179, "uuid": "88812dc5-e957-4345-8379-fbf41f8bfd93", "value": "1c88150ec85a07c3db5f18c5eedcb0b653467b897af01d690ed996e5e07ba8e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c2df7a-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789339, "uuid": "796040de-2f8d-4fa6-a377-2be9a6e6f749", "comment": "Malware payload (Mirai)", "value": "6712a3f309d2c8375fa4660c4e46ed6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789339, "uuid": "3276bba4-07a9-4f0c-9351-471417ca9858", "comment": "Malware payload (Mirai)", "value": "1d86fca831b4f0eae81769040c075994d959ef1dad30ab4260e063206342ed7f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789339, "uuid": "327a16ff-bbf1-4492-bd12-56b401579bb1", "comment": "Malware payload (Mirai)", "value": "7ea7181ba4ea7c773b78792b1ce9d3997767d0d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789339, "uuid": "c5416316-af34-408d-a5cf-8a72a4ef9c11", "comment": "Malware payload (Mirai)", "value": "b90f8e627e08e8c8dcaaf0a2d4c2881c05ff04f65085fd8e7cb38009e7d59a8b36c81c41f79cd1221f4d053c8fe440b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789339, "uuid": "7e113688-3227-49c1-bfd2-7661e87c5749", "value": "T193A34C32277A1B26C0E5A47D40F79736B3F2AB892961820F7E251E8D7F15AE031473B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789339, "uuid": "c27a124a-56fe-4857-9e67-761e460aeb47", "value": "1536:LBwVSU9aZRcZeN+Vwk0fjxvdM6sCuaTHaZQFiF0IeEWnfNG:tN+VJSxiUuaDbFWeFVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789339, "uuid": "e8f0d4fb-305d-4aa8-901c-743f87fdde9b", "value": 103038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789339, "uuid": "65117293-7b51-46a9-bb16-ed2d83bfea14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789339, "uuid": "b497c3ea-5877-411c-8a5f-1943f813a268", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec083543-409a-11ef-957f-42010a9c0016", "comment": "Malware payload (Stealc)", "timestamp": 1720821960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821960, "uuid": "5dfbfca0-774e-4c43-b96a-388fe6caaa5c", "comment": "Malware payload (Stealc)", "value": "380d17ae48099065620bf6819a75546e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821960, "uuid": "b7d872e2-9730-4f61-8ff9-a06ec7c86707", "comment": "Malware payload (Stealc)", "value": "1fae7a09da2d90805c3c5ddc97b91d36236171c34e79c8f3a3de945ac2ba25a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821960, "uuid": "058ceda8-0834-401b-a240-36ac7f8bb6a8", "comment": "Malware payload (Stealc)", "value": "15287cf99b247c5841ccb5d349cec09f2f8d6842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821960, "uuid": "3df59263-90de-469d-bac2-0bbc134a9b14", "comment": "Malware payload (Stealc)", "value": "a9a59fca0ac7d1a5ee9f81122f766563dd314318c6ac403bdab8ee06e48e8c3f03a7c72cbce4d9334ebc8987df5c0225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821960, "uuid": "8d5c9d97-0145-4f20-ae3e-f1fec77448f4", "value": "T1A6C533D5DB444AF8FB896E34FC3C4528202EB996A9841E1BF63268D1473A8C0D5D778F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821960, "uuid": "f01fcb2e-f01c-4586-b6ea-d597ca61c8f1", "value": "001806c33a6e9fe5fbff34bdbd79b591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821960, "uuid": "5281d4d7-253a-40a4-a605-e35a49efec96", "value": "49152:HGgqW+2Ifc21ch3scIZPA8SPtFlbiNZhNOL4xXoY+pAdrwf7:HRZFIXclsKtFlSZhsMxYYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720821960, "uuid": "d637862e-9304-4316-b23d-beb80421d774", "value": 2527232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720821960, "uuid": "fbeb29bb-22aa-4a0b-8e66-69f0061abfd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821960, "uuid": "c4a5de8c-9c0c-417a-8fbf-111e5b3e8a4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd39679a-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773885, "uuid": "3865ef5d-8d9c-4a6c-b8c4-019f7088705c", "comment": "Malware payload (StrelaStealer)", "value": "c5860795833c372e83645e71da42726e", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773885, "uuid": "8c901e36-b6ee-4e4e-9d55-1b06f76c5258", "comment": "Malware payload (StrelaStealer)", "value": "215195c98ab974d1aca5b0105a93e0cbf5c1f2374a9f8e1e1274b030ae24a898", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773885, "uuid": "4da03807-908a-408a-8989-cac83f8d2445", "comment": "Malware payload (StrelaStealer)", "value": "f3e420c7cb58a3f825ee62ef5a2983d10bb611c6", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773885, "uuid": "da26e3f7-6a5e-4d03-9a0f-c8c88144311f", "comment": "Malware payload (StrelaStealer)", "value": "5dfd047fca74b98ba4db28748897e65edbff484020d664653b10896709c27ad4a93f3176c0273fefd62e23edbdcf1f01", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773885, "uuid": "e627449f-2328-4275-95d1-453f0a4af5b9", "value": "T193F002BDAB156D44E87DB53901D14C136B8B52351F5FD96B37034961D441FE4CBF0291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773885, "uuid": "ca6150e9-449c-4f94-a37a-df364ecb798d", "value": "12:5jY8slVoWOrhG6cjvYBU7umLRmbEQCsRaCUnNCy4vZboRsYBn3h3It8slVoKZOrN:9nsoW56/BUbK76nNCy4vZ+xNIyso6KLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773885, "uuid": "5f0b3071-66f7-4f52-a902-8c1d1bdaa3c7", "value": 654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773885, "uuid": "3fd92f74-183c-4c0b-a517-b3384c1988ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773885, "uuid": "dcb9312a-b524-4c74-abdd-898db39a470b", "value": "Rechnung_BTKR24_0008703_52109030.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3de351-400f-11ef-957f-42010a9c0016", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1720762127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762127, "uuid": "aae6f6fc-d870-4194-aa80-cc3c7ac8a4c1", "comment": "Malware payload (Spambot.Kelihos)", "value": "9847280ad804970d7a00715cd4d5468a", "object_relation": "md5", "Tag": [ { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762127, "uuid": "3f3348a0-9575-4710-960c-1265e3fefa4b", "comment": "Malware payload (Spambot.Kelihos)", "value": "28808164363d221ceb9cc48f7d9dbff8ba3fc5c562f5bea9fa3176df5dd7a41e", "object_relation": "sha256", "Tag": [ { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762127, "uuid": "8a6af2a5-234b-4026-9d62-6e1b2d98333e", "comment": "Malware payload (Spambot.Kelihos)", "value": "c9d39d7a8d16c463e6b7f7359df8b0bb903db4df", "object_relation": "sha1", "Tag": [ { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762127, "uuid": "31d8bcae-0437-4f8d-8718-c8a930bec838", "comment": "Malware payload (Spambot.Kelihos)", "value": "9a02f97972ce626204b7f8107427f4e18dfb241f4f119c18548a2773af7e58cbb1b855f510abe63fec4721b1863201ae", "object_relation": "sha3-384", "Tag": [ { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762127, "uuid": "d052b8d4-faf5-4ecc-9c5b-c0772148fc8a", "value": "T13B873322B2C7C236C59E0177A979FF6E0139AE770B2141D7B3E0B97E59B18C15279A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762127, "uuid": "923aa34b-c612-4ded-ab55-3feaf7e58a13", "value": "786432:L2TVJJB5HV816DGXfnVEZrC1q7RvP4G1QR3YQtEotMds1e0Fo7b:LsJNV8/nelhdP4G1Q3lbtMdsk0O/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720762127, "uuid": "c3c1fc5b-5b3e-4e16-9f3e-fa70f2b86992", "value": 39386624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720762127, "uuid": "b2402317-c70a-4f87-86ed-36630720ca99", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762127, "uuid": "86171de6-a3f6-4d03-81bc-0123562b0cf5", "value": "SkypeMeeting.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fa9cab5-3ff6-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720751340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720751340, "uuid": "131b6d87-4d8a-4c00-9122-b3a271d5db8b", "comment": "Malware payload", "value": "620f66394c69689cf59777aa25351b34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720751340, "uuid": "1c095157-3f3f-4b1a-80a7-c5f199efcf0a", "comment": "Malware payload", "value": "288a5141311f0a00377a6f97133c852136790a40027f9be14bb10b0fd47aff83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720751340, "uuid": "c79dcd36-ccd4-4ff1-8e0e-fe446243fed4", "comment": "Malware payload", "value": "8b1bb96bbf15e7b30402071eec51b622c399a724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720751340, "uuid": "81a3192d-10c4-4d35-8dd2-3ae0d752e31c", "comment": "Malware payload", "value": "0c6533219b55d178f79fc4b85398068c6d9bcbf922727f298e93c8f397154899daf0795ac39752af9fd5c391cb76398f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720751340, "uuid": "297be422-8e26-4d1d-8663-aad77f96507b", "value": "T103573377D6EA4C44C329B8B17EEFB294E706E3292F123BEB1964E1175D468829CC3174", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720751340, "uuid": "5f29db28-dac2-4c52-a815-b3e35c414e44", "value": "af32077305a4208d2855ba10ff7a23f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720751340, "uuid": "4dcd9ab4-b374-48b6-bbc4-ec5004082bb4", "value": "786432:4XJLqGTpK1geAs5P/VJtDACKJ0kKkD4DG9FzpongU:4ZJQooVPDAEkKo4q9FzAD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720751340, "uuid": "7529aa33-67ea-4249-9c10-9d4128597ea2", "value": 28648960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720751340, "uuid": "7a5c2e4d-d86a-476a-b40d-e6736add77a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720751340, "uuid": "456fda93-7f26-4be9-9d58-e255f2dd02b5", "value": "SecuriteInfo.com.not-a-virus.HEUR.RemoteAdmin.Win32.Conne.gen.1416.17840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cd89067-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (PureLogStealer)", "timestamp": 1720769428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769428, "uuid": "b4e97bc9-142c-45ca-a2c8-8fdf12c6c7eb", "comment": "Malware payload (PureLogStealer)", "value": "61f757a48c997c436653eb4742b62e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769428, "uuid": "c3986d16-5883-43e2-ab0c-d7184024e048", "comment": "Malware payload (PureLogStealer)", "value": "29376dbba682dabf356fa66429271e0d8fae77f5427d49119487cee176211d5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769428, "uuid": "321a4755-c48c-48af-a825-e4610c0b33af", "comment": "Malware payload (PureLogStealer)", "value": "69e8738fc00e2c3a8f000c18bea695b9ec5c172e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769428, "uuid": "21ede2df-d967-49d0-91df-139c79795752", "comment": "Malware payload (PureLogStealer)", "value": "edfc1db1d95cbc241b206064f139c5d924a490ca13f6d9099f8fbe415553e4fcead207e3d706c78b7ea09886173c820e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769428, "uuid": "4b2f5c47-b933-4890-8813-4db02fb498f9", "value": "T187E4E71576B84525DE48C67890E309248BBBDE1932D6A32A97F2F6B81F7337C8F47181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769428, "uuid": "abdfd189-c539-43e4-a583-0231dd4de9dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769428, "uuid": "7a800463-d704-4fb1-85b6-97895179042a", "value": "6144:J7JDtFL+H2KqodoHCAu7fMJGV+mB1gjHXrpuxvva50jQ:JHFL0eodoHS7CdmB+Xrgs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769428, "uuid": "4b0ec58f-ddfa-4c6d-ab1f-d45fce602c92", "value": 684544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769428, "uuid": "0ec173ec-6e47-48ba-aaf3-58eecd8cd153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769428, "uuid": "488d36a1-8dce-467b-bfc7-1329dabf05ef", "value": "QUOTATION_MAYQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1137897-409a-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720821968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821968, "uuid": "e43db40d-aaab-4458-8ccb-3fd3deea30e1", "comment": "Malware payload", "value": "c2a2d4919ddd2a7b85f9284a74627e23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821968, "uuid": "16449cd2-132d-4497-9a23-3001458ce1c5", "comment": "Malware payload", "value": "29e0d3a82afb57241ff63a0e95b9eff1f69fa93c80981f27647d7dac42a62a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821968, "uuid": "a6677427-0b07-4881-ac6b-fb67b92a4abf", "comment": "Malware payload", "value": "7291e031e389b7c1aa4a923fb0489bd536decfbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821968, "uuid": "0f7038c0-9c28-4f12-ba41-393d37a2fc24", "comment": "Malware payload", "value": "f62c37824d8f8410f97400824c3359e7b5c7b56a5629ef311776f476c30fadaf013224cb073df875b588d8b95978d447", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821968, "uuid": "33230a72-5a8b-4c9f-9457-029103361513", "value": "T1C745BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821968, "uuid": "36a1fe62-78bb-4c7c-ae6d-da9bd05c9f80", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821968, "uuid": "936065a1-344f-4050-ac0f-ad093d5208c8", "value": "24576:wqDEvCTbMWu7rQYlBQcBiT6rprG8aLt2Sbly7TWEPje:wTvC/MTQYxsWR7aLt2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720821968, "uuid": "d98804ba-9e4d-4584-a2b0-2a83ef32735e", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720821968, "uuid": "2c208ce1-9e6e-48f1-8ac6-68662691bc24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821968, "uuid": "5f3c4f0f-7ef5-48e1-b3a7-cb72587697b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816d20ed-4015-11ef-957f-42010a9c0016", "comment": "Malware payload (WannaCry)", "timestamp": 1720764658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764658, "uuid": "1631ad66-9a9a-43f2-b1f0-05499bc5e1a5", "comment": "Malware payload (WannaCry)", "value": "da8dde3005365992711946c4622a3c74", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old sample", "colour": "#DB7BA7", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764658, "uuid": "4c6e8a93-69da-4ac9-849e-2818f3ff9682", "comment": "Malware payload (WannaCry)", "value": "2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old sample", "colour": "#DB7BA7", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764658, "uuid": "ddc3b9fa-1aec-4d05-bd39-eddc4cbefaf2", "comment": "Malware payload (WannaCry)", "value": "d04042cd11cd11f3b6386a5e2275f14b92048fc6", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old sample", "colour": "#DB7BA7", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764658, "uuid": "603501a9-89ce-43c5-aeb4-2b0cdf18993f", "comment": "Malware payload (WannaCry)", "value": "c58f887ee7433fec3bab114a0b04f8831ba4e7fe10acf942408f3b15a42d45b31c041d478930e61075f2edb7113c94fa", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "old sample", "colour": "#DB7BA7", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764658, "uuid": "d127e616-c303-4026-816a-8a99d661ba38", "value": "T1E1B5239A716C90F4C2092A7494BB8E12F6B67C3E21FA690BEF4089762C53F56F750743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764658, "uuid": "7639fd92-e661-43ce-b4e5-d626b1765964", "value": "9ecee117164e0b870a53dd187cdd7174", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764658, "uuid": "0454bc7d-0517-43ea-91ff-ccb787fa2490", "value": "49152:QnaMSPbcBVQej/1INMx+TSqTdX1H76SAARdhn:QaPoBhz1aMxcSUD76SAEdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764658, "uuid": "e2d4dd92-041d-419a-abb3-7887ec189b58", "value": 2281472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764658, "uuid": "4fdfb72b-e2af-4197-8a3f-ec0aa0939747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764658, "uuid": "3416c9ff-ffda-4208-b51f-39a4ce582466", "value": "2a62c57ba98308fe2316508f077186b76e5ad55a1e367e58d19e5a9b08900eec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5980e22-4022-11ef-957f-42010a9c0016", "comment": "Malware payload (QuasarRAT)", "timestamp": 1720770382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770382, "uuid": "857e5676-a785-4c96-baff-76525048080f", "comment": "Malware payload (QuasarRAT)", "value": "87fe2b0745cee80984847fafe4a38f1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770382, "uuid": "fc73a3a5-9769-410e-a823-41a52c94fb0c", "comment": "Malware payload (QuasarRAT)", "value": "2c778d65ff3ddb44732faf2be85ca0205667be3d87ac14acc48675dca9439e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770382, "uuid": "255ec922-9655-43e5-a337-6e9874ed7440", "comment": "Malware payload (QuasarRAT)", "value": "b00cfef272bdf0a9b0c1a31ef5cb6a470e940f89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770382, "uuid": "443e6ad4-18ba-4a3d-87b9-414017a6414c", "comment": "Malware payload (QuasarRAT)", "value": "c28e587fe9751c2965718ed12d9bdc1ce130351e4c5ba7ba632246f5888d6a89f02ca37e7f4bb084834238cda1939e96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770382, "uuid": "f0f5f4a8-8ea7-47e1-942a-41ce1d76d653", "value": "T1AFE623D8A1D812F4D4D306B0A24A03CEB1E0795A1BFD5D5E36E51C139F12EAF291EE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770382, "uuid": "975a9ed4-f9ae-49fe-ae49-74b147c3a309", "value": "499991b521db19370df95b1b3cf4e6f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770382, "uuid": "457a2deb-e574-4eb3-937d-2b68d7fe6bf9", "value": "196608:ysYkoaFUFFQ8TDte1DS2Eq9hKx1qxcj2yWuF8nJZT8t3ffBO7exJLfUxhyu57g9o:W5jesZ1Ucj2xuF8JZO3ffM7xnLdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770382, "uuid": "bd5ca33f-117b-4afb-8fea-22360d3eaa24", "value": 15197696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770382, "uuid": "e33df771-289b-4ff6-91fe-98314b7e798a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770382, "uuid": "12fc5d91-0d49-4d57-9585-7a132c332b4e", "value": "87fe2b0745cee80984847fafe4a38f1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06945736-4006-11ef-957f-42010a9c0016", "comment": "Malware payload (RedLineStealer)", "timestamp": 1720758009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758009, "uuid": "6710a93b-7abe-4f18-8da2-d8f9cf66606a", "comment": "Malware payload (RedLineStealer)", "value": "a3a55457b08e66b8246b3ab4f5afc5f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758009, "uuid": "5e3efe20-5532-485e-a929-b1ba60484a49", "comment": "Malware payload (RedLineStealer)", "value": "2c7c1638330a59ae2a7c7b549384b6cc6b915584c4c99c59256fdea1930437d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758009, "uuid": "951919d6-8392-4fe6-9af7-bf5d8165d04a", "comment": "Malware payload (RedLineStealer)", "value": "bcfbda193b0091361b4a9ddb06717e219a389351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758009, "uuid": "be40b6a7-2adb-4916-b236-6747ab588d24", "comment": "Malware payload (RedLineStealer)", "value": "7a4c4f8684edd44b11ed0f78f3c031a7b77d0fa2965aaee32369697662936ff59cca19ed38bcdfe8883ddf29bd870aee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758009, "uuid": "d4032752-c159-4bf8-8e0a-2349dbf92523", "value": "T1C0D51215361B5E1BFD4689B8D8E634F82AFC9C037AF6664FDF0A8C9914D20FC01568B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758009, "uuid": "02991a29-ed87-4a5e-a90d-3ec053ee511a", "value": "12288:mJZ7RmT35hppmYbhFD4IssrqUIb231sarW:mZA5hpZFFDtpIb23CarW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720758009, "uuid": "0a6259eb-4800-4c6f-b12c-f12b2090c52d", "value": 2817633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720758009, "uuid": "fa586f5f-6efd-4d02-946a-6795233ad025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758009, "uuid": "8575d3f2-6a66-4708-9874-b9652c82ed98", "value": "CATALOGUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535103f7-4036-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720778754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778754, "uuid": "a0906f8f-db45-4e34-b980-c74e7ffc5cf9", "comment": "Malware payload (Mirai)", "value": "7f014469f0c17f455fea9b5edcf8b1be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778754, "uuid": "3f87d27f-6058-4acc-ab29-a7882216994d", "comment": "Malware payload (Mirai)", "value": "2dbf62abd057ff3e3d30586101bc81ce6f823731d80bf1c5eb904e70d19308a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778754, "uuid": "6a2b279e-72fd-47ca-ba1d-ba7af7ca68bc", "comment": "Malware payload (Mirai)", "value": "2e74ddfca744ec86702a4ca72f707dc5253d1738", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778754, "uuid": "33f63aa8-34be-452f-a1d4-ca29687ed019", "comment": "Malware payload (Mirai)", "value": "b7bf36a3e5d435e0b638ae7ef6fd02a56ee2042eee4809f69b8d6a4089322a2b9d2cd4a6a5925e2b94a6f0486bf9a8d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778754, "uuid": "37e404dd-e2e5-432c-be97-b77f3e884d1d", "value": "T115D3D449E964A72DC7E372FFF65902CE322A0B9CB7EA71219E305B5137C5B916839130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778754, "uuid": "a23206b9-ee4e-4a73-9da8-276ff0cd6952", "value": "3072:XZZcDUfJAxIQ1ONTxm+PzJZZqcrbisgxaRRUzklVG:XZ5U12xpPznZdHisQahlVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720778754, "uuid": "27449abc-909b-4361-af4a-9c2b058a6645", "value": 133360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720778754, "uuid": "bcd2d985-d22a-4e78-93e5-8068a9a7b4aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778754, "uuid": "752a1bc1-bd47-41e3-b37c-2edb045189d2", "value": "7f014469f0c17f455fea9b5edcf8b1be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f882545c-406b-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720801794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801794, "uuid": "a7cc2ea8-6257-4a73-9134-e92813bdc2b7", "comment": "Malware payload (Mirai)", "value": "c622df75a9dfe01f7cc8fb1ce549bb83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801794, "uuid": "15e5a181-f88a-41db-a148-5182f1c1a399", "comment": "Malware payload (Mirai)", "value": "2e3bdcbe5793b45c8e8340f009a6a7f6b8cdd8d2f50610f1c62b06360e173e97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801794, "uuid": "6c0b1eb4-6514-4793-b177-d68943f2c92e", "comment": "Malware payload (Mirai)", "value": "f5f22bb6fde8889c779827fb23222b6fc974c63f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801794, "uuid": "4e58da99-b4c5-4e50-b154-f1d29977103d", "comment": "Malware payload (Mirai)", "value": "2058ed18aaff46de523e184007cd6fab60c915b5bdd7b2044a6901079f136201e75a80014432f50b0344ea9c4b525e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801794, "uuid": "da319190-c324-4ee1-b0e4-6519047172ce", "value": "T11FD33B56E7808B13C4D22775FADF42053323A7A5D3DB23069928BBF43F8679A4E93506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801794, "uuid": "e9adb73d-4227-4e08-a09f-24df4fb921ca", "value": "3072:qY5ig5kL5y25zA5iA5EFO7A5CaeeSEkQX9Ew8rocG+fI0VV7ajd:lnqR6DOFxkaeeSEJX9ki+fI0VV7aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801794, "uuid": "f072c0f9-6977-4a80-a4e5-8b5e8071962d", "value": 133459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801794, "uuid": "55cb1704-5181-41ad-b662-d9d8e9eaf2a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801794, "uuid": "11ce7c5f-360b-49f6-82c9-341578398724", "value": "c622df75a9dfe01f7cc8fb1ce549bb83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4056ef14-4023-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720770561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770561, "uuid": "775dd00e-f66b-4bf5-a965-2ffe2e0317db", "comment": "Malware payload", "value": "a808065988408dd13ab469dc99d5019d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770561, "uuid": "536e54c4-5eb6-4302-b261-6bfd4532eaf4", "comment": "Malware payload", "value": "2ea3b0c6b2d10d6193c29b03e726a83394193a2923b8de231489cff9b38b94aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770561, "uuid": "83bcff8a-24b6-46b3-ba53-75e5e6e3d120", "comment": "Malware payload", "value": "43f911f4f2fd5ba1a3d862a41004c2be9ab357c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770561, "uuid": "c0d306fb-0491-4985-892c-ec13abca2220", "comment": "Malware payload", "value": "18ac7962612a7ad1040282eed805c79e5d0c315b4132a0c0fb1ac6043417729d0ab1fde843d14ea0352b1b68cb030d62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770561, "uuid": "3f554ec0-70ca-4a27-a6ac-9630d9c48361", "value": "T123453B5BE7B344ECC56FC1748357DB76AA30B82602347D6E19A8DB321F32D504B6AB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770561, "uuid": "c2b66b70-c7ca-47fc-a51d-d76f2a11c753", "value": "9ddd689d113436fccc3722441bbbfc46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770561, "uuid": "509c3fa8-3a38-4173-b1ab-ac2187f58c28", "value": "12288:4IXqAcXKlncOyAGFu5/wZmsTyef7OGjLVcFgUvGSic/+el3amYoGB5hvh:4IXqAcXKlncOyAEu6XLVMlGSJ/hl3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770561, "uuid": "c2b5a5bd-90df-4dcd-8374-a352986cc038", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770561, "uuid": "5f0c17ea-c845-4764-bca8-0fd1a381f8c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770561, "uuid": "e6282c95-b13d-4578-8cf5-3b4a02fafb3e", "value": "a808065988408dd13ab469dc99d5019d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c798470b-4008-11ef-957f-42010a9c0016", "comment": "Malware payload (AsyncRAT)", "timestamp": 1720759192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759192, "uuid": "01a5173a-f10a-4e3a-86be-6c4479499f06", "comment": "Malware payload (AsyncRAT)", "value": "1644c4839846a1b6524e38071528a564", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759192, "uuid": "8552ef05-6d42-4e7e-b947-4ddd62f9991f", "comment": "Malware payload (AsyncRAT)", "value": "2f9e7eff2a3dc88b9db2382875b0d3ad4241ac09e97e8d1d779a533a8fc1d8d1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759192, "uuid": "0444d4d7-1f76-430d-b453-41a581305c8d", "comment": "Malware payload (AsyncRAT)", "value": "2250bbb322087bf0ba0a26a83b0e11ce5da6733d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759192, "uuid": "faa9d355-3108-44b3-b23c-5f552238a759", "comment": "Malware payload (AsyncRAT)", "value": "0d804343978e5bfa106b52c74fce0238652c7ce12ae841524e6b68d0501169a3f73a3c3fcbade320774f62e9d584451a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759192, "uuid": "cea58361-fc71-4294-8289-529a52039526", "value": "T1C3535C003798CA66E2AD46B8ACF3550006B5D6772116DB5E3CC804DB6B9FFC60A527FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759192, "uuid": "bd319f63-099e-4a6e-b1d6-7f129e6739f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759192, "uuid": "8251f327-7f5e-4fd6-9937-ec1a63877aff", "value": "1536:VYQj1F212+iqsUbDh9xrsGu1SdpqKmY7:KKM1DhsUbD9HGz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759192, "uuid": "84239907-aed9-4d93-b17f-26434a3b6cab", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759192, "uuid": "6bfab45b-be68-412a-9ebd-47267039b2a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759192, "uuid": "b0f6b8db-fb10-455c-90bc-100b28408f74", "value": "Microsoft_Service.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efe1597-404b-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720787739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787739, "uuid": "d56dab95-8fcd-4829-83d2-a8f52ba5fb7a", "comment": "Malware payload (Formbook)", "value": "0f69847ce2652ade7ac61eab6864ba4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787739, "uuid": "ba76ee36-e7fd-4955-95fc-f153db7cc270", "comment": "Malware payload (Formbook)", "value": "300185691a83ec8f644453f6007b1506b2a21e4718dfef7f2c3d3ceb4f890544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787739, "uuid": "39c0f456-0708-45de-9d87-620b65bc4246", "comment": "Malware payload (Formbook)", "value": "8cf5fb9e24a0ef55f0821a974bdbc65a455e8414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787739, "uuid": "3caa0a69-5eb2-4f11-8b58-c2fb6fdcf03f", "comment": "Malware payload (Formbook)", "value": "0978ebe510908bd87276ab60375bad0e457af6f6d4f985645f0a3167ed4f3c2a2f0f5c885844743e89e97db87ee39900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787739, "uuid": "c567fe25-1f04-4047-b4b7-0b550af808ac", "value": "T18245BE0273D1C036FFABA2739B6AF64196BC7C254123852F13981D79BD701B2267E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787739, "uuid": "78b43417-0e0c-4057-a309-8fb56aac570a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787739, "uuid": "eab818b1-0c2c-455b-a75e-142a8ecaa7a4", "value": "24576:sAHnh+eWsN3skA4RV1Hom2KXMmHae1UoZPAsMbeFFa5:Lh+ZkldoPK8Yae1bVAsRFC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720787739, "uuid": "3d72a20a-aafd-4aa3-a18e-ae6b891cd5e9", "value": 1177600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720787739, "uuid": "b7bd3203-e934-44d1-b657-7b73328be50f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787739, "uuid": "1d4f5c8b-fac2-4ebc-b2e9-e6c50a93e67b", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2305dd5-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769437, "uuid": "bf263592-927a-4309-8ea8-9b6e1981ec43", "comment": "Malware payload", "value": "ef095b996c617c155bd8942af1e6c932", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769437, "uuid": "bc3fa08b-fbb2-45f6-a8e1-219ea8c2f7d5", "comment": "Malware payload", "value": "306dc30e7ffc4951427e7a96577dc430e9f3072e7aa0871ce73c82681b483cfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769437, "uuid": "be65a8c7-f57f-4707-b852-438e4a678dbf", "comment": "Malware payload", "value": "9dc414ccd86be2080c352789bc877d06adc6c08a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769437, "uuid": "0c95ddb9-2dd6-4fd8-87e2-7582bf0d1b35", "comment": "Malware payload", "value": "ac51125c121e7318d173f55ab0a7489d85848de6f5cb6c75a0715bc25c603484ca79d50ef81bffe89a47c444f04fc23d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769437, "uuid": "62ad7c70-b894-4003-bd37-4847b2ad9b85", "value": "T1C7B42B257674D52BDB28C6F403E35B108297AD1E66D1D2291CF0B5E9CA312FE6F0F582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769437, "uuid": "22386110-e857-4277-9fc0-2c83aa13f129", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769437, "uuid": "09bdd7ed-f69a-4cba-9e7f-f0f4df101fcc", "value": "3072:XC9qg2cR+4vqQj5Q5TN6M4EQX0ivhH9eqyQoPEEn+d5rpqr/xkYuy7:XDcq4L1n1oPx+dfqr/q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769437, "uuid": "594c3aa5-cd77-4cc8-abf3-193273ce8cf8", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769437, "uuid": "9e75d78b-b799-4f88-9929-a64d51b7b931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769437, "uuid": "f27d2d4c-4f9c-4b7d-b658-724c85d85291", "value": "QUOTATION_JUNQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dacd5c-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774143, "uuid": "5f8e44e2-deb0-41f2-9fef-a84c2cd1d5cf", "comment": "Malware payload (StrelaStealer)", "value": "d4979670bcbe8234e3ec020b61ef507b", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774143, "uuid": "dbc71331-794a-45c2-b793-8c16fbfebe60", "comment": "Malware payload (StrelaStealer)", "value": "31142c3dd5ca319557854ed8a4ea00a4799e029fa35010e2c5d1904494f79b8b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774143, "uuid": "58024524-f4c7-4752-80a4-a911d05d0b0c", "comment": "Malware payload (StrelaStealer)", "value": "d44c5fef0e89c90b6a5f6d69e8d2a8a109ef270c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774143, "uuid": "02f83c4c-4e26-4fbe-9eae-b01bd220e0e6", "comment": "Malware payload (StrelaStealer)", "value": "a5bfb20990355dd6d76a5b2a961e95573ec8fb01c6b2040d494d36393c48227000e7f6ce2cb92289d9d2e5f533774d58", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774143, "uuid": "f0d1babd-78b7-4416-a5c7-ffdc8e657983", "value": "T11A419DD47592D92913743F43F99B4A3400C3ADF26E16D44F8E91A80CD95859EF33A1A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774143, "uuid": "8d498a3d-ead6-4764-8d81-aa54442b3e0d", "value": "48:RcyuptioAamc/HRF/yJjWNrrWEbLfjWNrrssX:RczjxAamc/HRF/0Krr3b7KrrssX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774143, "uuid": "002c7cd6-ee4f-4761-b478-109d68809485", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774143, "uuid": "e216c295-cd67-4b95-ad98-fdc1938e9e45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774143, "uuid": "3e3309a9-9406-4e2a-bace-ade9ca887b19", "value": "27656181351091418700.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a80491-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773520, "uuid": "aeacb4be-fe51-4514-9f11-13766e3649f1", "comment": "Malware payload (StrelaStealer)", "value": "18968a2036e59c0226e1aa98bdd28252", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773520, "uuid": "a3a83acd-97c0-4c5b-9897-f6a162eca63c", "comment": "Malware payload (StrelaStealer)", "value": "3351810bdaa5b4658deae7a94c78e6871a9faf23a2593d5c89b9c1dc35cf3670", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773520, "uuid": "5c90f653-033d-463a-b1f3-e6c00a941307", "comment": "Malware payload (StrelaStealer)", "value": "34e373f209606badbaa5820b571ba428b24119b5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773520, "uuid": "6c11b0e9-e238-464c-a293-a476b1f025fb", "comment": "Malware payload (StrelaStealer)", "value": "8bed2f731a9638d0bb0b1513894121c473018d15e6304b2ff0ab968c450ae0126e4d38bfa481f096107db1f924e93d65", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773520, "uuid": "bd711916-a4a6-479c-91c9-bac4181f9e5a", "value": "T16841E2D714007A465228AB4E3D771A0C16A26C342F6FE8DC85F798CBCA04DAC27C276F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773520, "uuid": "6375300e-25f1-47e9-a998-3a008dfe790a", "value": "24:yDGRz0lLmA0WXhAakj/Roxp76ovaXizU58PrzPfizU5TW9DgodPj5TC0+gD96zei:yomSAN3kj/RoxpVPLYV9jerWYgq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773520, "uuid": "160cd8a9-53b2-4785-9454-0a5172dfd0b1", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773520, "uuid": "8c68f252-a1bd-4e98-a27f-d4b7d9abc64f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773520, "uuid": "0227275e-1ebd-4ec6-a968-7ecd650e8524", "value": "3351810bdaa5b4658deae7a94c78e6871a9faf23a2593d5c89b9c1dc35cf3670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7dc690-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774236, "uuid": "d16ce3e8-8df7-4180-a3d3-019ddc788348", "comment": "Malware payload (StrelaStealer)", "value": "671f6639a2588e39f25c3292efe2c8b4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774236, "uuid": "aebf4146-0324-4d33-8a61-3d1380a1287f", "comment": "Malware payload (StrelaStealer)", "value": "33a86b38358a751b08be065ac575e0dcd5ef1164e20252db1ac9165c684da630", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774236, "uuid": "3c2519c4-31fe-4eed-a859-97e11099e3e2", "comment": "Malware payload (StrelaStealer)", "value": "99c9acff2d2d07ce6844e70c90c113dc889aa290", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774236, "uuid": "960a0c06-8937-41c7-870e-00afb8ae7e10", "comment": "Malware payload (StrelaStealer)", "value": "23e5e16ccc16e1366b213652593c631f974656d572f48109d35852e9af6c433f9a82cf332e62c49d8f2d1cae35b6871d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774236, "uuid": "cf63ae74-ebdb-4f35-83bd-bb0e7ea24702", "value": "T11A41E2D4BA084B4BCE336054F732F242729C0571E4C5FCC89AF019D9E5B290AA975BE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774236, "uuid": "fb839036-348e-408d-aef0-1bc02e74065d", "value": "48:JRNH5DFp1G7i/9pIpkiIa+MpnadbjMFLrUh2vOzarUh2ldt:JRRGQGyraF0d0K2Y2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774236, "uuid": "f59a0c0b-b500-46a3-9845-3912e4b75521", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774236, "uuid": "33904eda-fca3-414f-a40c-5e44dc8c773d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774236, "uuid": "bed8e10f-ffe9-4e1c-b547-d899d9c963a6", "value": "1719331522635826084.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f8d0df-402d-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720775104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775104, "uuid": "f33c4097-50b2-4065-97e5-d6fd337fc8fc", "comment": "Malware payload", "value": "c4530d58121fc0bed32567d21dce643b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775104, "uuid": "b59d8158-630d-4f52-9ae0-5fbe7a0115bd", "comment": "Malware payload", "value": "354d6c139088ba9e53ce333b7dd73a79b8a231c8716f64c8eec6cf00f3a9f343", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775104, "uuid": "6c22767d-092e-474a-905c-036019ab7a52", "comment": "Malware payload", "value": "5cba461927ec53b7fdc3f516ac6a46e6f81a454a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775104, "uuid": "a236a8fe-8607-4b12-b359-99cbe11a6364", "comment": "Malware payload", "value": "d43298390d27294840a5840c68324e29327df0ddd1dddd60654c0467a7e917a7e96a67ce5c870021c6c0c469164e34d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775104, "uuid": "3394521d-f79d-4da8-bcff-a01c393edaad", "value": "T1F445BF0273D1D022FFAB92334B5AF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775104, "uuid": "8f3cb188-a9b3-4f63-baa6-51121fe889bc", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775104, "uuid": "b7d9ba8e-7290-4aed-83a0-382e127b594f", "value": "24576:dqDEvCTbMWu7rQYlBQcBiT6rprG8aLu2Sbly7TWEPje:dTvC/MTQYxsWR7aLu2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720775104, "uuid": "eaa60615-f12f-4b5a-b7e3-7d25f4552f0c", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720775104, "uuid": "1fb2d842-b6c3-404f-b0d1-0bed29870f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775104, "uuid": "21c16201-7651-479b-b8ab-86e6aa1e41ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919af4a0-4042-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720784012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720784012, "uuid": "4b970733-25a2-4f3a-9e54-ffb0d0e15f65", "comment": "Malware payload (StrelaStealer)", "value": "0d4a83d334e52393f8c32b70ec08cd53", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720784012, "uuid": "4302fc18-293d-4485-8efb-b1c742288b16", "comment": "Malware payload (StrelaStealer)", "value": "359785b5065359b30149c27f4176ec2eed7b03fbbdbe20520ef8de2f240e3c35", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720784012, "uuid": "9b3ff053-0ddd-464a-ba44-d2f043875ed7", "comment": "Malware payload (StrelaStealer)", "value": "20064931d756d411fa41586df84c1ceaf6d838ef", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720784012, "uuid": "cc4d3892-2ab2-477b-9d42-0285fe83833b", "comment": "Malware payload (StrelaStealer)", "value": "d6a4b4b93cdd57a4dee0ea818f562d30f78bd8aac2f825c08daf44c286e13c0ab6d7a5df9541b8cae778920d1c14a191", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720784012, "uuid": "44e2620e-387b-4a59-9685-8b8208f41e36", "value": "T17B41B6A705C27B2AEFD832B7FD14C190787B87F25B27E43DC809C9B6524A95CB583422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720784012, "uuid": "f10fc2c3-897a-48d7-b1b6-5b38100b0d56", "value": "24:Ix7Ylou4+OE4eA4lOJWdAdOY7apez6Uvnnn+iXf4pez6Uvnnnjf2n:Ix7Z+OE4VZWaAY2paEIf4paBf2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720784012, "uuid": "163bd54f-3d1b-4ef3-bc42-b77466f68b2c", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720784012, "uuid": "ef614396-190d-4103-84bd-44878fbad1f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720784012, "uuid": "7fe351d0-67fe-440c-9fd4-2111201ee4c4", "value": "8285223561671531490.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3c590d-4037-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720779067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779067, "uuid": "9117990e-2ddd-41bb-807a-46493d635544", "comment": "Malware payload (Mirai)", "value": "bdd39379b2d3a3c39ca266e54fc6b365", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779067, "uuid": "e88f047a-c32a-4545-97a9-4fd90c66fe40", "comment": "Malware payload (Mirai)", "value": "362845595b659f92587caef0d756b4986cd7d22e740348c0c8fa819b9128a766", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779067, "uuid": "c4fb0476-f7c9-4f97-a2a3-b61ff5795e7e", "comment": "Malware payload (Mirai)", "value": "161f97320e6bfd52c125dd6c1273fcb34399027f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779067, "uuid": "0ff80eec-faa9-4dc5-a7cf-d8097451dc34", "comment": "Malware payload (Mirai)", "value": "b505c789eff1164ca5706193cb4eb1c1927b34018363689ee5b721e46537552982b2cc301ad24d3ff25fdfe5b67d5147", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779067, "uuid": "1a1ab6f1-67ad-4c99-a630-85acfa68fcf9", "value": "T1D8832901B7240947E2B31EF03A3F17F1D7AA9E9221A4B249784FBB45D5B2D361486ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779067, "uuid": "130c36e4-d573-4015-b442-9bb1173eb6af", "value": "1536:pZ9rUmc6SF9Zu6vpg9+fwufvsccKio+lZiaYdD42PWQ33U4FJvkHOjrc:n9g6SFbq0FfvpiRsXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720779067, "uuid": "044ac92e-b414-4456-92a2-78a1443cd70b", "value": 82700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720779067, "uuid": "96479a9f-1fa0-4acf-ac4b-14be035821e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779067, "uuid": "fdf625ab-a290-42da-85b2-a4bfe0e0a602", "value": "bdd39379b2d3a3c39ca266e54fc6b365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5271a85-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789333, "uuid": "eedb6568-7565-4469-871a-36ee34822499", "comment": "Malware payload (Mirai)", "value": "902d5a78e8edd428d0ca68b89823e6e6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789333, "uuid": "3c246633-92f3-47a8-a946-f97ff57528d5", "comment": "Malware payload (Mirai)", "value": "3631c43e399f4ca705226cd9635da6b564f3f2ead8c1740fb777b3d16443d542", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789333, "uuid": "5f70197a-ed5a-4f49-80ac-8f5063fee72d", "comment": "Malware payload (Mirai)", "value": "b4d4760cc4cd4c7708c13608d0b1bfce5015c8a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789333, "uuid": "8b74ca34-27eb-46c4-bb62-743ceb394a66", "comment": "Malware payload (Mirai)", "value": "2d411797a43a5e1160b9fc1ef0f476615306871c4cdca629066ad4c300e63add3c808d9f9f418313c44911b72215c9b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789333, "uuid": "3c9589d9-59e0-4922-8546-7907e4d612f6", "value": "T1A0D34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789333, "uuid": "2339e514-7796-4749-870f-e8b9036765d9", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTqHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CgHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789333, "uuid": "9a6120ec-46d5-4e2b-8476-8684ccb57c28", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789333, "uuid": "6e9ac188-0ca0-48a2-a434-32f3b34f4dbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789333, "uuid": "aa88f42a-d220-464a-ab41-30a5113354b8", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f75219b9-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789337, "uuid": "84c42f50-916b-4d9b-9e1a-3c17fee558e9", "comment": "Malware payload (Mirai)", "value": "666e7f88461be0c54090ffe3a0056f3c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789337, "uuid": "2b9d968f-d2c7-4850-9e49-36136c2c79eb", "comment": "Malware payload (Mirai)", "value": "36529b76b8c3ada0d2b20b4d592e514e37f9fa834c707d193e3df4868d821ee6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789337, "uuid": "116153ea-6d22-4329-b32b-330f6bc44d4e", "comment": "Malware payload (Mirai)", "value": "b80bfea51998813e3718c6f3dff19c2d4c04ba92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789337, "uuid": "bc3d4ad4-760b-4e35-ad2f-5259eaa696ff", "comment": "Malware payload (Mirai)", "value": "8c5a6052d876d4488e9ba8a1cd387a075ec4aaf5bb71db50b1af836c0c83fff8dc3edb738c0927efa6a8f32d40ef6a84", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789337, "uuid": "cfa86904-eb89-43fe-b5f5-5047856887b2", "value": "T199C319067FB11FFBDC5BCD3B05EA1711118CE91A23A66B36B538ED18B64B24E06D3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789337, "uuid": "c2a0bccf-5f06-415c-9613-f3a3508caf6b", "value": "1536:XeuwlVo4NH+N3Fy9T98GuozInrzvD8ftNDpcBU2YWXyiE8hjZ9M:OzlVo4NeN3Fy9T98Gupr3QDh2xXydWjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789337, "uuid": "d4b226b4-5352-4548-b1b3-6525fae6ab9e", "value": 120738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789337, "uuid": "84534006-e711-4d0d-9cbc-cd5bb9db10d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789337, "uuid": "8224c476-817a-4dda-882e-d538b70660a7", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0e7475-4009-11ef-957f-42010a9c0016", "comment": "Malware payload (Havoc)", "timestamp": 1720759652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759652, "uuid": "98ac0a01-f5ce-43f3-a69f-6de22a311977", "comment": "Malware payload (Havoc)", "value": "69b4e52a3f1373a1f76d91d23aeddcce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759652, "uuid": "5a25a9ed-fb0d-430c-a4bf-0f2728e482e5", "comment": "Malware payload (Havoc)", "value": "37db74894bc92038ee310c7989705e56b21b559d9188931994af0b58b1752b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759652, "uuid": "591e610c-86be-460d-bdc0-adfc01d12ea9", "comment": "Malware payload (Havoc)", "value": "743b1921cb56245499022ae2fe1371e009c9de5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759652, "uuid": "a56f75f1-3c35-4015-99ac-8fdbed4e9f70", "comment": "Malware payload (Havoc)", "value": "65a2edceb6eeb79ca7a374af57685ffeae4af17ff3b2e13cb9456a3d5eb262c824a213e67bb68e16cd294569662f6b1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Havoc", "colour": "#BDC7AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759652, "uuid": "d6fffee0-d887-40e1-b482-48b355374055", "value": "T19AA39603E2A720FEC4A9C1B447CF7232FAB3B46C21346A4E5710CB552F62AB1767D659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759652, "uuid": "5615c336-aa06-47f3-bf7e-48945c66b2e9", "value": "1536:VkJIalOYktfCM83v6pq9UVE/kGE5+Kb+LwoMSJZNx5FOKdbF:MlITtfCMT2UVE/kOXMSJZDPOKdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759652, "uuid": "38df9333-e579-450d-b927-52ebf9354a7c", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759652, "uuid": "7224931e-625b-467b-81cd-2e3a0e210c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759652, "uuid": "40bfb9ca-598b-45ce-a4d6-acc8c289b743", "value": "havoc_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184f2552-4061-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720797123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797123, "uuid": "61581619-0be8-40e7-847b-999d8e1b78f1", "comment": "Malware payload", "value": "696b3679926998b45c806a1068ffcb75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797123, "uuid": "f7c0250f-e6c2-431c-b51e-3d5d9fe461c2", "comment": "Malware payload", "value": "393b1fdda7c4af084743c56c27585366567a8446c6438753d20b0b9ee3e72541", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797123, "uuid": "eb301616-f36f-4b6a-a2f0-ae9da10b14eb", "comment": "Malware payload", "value": "87a680e3018d3604eea9b1d28915fac5172f30df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797123, "uuid": "f61d04fa-2ad0-4c2c-b7aa-e36a2fb4c3a4", "comment": "Malware payload", "value": "17ec7a511f6007be596cafaa2c03557ecb38a1b87641df34ca90bc023e76ea4c60625bd107c1504521982b6becef1b1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797123, "uuid": "6c5a1d95-a4b0-4e7b-a18a-3c2537c8f13c", "value": "T1C3C77DD3B5D541E8C0AAD138C622A72BEA6F3C694B3193C72660B6551F33BD07E39B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797123, "uuid": "f68f5e16-df47-4404-a568-e5147e086bd1", "value": "0d54db7fa2e518e83dc2999e4a3a4172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797123, "uuid": "bb1325f1-2e5c-46ba-be7b-d1a35ee2ff46", "value": "393216:4Om6IAUAYVtWlwRJtmWYAosedwrsUbX1YcWxAnwt6Csu5h4Lj92HygC5Ou2hFJ4d:kA7Yr6wRJtmdDQo0urM5NQTng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720797123, "uuid": "174ea94f-e05c-41b8-a3f7-4241d50e0178", "value": 55469264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720797123, "uuid": "eb9b5d84-45f2-4c0c-9f97-5f01066f69c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797123, "uuid": "031beb23-ee2d-4dd9-a81e-18c61ca6a20c", "value": "BrowserUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0581a3ca-409c-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720822432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822432, "uuid": "ba1665ac-4857-4829-93e2-66e852485526", "comment": "Malware payload", "value": "13b264a8672352cf77814a1866ed9fed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822432, "uuid": "d3855af4-af85-4e2b-a254-77eff4914e33", "comment": "Malware payload", "value": "396d8f8db9a0b82e4530ab9da77971489c8a07af0bf4bfccbe8549ca3071b433", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822432, "uuid": "a65aa15e-1b16-4f52-a251-5a49f72e212c", "comment": "Malware payload", "value": "cc64dc7080a4a5f552de5d9089d29760f90c07b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822432, "uuid": "4de7f9d6-a9e0-4aa7-93e1-8ce3f4ef40dd", "comment": "Malware payload", "value": "558ba4ecb4c89d2d2bae3559b1c4682a9ccbdc91ae5325ebc9d0f4875275585ba491b9898334bfca6afaa7dd487692a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822432, "uuid": "57971f33-d2e2-410f-8171-e7b3c829c2d3", "value": "T17C45BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822432, "uuid": "030bfecc-7234-4a09-b6e7-0c4e647bf080", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822432, "uuid": "0e070fbb-421c-4411-98ec-c92f65a005c2", "value": "24576:mqDEvCTbMWu7rQYlBQcBiT6rprG8aLr2Sbly7TWEPje:mTvC/MTQYxsWR7aLr2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720822432, "uuid": "d7e7e9dd-7368-414d-b07a-e60d4ce7ddfd", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720822432, "uuid": "14969696-8e5a-431c-8e08-36a15ff3fe6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822432, "uuid": "66851ec7-7983-48b2-bc5b-ce98800f59d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904ba3ee-4098-11ef-957f-42010a9c0016", "comment": "Malware payload (njrat)", "timestamp": 1720820947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "bdab4c71-dc2c-4d4e-bf68-d5ca87097d17", "comment": "Malware payload (njrat)", "value": "77d0708dfc2b10c4a55c72e357cfbc4b", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "e14103e3-c657-45c8-b23c-a424299e239e", "comment": "Malware payload (njrat)", "value": "39c35ebf272140c777d40fc013f0306c44388340c7d942220ec15c1ca8ba8edc", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "878250bb-c763-4061-a7d5-565285b08db2", "comment": "Malware payload (njrat)", "value": "1e964900e08bbc976de121eb5d47779b20d57181", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "f2c4a666-ec2e-46a9-ae22-fe78dc0cac75", "comment": "Malware payload (njrat)", "value": "aa2cb6a0d311a1907a792631a07d8c94d44fa5cbc0ccf20945bedea71b00cc6b800188a083436b9bb93b42c42e5326a1", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "2e68dbd0-e17f-4bfd-8e93-8e9b704a9203", "value": "T1B2E2184A6BA89216C2AC5AFC8CB303214772D2478432EB5F9CDC84CA5B776D03595FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "60bc0647-c374-4a35-ba30-fe47ce69d354", "value": "384:H8EW+4HU36e65gSDl27F/JfXWTftTUFCqzFgObgv:bW303Qp27iigv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820947, "uuid": "5ce75c5b-436f-4fe2-a4dc-259522f749f9", "value": 33053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820947, "uuid": "053646ca-3063-4793-be72-8c138b429566", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "ab301e8c-f5dc-4c5e-a609-57bed4a9b55e", "value": "1720820945639046834cefdadf393663b7bb27f9954259241e4d4e975d0208fba9e55a1feb797.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c11e910-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720759012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759012, "uuid": "7f81fb7e-0ae5-4618-b6e4-54ead646127c", "comment": "Malware payload", "value": "da2f9b8627a659f74acb0476af3c2081", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759012, "uuid": "efb35681-365c-44ba-9507-d1217f2db53a", "comment": "Malware payload", "value": "3a1c46f41c7bc75e423680caaac29dae5ab20c43815df5f6a16b81df3bd6f1bd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759012, "uuid": "c81ea834-932e-40f2-bb9e-263a1eea06b1", "comment": "Malware payload", "value": "c7964194815a85af94f2f94f0c0576c128de3fc5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759012, "uuid": "a428e265-3089-41f2-8b29-e98ac0cb350b", "comment": "Malware payload", "value": "58ad9ce6563ee5eeb66451bb0850a0361f6ec859d4f74a40b0329b7bca9d52ebc46a308b760a11301ff2c728d8cc5fdb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759012, "uuid": "ff46619e-740c-4d31-8cd6-9697aebbfb5d", "value": "T10DB01222A42DE67CC0C2D4BC9C4E8C4D9D47B0D4652ACD5AF3589FD4ECF942157E0AB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759012, "uuid": "2e7f6add-dd1f-468f-9690-4700b8269d49", "value": "3:HRAbABGQF0tnyK8dIwJvZHwTIgQo5Sicuj:HRYF1FecIZoMicuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759012, "uuid": "33a7c659-33ff-4855-a481-019d96f726d8", "value": 109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759012, "uuid": "a08b0ea2-8e30-4ee9-8c0a-b5df87d7ef9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759012, "uuid": "f84609cd-0385-4964-9c0c-994ee6159ddd", "value": "1.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f965bd90-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789340, "uuid": "3e619522-34ed-4037-9d5f-194ec09b2a32", "comment": "Malware payload (Mirai)", "value": "e4474e84540a27edbe1b992b750c262d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789340, "uuid": "096c760e-7463-4b1f-998d-9dc87496024f", "comment": "Malware payload (Mirai)", "value": "3a53ed3b0bd92f58ce1e2ac679eb74d082ecb7d12175ea828ce3d2fd6bf5a024", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789340, "uuid": "414bdc39-a248-4231-8985-a95a6d636a5c", "comment": "Malware payload (Mirai)", "value": "7ee55c77dad9e53ef706fe730aa9289b642dc0e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789340, "uuid": "cb448985-6544-450f-802b-2de0fedf2f8a", "comment": "Malware payload (Mirai)", "value": "a019aa3754df3cd01880a768209074fd5945147434baafc6f08cdd76bec251fd7d9539e6e7c04512996debd1e2881cc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789340, "uuid": "afeb86e5-b244-49c8-91f9-a8050f2a3de3", "value": "T1C9833AC596A3C9B7C8820B7411A7DB774531F86A276DD607F36CAFB1AE03684704A34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789340, "uuid": "7f6d2c08-f276-478b-946d-2bcd81f6ee10", "value": "1536:Roz44tFVcAi0ceUIGYXoPpcyrdNpUZcmDHEkwfqjW46Y38gD:Roz44tFVcA/FXoPCEUPkZfqjRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789340, "uuid": "7ed51a01-9543-4ae5-acbc-f5a0a97aa436", "value": 81769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789340, "uuid": "7f7696b2-a94f-4ed8-8a16-46bf3407cc1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789340, "uuid": "f78f6297-fed8-428d-8b81-f51ff73a1fc2", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e455b51f-4018-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720766112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766112, "uuid": "71512e2c-7eee-47d0-8905-623682d384b8", "comment": "Malware payload", "value": "0d068b6d0523f069d1ada59c12891c4a", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766112, "uuid": "ca4982ae-0832-44e2-9036-79018dc2fbf5", "comment": "Malware payload", "value": "3a7dfc0850136c59104d362b11183a5a61511d056ef393f6a6a63fdba9bbb804", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766112, "uuid": "6632326b-5642-46ae-b272-b13f54249442", "comment": "Malware payload", "value": "9ad85457947b5ba0efea57fcb2df0653ac70c3f8", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766112, "uuid": "0db6b1ae-2900-4400-85d3-2d16073e8c09", "comment": "Malware payload", "value": "04e25c112c3b8c770cff227c76f7b12da4c1315576ab0a7f89a4448092808c3f4e961f055a03e65f9eb1376cf76ca29f", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766112, "uuid": "322a11f5-4823-452e-9300-fbeccc9ef2ac", "value": "T187A42337A6142682FEE2D201CB8762FBA7D2ADDF446C03E73755C442BFAA4DD954D082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766112, "uuid": "b15082d8-9808-465d-aa23-bc2d1f94975d", "value": "6144:iMusKSnGDpxll/TbXBUsN4xgaP5fWhP3mPhqvfoUsuok+aacxI4FYSkrNB2IUwN:DzaDpJPlNfwOhPmp4foNtknN1FnSRUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766112, "uuid": "d21edc01-1e27-4d42-81f7-952b03f5f2ec", "value": 467154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766112, "uuid": "6b0835c4-9dcb-45bd-8e06-000c9cc7c574", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766112, "uuid": "137b9134-fdf2-4111-9d38-f90f891ec5c4", "value": "3a7dfc0850136c59104d362b11183a5a61511d056ef393f6a6a63fdba9bbb804.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe710df-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789318, "uuid": "8619cf29-c796-4fd4-869f-248220152f7c", "comment": "Malware payload (Mirai)", "value": "33aad1479605658f060a33108ad750ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789318, "uuid": "a783a1f5-c603-4ae0-b5af-eeb740a1cf8f", "comment": "Malware payload (Mirai)", "value": "3bc1bbd11f8f225ee721861ef4f10d6b6728d0d333d64f832d3f20ebfb8bd560", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789318, "uuid": "75e41eb4-84c4-4782-a46c-34757238c779", "comment": "Malware payload (Mirai)", "value": "4a407e1c7a58f0c96f2b671073f63769a77386c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789318, "uuid": "5dd6239b-8c31-4a93-ad8e-3663d1dc3808", "comment": "Malware payload (Mirai)", "value": "7e72111f2c77525a41eedbaa59b6395513c68aeed9f5e3e2aead7712bea515c546ccade186165ca7f5d9c5e91a788977", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789318, "uuid": "42708749-f3fa-4f7d-aaa5-0cb0b5994ec8", "value": "T1E1932A41F8818A16C6D523BBFA6E11CE332567D8A2DB71039E316F6437CA42F0D7BA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789318, "uuid": "add1a39d-0372-4204-951a-93ab9dbb2a22", "value": "1536:NLYUBU5UqUSxUMUVAqu/cb19iYjXrRZmQdSo1t9/wwES196/uvZJpEBFFbPMsdnp:NtiaXSSBAEniYT9Zm0H6w/9hBToFFbPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789318, "uuid": "5dd229ce-b5dd-4851-9c7f-e368c06c9a2d", "value": 91284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789318, "uuid": "2146be54-dd08-40ed-a3df-72569829c5bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789318, "uuid": "51e5fa04-8034-4c89-af3b-b3f283978378", "value": "jade.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e73a11-4009-11ef-957f-42010a9c0016", "comment": "Malware payload (Metasploit)", "timestamp": 1720759645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759645, "uuid": "8a992577-0859-43de-be5a-aef038689561", "comment": "Malware payload (Metasploit)", "value": "18910ac2702a44f37693274a0508e3fe", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759645, "uuid": "963cf18c-1ee5-4e33-b816-918578b9ed32", "comment": "Malware payload (Metasploit)", "value": "3cb3dbfdbd33a2e1f7f3c2a15f2735dc093e88b4f0e286181aee7cda40407d81", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759645, "uuid": "56add981-df8d-45a1-93a7-1667915a5cbd", "comment": "Malware payload (Metasploit)", "value": "3f88819771b1dbfb9769c11daf9ae7b57637ac37", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759645, "uuid": "0373ab9d-33e8-431e-84a9-a2039f479b24", "comment": "Malware payload (Metasploit)", "value": "2333cc829080f30287003b348486c1a151b363a5ab5be4eed39725ab1125c7a30289b91e0868f9888e5e12c1df737d80", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759645, "uuid": "4b384afe-95ca-4ba5-8e62-bf7ee1ce2ed1", "value": "T10E22AE3647696369D00316B84F7F216BA53BC649A2597385FC08B38F8131D903FC19E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759645, "uuid": "e0b0cd2b-8cb7-4a78-b625-9a59fc1a3ea6", "value": "192:6Lt7+5NEHIII6W/onkfQxX4PNX8VnzCB4kFf2qhoc9rpxVaPNe:6LtrQ6K9fQxauVnzCGkFfrhx9dxVac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759645, "uuid": "69629273-9bbd-4024-8d6f-005d224798b0", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759645, "uuid": "c730871b-d8d4-48b0-9bac-b1859bb1fdce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759645, "uuid": "50dc7b6a-c717-4deb-a92d-33222d4acdc1", "value": "HealthPhone.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159477f4-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773496, "uuid": "18ec4dd3-eee8-4d78-b677-930fe0fbe5f6", "comment": "Malware payload (StrelaStealer)", "value": "fcb6560bd0cb32ea9912b34a5990dbb1", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773496, "uuid": "0593243a-9f70-4218-b57f-236bd3ad5d74", "comment": "Malware payload (StrelaStealer)", "value": "3d5197e1537fa9409cb478784a794bb1163f3321ae77da6ac22e56b4f017af4c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773496, "uuid": "b83cb926-c6a0-4929-b334-3704f660f483", "comment": "Malware payload (StrelaStealer)", "value": "c69ee675e0094824cce0baf58297c40495a71d3d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773496, "uuid": "9175c630-3ffb-4b2d-a42f-8d48cc9d38f0", "comment": "Malware payload (StrelaStealer)", "value": "a5de9929d1d115635f3ec4e3dd6f9ee486913aca53085ff116339433f8b80464fa395267bfee67dcbe94ea08344d36ee", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773496, "uuid": "9c0590c8-ba31-480a-a3d1-2dec5bdbc3f3", "value": "T15341AFCC72B172B3D38E15D93ADC196281016BB127A2D9B8452DDA2AD85388FC9F310F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773496, "uuid": "6073c4b2-67e3-4673-a2dd-e3583a5bede0", "value": "48:kC1P2ACocrqyYhtTgFgUVVVRwwk/FeVVVRwwkNLC6A:+JalNLfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773496, "uuid": "2daaa7ca-387d-4ef9-ad72-d461aad526d8", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773496, "uuid": "0dccc9ca-eab8-4476-b29d-50d752201536", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773496, "uuid": "a13f40e7-de74-4feb-95e8-bef93a501de6", "value": "3d5197e1537fa9409cb478784a794bb1163f3321ae77da6ac22e56b4f017af4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36c24b6-408a-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720815100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815100, "uuid": "761e0404-0dbc-4536-b911-ad58ef78de0a", "comment": "Malware payload (AgentTesla)", "value": "99af50ba5059f85a1c8bd15ecf23fb3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815100, "uuid": "f92f8f9a-9368-4cf4-bca5-7c82f1bebc6a", "comment": "Malware payload (AgentTesla)", "value": "3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815100, "uuid": "d6cab5a1-cfa4-4144-9dc7-3438a3e508a0", "comment": "Malware payload (AgentTesla)", "value": "276b986f4a09fc2dd4df54df5ca32817096f1318", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815100, "uuid": "14e60d98-b82f-4fed-be80-5e23da6c3c20", "comment": "Malware payload (AgentTesla)", "value": "ab72c737e3a48ee36aae664e727491bef4a1f37cabc50c4a539ff61ef87bb9e0b9381dc820a7d515704185105b97ca6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815100, "uuid": "6193c13b-a3b4-4f59-8f44-c746e68a745e", "value": "T14035CD86B2838D17FD9546B4C8D6B0F955FD6C63B8F9880FEF913E0A28722BD4194174", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815100, "uuid": "b3cdd21a-a251-4e9b-bd95-e97a9cc5d734", "value": "12288:PaCIgcZcoaREnONS7zCm4ry3tr/QUC7z46a3c:ygec+OeuO9r4UiO3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720815100, "uuid": "9ae551d2-dee3-457d-8520-b06d2a8057c9", "value": 1090376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720815100, "uuid": "b0c2170a-4e7f-45c5-9e14-44eef02bba36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815100, "uuid": "a3e251f8-e110-485c-98eb-6811cbea87df", "value": "Milieuskadeligst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2595c50-4029-11ef-957f-42010a9c0016", "comment": "Malware payload (Vidar)", "timestamp": 1720773330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773330, "uuid": "5b41f5ee-fb46-49dc-866f-9d6426d40068", "comment": "Malware payload (Vidar)", "value": "5715f2100028b28f508559c4782daa5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773330, "uuid": "c81719ce-d152-4c7b-bb93-58bd42f5a9ae", "comment": "Malware payload (Vidar)", "value": "3ef1d040731916fee2fe1317c53a0e363f05fd12f87b84563af86ac5d49f74c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773330, "uuid": "ae7e0d03-5c4c-4740-ba06-06ddeb582c41", "comment": "Malware payload (Vidar)", "value": "f15aa6ce0470b63d98406f3a4821675a2bb45732", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773330, "uuid": "e2c84c1d-5cb0-4222-94a2-0f680443a521", "comment": "Malware payload (Vidar)", "value": "d19f6a6aec4f34859167ab071d0b1b17a3e6428e234b1fa4742c7bab3e3d79e0ff82bfdd5d3ed2462cd91664cc3c3a25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773330, "uuid": "b212b651-2453-435a-b46f-ab29a7ed1c55", "value": "T13C15230A4FB94517DBF08EF420A685536DB7E60168FC548B2A01CFDE3532FD15879A2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773330, "uuid": "d8e9b99d-22de-45a2-94c2-ea497b004ac0", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773330, "uuid": "cc716e8a-f724-4786-8e31-e5e863934881", "value": "24576:I+e7iVe757APGlGVu2nzlsQAaibE/1lrGAipWX:k2VQ57TAVPnzlsQAPEjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773330, "uuid": "48d9a7a3-a33a-4a5d-bc45-e1fec3c4306d", "value": 914616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773330, "uuid": "3b205b31-7aa3-4044-af59-0690f330b7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773330, "uuid": "e3b56ea2-4e6d-4f77-ad15-d109bbdf633d", "value": "5715f2100028b28f508559c4782daa5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49540c3c-402b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720774012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774012, "uuid": "6b1e8064-1301-4107-8360-914ae6cd6b35", "comment": "Malware payload", "value": "73fb9185870fd4cc6931023b873112a2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774012, "uuid": "06176143-f34f-462c-bab8-d12c02660300", "comment": "Malware payload", "value": "4098062d433518dbea30c49b0905df84be8de1fde17359b589aac16a8c04b72b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774012, "uuid": "d07925b3-114e-42ff-877f-68461074d5cf", "comment": "Malware payload", "value": "dbba95c178c3860e7d314d6c4b549040aa162e5b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774012, "uuid": "4cf9dddb-3fa4-4ea9-86a1-5491990578fb", "comment": "Malware payload", "value": "05a3880294ff6ad6f38b3a85eae96cdddbb76db6d126b786068f664dbe83d4394bf6a7f80d85544dce8b87e84ea24ef7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774012, "uuid": "c2c3d760-72d2-409e-bfd5-9563bf56e3be", "value": "T16C41BC88B3C236AE7BDA49053B24C1B0C14109B108AAE138693CF942FCDBF4C54E38DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774012, "uuid": "6d85f8f7-3a57-4303-899b-f1588eba8e83", "value": "24:d7NIQBF+Yeftv/03hyFaevr+hNBwoNorLejomnguIApO444TvhfAoApO444TvhfU:RBF+YOtv/fIevr+hNBBNomjrrhfohfit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774012, "uuid": "3d22ce2f-31d7-446f-b091-b8b20dcfb762", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774012, "uuid": "2fadf93e-63c7-4da6-a310-622494f194da", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774012, "uuid": "5fdb157f-8787-4cb3-a383-41264b61a879", "value": "195088682237351719.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f831202a-4059-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720794063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794063, "uuid": "5683424e-b70e-4eea-9049-57686f801d87", "comment": "Malware payload (AgentTesla)", "value": "3937a7d464979e7a2342cb40f41cd38f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794063, "uuid": "15574ecd-5aaa-44f5-b0b1-ffb3eb85fdae", "comment": "Malware payload (AgentTesla)", "value": "41dc49520a04284862f964c44e15be7ff2959189038120949399c523750b255c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794063, "uuid": "27a7cd0f-b3dd-41ee-902d-2a8e08ccff97", "comment": "Malware payload (AgentTesla)", "value": "444161a9ec1c6877b6bcac16e9e37ebe3dd38d8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794063, "uuid": "a374820b-eb5a-46ca-a0ef-934442bb404c", "comment": "Malware payload (AgentTesla)", "value": "4a0e76fff62c41006b92b09b491e9530cb930f5e3d7d79c8bd90d7c174639701bb39c0818b2734984417ec1a8e2d6d83", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794063, "uuid": "7540d44a-5a21-403f-949a-f66a742693db", "value": "T17DD4232508369FE9C3E8E9F9917EC7032C2E99224A9EC3F17ED0ED56300469B5764736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794063, "uuid": "463c59ba-97d0-4c75-85a6-95218962fc5c", "value": "12288:Xqw9tbzyEtQw6janZwZrJSvfmanYWe+lT1Y86Vpv2qLyZM2Z1nrn0M43JndWx:awjzvh6janZI9ozLC8HWWOWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720794063, "uuid": "af8ecb5c-afa5-498a-8089-eaa020f1ec2d", "value": 604399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720794063, "uuid": "38759c07-ce9a-4fcd-9a05-bc3c5e7524e4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794063, "uuid": "e75877d9-ad3e-4fa8-84f2-253ac21fc8ed", "value": "nT_DCB_130TAK_SAGE_T.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae06b5f-4068-11ef-957f-42010a9c0016", "comment": "Malware payload (Gafgyt)", "timestamp": 1720800375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800375, "uuid": "20c467ea-f64f-4a71-8c42-c5d0279208df", "comment": "Malware payload (Gafgyt)", "value": "444cfe2d8e991662dc0671f0e65eab21", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800375, "uuid": "2808d49b-2133-40f2-a2a3-fb12e19dafa1", "comment": "Malware payload (Gafgyt)", "value": "4241e30384f3b58e25d530354bf33bd5d2ef9ff6ee2d7b646400830a67f59f42", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800375, "uuid": "3f869fee-de0d-4636-85f2-90da65732de7", "comment": "Malware payload (Gafgyt)", "value": "deaa030d024c1dcd68d14c1ccff4bd8c5c2db711", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800375, "uuid": "74396dd2-3c33-4930-9f24-fc93b102506f", "comment": "Malware payload (Gafgyt)", "value": "d1e01323e040ecdb145f6cb9d7fbef2ada7226536e278ed18e9fc864db51f958fb882fc173539792f183776f17ddd698", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800375, "uuid": "ab478733-3001-490a-9624-51a5301a8f09", "value": "T145B37C03D661807BC1CB82B11BEF96565923F4FE077A310363D4AEE42F055959EAAF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800375, "uuid": "40df79f5-647e-46f2-a788-98b21e20e11e", "value": "3072:tSjpjxAce9hOQpha0npjBcwnQxdm1RWaLHvb4:mpjQphaQpxom1RWaDvb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800375, "uuid": "2ed33196-3a34-4693-8aee-a89319494867", "value": 110270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800375, "uuid": "12744f3a-9734-423b-8310-9fdd4ffc74cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800375, "uuid": "dfb3b2e8-6284-4917-9f22-12c6cb1197b9", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d3f8770-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773992, "uuid": "41192066-2cdb-4300-8e55-75d0043d8b62", "comment": "Malware payload (StrelaStealer)", "value": "b6a36d8cab0dc35d2c7d8c75ab6dcc27", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773992, "uuid": "c35d4ad0-03d7-40f3-8f83-3dbffbfcd9f4", "comment": "Malware payload (StrelaStealer)", "value": "4256eed5619c39f534b5e9a5b939628d320b56a656e2f3b3c228641e2089bdbc", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773992, "uuid": "d98ad629-641a-4497-af20-f257f6dcb240", "comment": "Malware payload (StrelaStealer)", "value": "a3982ec1a2e0d208ad5e0a8f3e278651a3d90f4b", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773992, "uuid": "f40dde80-79b3-4469-8259-3d850f42fbb0", "comment": "Malware payload (StrelaStealer)", "value": "9426c7849307885a9d309d0932583165a55998567ccf6f4ed1688864e6fd9d52806f75e78ed99ad0607f5bdd369db8b2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773992, "uuid": "914cf866-2e9b-43b5-9ea2-12eb96de8eea", "value": "T10341E4E71FD9702BADEC4620BC45088550BC063994F0EECD95A22927DD895BC1B3EDB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773992, "uuid": "6c183343-1e58-4526-a1e1-b5bd49296666", "value": "48:b2uj5eObknTYfBLdxXmGSoGjJXA+jEbdYrimLymhjP:Cv56BLdxfSoGZA+ydeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773992, "uuid": "aa9413e3-d8d7-49b4-b37c-9d90848023f7", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773992, "uuid": "e9eb0795-c38f-4d83-88c8-393ee449183b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773992, "uuid": "8d7849e1-06e4-4ca8-bf74-e52de772467e", "value": "306981021354922567.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57d8b27-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774274, "uuid": "2ff7e70b-1842-467b-93b5-f795994d9000", "comment": "Malware payload (StrelaStealer)", "value": "bb2cccb407fc870b46e11026edf91397", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774274, "uuid": "ebd9c953-2468-4017-bd2e-73bea297400d", "comment": "Malware payload (StrelaStealer)", "value": "42c66434b57c03f453c9afabd745673c6962fdd693a7e2d46dff6a050cbb6b85", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774274, "uuid": "1badc61b-6192-42fd-b47f-89c14f0a5d89", "comment": "Malware payload (StrelaStealer)", "value": "845c2f94575b159e2fb0c7092e003aad41d296ae", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774274, "uuid": "f4852e5b-6fca-4598-8825-1d321972a8a8", "comment": "Malware payload (StrelaStealer)", "value": "aab4c2dd8c4e6e1b4b8751f724d4115d91e237b5875da9321f87ede8c0ad29d98f4d366957108bbadb7d71cb46cd1aaa", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774274, "uuid": "24e1eb68-6861-4b79-87a9-f0d7aea61b25", "value": "T1F54117F0A36B3E4A19CC398BEC56C244345579FC447AD69EE0A78555CAF888D6F831C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774274, "uuid": "7a916b5b-547d-4099-a032-f6dd251c2065", "value": "24:V+ajpYXj4UQHrDOMGsI0QayyYWLeDGxMdAW1X1jp5/W/aDoW/aD/sh:+UUQHrD5G3vZ7Y2G6dA81l5287eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774274, "uuid": "55a2fe4d-1faf-4ac2-87e6-06a3c397fa08", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774274, "uuid": "3de86080-8a0b-47bd-824b-57da6c9979f9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774274, "uuid": "29e54059-2b36-4637-9575-8d1f6cbe5f3f", "value": "42968460261693320.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e77b6d-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720759000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759000, "uuid": "44c54ce9-6a2d-49a7-83d9-0bc52ac5331b", "comment": "Malware payload", "value": "185fe453685cf876171f94ac35bdcb8f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759000, "uuid": "85947a77-822f-4ce3-94ce-53b12d1adf4e", "comment": "Malware payload", "value": "43da0f0c73566bc79d7cd4e00f9765774829a00bf25888aaa8b3a4b459ce7bd8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759000, "uuid": "e0759a48-830d-46c9-9096-64870c831689", "comment": "Malware payload", "value": "c8901069b78b439299676d000c27e01e52b265d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759000, "uuid": "11bcaa2a-057f-4c6b-bd24-25691133daa6", "comment": "Malware payload", "value": "9bf3c0506bb0a7e5a4f145e96995ddc80dcd25714f99b420d71ac1ef9a5679f999956ebb77749d912a57e5742ee3a54e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759000, "uuid": "1bb5de33-28b9-4a3f-bf6b-c913a1d7f6b5", "value": "T18EC02230062A88A89E9188344C784828CE17C2A2B456EC9EE290DF2DEC1141302C0270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759000, "uuid": "432398e2-8a5c-4470-82dc-1636ec524ba5", "value": "3:HRAbABGQF0tnyK8kdeDdT6o8USJvVW7i7tVKLXwLvYscLygXTSL9ZHw2SP41u1uj:HRYF1FEl6FUycUUtXT49yP4Ouj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759000, "uuid": "52eee264-ae89-4dab-aa8e-3b442b4276ba", "value": 186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759000, "uuid": "4581a6cb-d0de-419d-b673-3b4f3710925a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759000, "uuid": "57ac562f-6c1b-4953-b3d1-a6cc9623c6b6", "value": "test1.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41c29d5-4073-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720805142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805142, "uuid": "74bf8c77-c924-43df-a8a9-3461fb1e15d6", "comment": "Malware payload", "value": "60fa7bfb474957e975a77df41e4f2a64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805142, "uuid": "6b65ea21-c5f6-4cc1-912c-6143269955de", "comment": "Malware payload", "value": "43f642d51a1e2e2a5dbeb9791b621e7617d4509c9fe0a44197aebb37ba10be24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805142, "uuid": "69e49684-b4f4-4572-9935-0a7b8a66a485", "comment": "Malware payload", "value": "d64554a572210a509027d5b923b822159b5d2903", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805142, "uuid": "7dc961d4-bcba-4c21-91aa-f3f9a304facb", "comment": "Malware payload", "value": "9292b3227d0d2d17e04fa1897b5f5c7f9bca942229c2df849e587d255ba2719e1cdfe3fbd9c475ab552be00a93c2bac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805142, "uuid": "882a6a6f-2b81-45ba-8361-8e5ec395eda8", "value": "T161762301A3C69475F76A1A7594B885200F33BCFA4AF6C26E1CBCF56D2B736869C31721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805142, "uuid": "8768b4b7-203d-4a10-9b35-09fb5fb4dbd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805142, "uuid": "49517d7c-bb7d-4d0c-81e3-2a8e6efd0721", "value": "98304:etlBC3ygOGRBuvCO89yILGGIVk1aLg4mLJgO/zuEPo9I+FQO4if5:i+R3O89yIL/IGILg4ogO/zuRxTf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720805142, "uuid": "5e4d1d43-d1fa-4f24-9fb8-d34b3f2e7961", "value": 7341568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720805142, "uuid": "c8d036ab-ec5c-4eb5-9779-91e9a1e7895c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805142, "uuid": "4901555e-986f-4f62-ab07-e3018976c7bf", "value": "SecuriteInfo.com.Trojan.PackedNET.2968.12552.16499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee87cbbc-409a-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720821964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821964, "uuid": "587b6cf9-0174-4cb0-8a27-fa306516c6c5", "comment": "Malware payload", "value": "942c50b985dc1e6eb49c1763d39d398f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821964, "uuid": "79ec53e1-475d-4f5f-b546-d2b150307e16", "comment": "Malware payload", "value": "455f3956ac0f7082228d48ed98ff0ea1d6f2cef1c01f6dc263502696e6a9a5b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821964, "uuid": "d26fc313-3f74-48bd-ad33-457fff263113", "comment": "Malware payload", "value": "9de6943387aef034ae9d2eab93f4ef557aba7ad2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821964, "uuid": "5bcebd3a-f587-42e9-a0c5-430044a1fc1f", "comment": "Malware payload", "value": "4e2a1eb17985eecd436f3589305b32ea569783b4fdb635833440ee5b6d1545505de36130bfc238ca4ad7f556e3d7aa79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821964, "uuid": "c825447a-9afa-4793-9baa-8d6f3d1520c1", "value": "T1C945AE0273D2D036FFAB92739B6AF60156BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821964, "uuid": "882b99cd-6dc0-4a64-8b93-943f1f5de618", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821964, "uuid": "bd3d9896-57c8-4c91-9c9b-ade428f74722", "value": "24576:uAHnh+eWsN3skA4RV1Hom2KXMmHazbg6J7wZ48VXAEiK5:Zh+ZkldoPK8YazbgrZ48VwEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720821964, "uuid": "99477c92-eeb4-46e9-8139-db13e35427a7", "value": 1190400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720821964, "uuid": "3844ede9-1d54-4546-9598-836ed50994e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821964, "uuid": "9bab2724-6b3c-47bd-a421-f18572673a14", "value": "docs_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8060ee-4064-11ef-957f-42010a9c0016", "comment": "Malware payload (PureLogStealer)", "timestamp": 1720798793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798793, "uuid": "f522c5c7-7b48-4403-af6b-64d15a5cd06c", "comment": "Malware payload (PureLogStealer)", "value": "73e3c089e5e10d52872ee4f434bd6d23", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798793, "uuid": "1fda8a7c-7b93-48cc-b4b2-69be6271d8aa", "comment": "Malware payload (PureLogStealer)", "value": "4589cef24c0d5800c245c74d5b4c3f38bb5bc5893db52a58740a26b011ebe4c9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798793, "uuid": "1bfff265-9e42-4eb7-9d76-b887c681b9e2", "comment": "Malware payload (PureLogStealer)", "value": "13ad356c27f6832ecaae6b63afd1c76f00bcac63", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798793, "uuid": "c53a842d-1e5f-4dee-8200-c14ce5218445", "comment": "Malware payload (PureLogStealer)", "value": "c6cb824c1360c00b95176e5b63b516bab874278fe98bfd15134cf78ded4dd13780584634e81d1b6980af850525cd1517", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798793, "uuid": "2fdf8e92-ca77-43f9-afb7-29b6d16e8fbb", "value": "T141C5331791C425B5D5F403B484FA41835272787B9F7680EB2ED5B53BAA23BC0A273B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798793, "uuid": "8f2fe3df-b89f-47fa-a3d6-8b19acedc2e5", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798793, "uuid": "06695068-358f-4766-87cb-e640989dd78d", "value": "49152:6bSt0H7n4mlQkG8XeAaMHy2NAeuVZSWloP7Fs/KDi/ZOEGSh3:kDNLeAaMHyKiHKDIhR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720798793, "uuid": "a76977cb-d7a6-40d6-b5bf-70300d4c3878", "value": 2648064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720798793, "uuid": "bec6020d-1d0b-4065-8245-6fb641ec1029", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798793, "uuid": "b01f7840-f550-4cbf-82c1-28451fa4518a", "value": "73e3c089e5e10d52872ee4f434bd6d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1944cc-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720756144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756144, "uuid": "f439e8f2-d6f8-4bf3-b872-d599109537b6", "comment": "Malware payload (AgentTesla)", "value": "c6d0fe71ae3df37d8a18d20ec3f598f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756144, "uuid": "60e657e3-b836-4daa-8794-37d1197c536f", "comment": "Malware payload (AgentTesla)", "value": "46c33efe5265103aa9219ef7e86364fb610a4e809ba89cf8c0bcdde3270957f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756144, "uuid": "d14b77b6-a21c-444e-b698-59048b850cd0", "comment": "Malware payload (AgentTesla)", "value": "98e8320a02dfff1e65368a8b1086f6ba7a93fd49", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756144, "uuid": "d5c9cc4b-9e4b-4ddf-9d88-9b928f9afa0c", "comment": "Malware payload (AgentTesla)", "value": "1798c1953204d793d121b4900d6eb6a6d48ebfd3abcdfad382b5580d72f7383ef610fbba38b3c2e85f5bcd5a6fabfd7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756144, "uuid": "5302abe2-dc71-49dc-8918-3df4a3f5931b", "value": "T1B4C423939C307A10B87C9C5A86DB68B1303C34494FD8B7B85D265DA3CB66B7B2B15CD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756144, "uuid": "349e5136-795e-4a28-8279-ea38d9eaf590", "value": "12288:l7wn8leDsYqYvD53PyGHITGlYUMRhBEV1HxF62nq7HrsVMy:ly8lbYqYvl36ud6hqR1Mc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756144, "uuid": "c062122b-9ec3-4577-b113-9b62cd3067f7", "value": 560558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756144, "uuid": "e48d2bb3-ad9b-42e3-9fed-4e071ea8d387", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756144, "uuid": "7fbc207c-9644-4cb6-ba4c-1f946ccb10f5", "value": "ListsPTKBS00107122024.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca853b4-407a-11ef-957f-42010a9c0016", "comment": "Malware payload (Stealc)", "timestamp": 1720808136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720808136, "uuid": "84ffd0dc-aa73-4156-9ac5-f5ebc5303f40", "comment": "Malware payload (Stealc)", "value": "eac898724c96f19f3f2a7137720269c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720808136, "uuid": "17607c7f-2bcf-4bf7-8b43-b40c636db9a7", "comment": "Malware payload (Stealc)", "value": "475edb8959f811cdf9b554d8707efd56906a8ff4fc2888a68d2b3a556b6e8272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720808136, "uuid": "fc26876a-eb34-4c19-9965-ca805f494e12", "comment": "Malware payload (Stealc)", "value": "a1902aab538cdfd3dd490f77314b4dbec26b3fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720808136, "uuid": "4a5df16f-495f-4762-9acc-0ccd25be8a7a", "comment": "Malware payload (Stealc)", "value": "b442bffe6b8196b8f3d49d54247f7d0ff2b07fbc960580af324bd494a00262dc81f476d6b799fc32fa0888c309442661", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720808136, "uuid": "c7003215-5a83-4ad6-a190-9b349ddc5192", "value": "T133C533E2CF39F900F1F827B13FA27E6479E1D0CD5A005557862A7871472E6CA4E26DAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720808136, "uuid": "5abfb9e0-c293-47a7-bf07-4d57ba88a0ee", "value": "001806c33a6e9fe5fbff34bdbd79b591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720808136, "uuid": "c4777fde-eeaa-49c3-94b7-d486b8da5413", "value": "49152:A36yDo6Ez/9rKthJ9mug8zgyuIO639vKZaoCow9Ea9W3IKguisk57jnqnpTxL:w6Fmth3muVflh9vKZaoPMvGIJskdjq/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720808136, "uuid": "bd433805-e01e-4615-95c9-195ef0c036ae", "value": 2513408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720808136, "uuid": "8601af52-9263-4220-8a3f-810e84797cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720808136, "uuid": "a7799076-c688-4aeb-805c-7d826cb6c54e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd3090b-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789348, "uuid": "6b113813-0e83-4f6c-908b-b1752951c180", "comment": "Malware payload (Mirai)", "value": "69ce5afe072fa6b0b437c33a51758a57", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789348, "uuid": "c944cda2-6bc8-46c2-ac0c-cdd5625529c7", "comment": "Malware payload (Mirai)", "value": "478834fc5e5ed423c54c2533011f6892e678b25b74843f541543aeeac5460836", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789348, "uuid": "15755def-5a59-4495-bbf0-d8f8991b208f", "comment": "Malware payload (Mirai)", "value": "c36fb2f11179a0b5f9ee9621eb33febd36cc5832", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789348, "uuid": "e3057ba0-3ed6-4d86-8fff-70e587ad17ef", "comment": "Malware payload (Mirai)", "value": "0ace29b9b9b4b94d3d24cfffbfb565c28aa7c6e74e978a3817e97138a12f189e0beb62bcb6c2f49a8addfa81e16069b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789348, "uuid": "248078a1-282d-4fb3-9281-adb5e5c8f287", "value": "T16CE2D15EF9D0768ADDCC1477567707717A0260A074D76BC1AB018688B177D9FBCC80D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789348, "uuid": "0da61424-5f3e-414f-943a-e08cb8070cc9", "value": "768:ZmieP10RD2EnAJ2kgKNnyALwALPsq2sRH3DJKW4:kpPgVnaD2ALkbWzJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789348, "uuid": "8ba4ad11-a5c3-4586-937e-d82065c0fddb", "value": 32752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789348, "uuid": "ba7649fd-6266-45d8-814c-a4aba684a225", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789348, "uuid": "14a802be-8d0e-41a5-a5e2-104e45d37793", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb0255fc-406b-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720801772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801772, "uuid": "f9663480-0a8f-4948-bcd8-2acb1563ab8f", "comment": "Malware payload (Mirai)", "value": "885e793e4f1046bb42981fa625feacfb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801772, "uuid": "ef72170c-43c8-4096-8f81-1fc98e09c7b2", "comment": "Malware payload (Mirai)", "value": "493b2910936164c92f0e683c85de5c3c12932180eda6a99e4ac94dfe0af1f39b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801772, "uuid": "940fe963-9edb-47e3-add8-2e0ab16a2583", "comment": "Malware payload (Mirai)", "value": "9bfa0ff910170d445ad4d4f6e7774414075dbb51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801772, "uuid": "e1e75137-c219-4a42-89af-10a3e9c4150c", "comment": "Malware payload (Mirai)", "value": "9130886d899bac05c0ad58d3548d984f3f62c5114ce02021ee367ec6062ad9866ab45ed92707c54903c4464c728c9c93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801772, "uuid": "274ee4e1-1cb6-4197-93d8-c5eee13e2276", "value": "T1D1732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801772, "uuid": "8d30e711-4550-47ed-aab3-201c54608abb", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftc7nA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFO7A5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801772, "uuid": "2c34fe99-d9c4-4e78-af70-128b7f69e929", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801772, "uuid": "08682ad9-cec7-46ce-af56-ae996ad3d2f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801772, "uuid": "2b622387-c0f3-48c8-9ed9-d143d5f65a01", "value": "885e793e4f1046bb42981fa625feacfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39610212-404f-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720789448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789448, "uuid": "15a2e287-3cc1-4454-b784-f765028bfb1f", "comment": "Malware payload", "value": "87c2dc66725ff92ff59f41da57929879", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789448, "uuid": "15057161-8379-4e44-8aea-02b29ae45d20", "comment": "Malware payload", "value": "4941e4d3a957effad786177b2b2271525a5fc25401f01dd2554a635019059921", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789448, "uuid": "3e337192-dfe3-46dc-a990-78ef096f80b2", "comment": "Malware payload", "value": "d153d492a2a80d675026bb9917090bc5cd5057f7", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789448, "uuid": "09c7be55-0612-4308-9f28-be5d08e4d7a7", "comment": "Malware payload", "value": "271c39d1d238e673e966ec6405425ebc367c015eb35ee821c127ed79dc02f8d75a6e7ed855cde2f4e8d7391a6e09ddc5", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789448, "uuid": "b6959df9-cc7a-44ba-a1df-eb3ffd2100f8", "value": "T183A633BAEBFE3E5F2DC782BF1651F238DB8C92AA86D444BC4F12763426D12195D30065", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789448, "uuid": "e7b9312e-7ff3-4e36-ab86-2b1e3d775812", "value": "196608:KoOakNnXOqwqwgqbskMuKB5B/gau9gfKJSonyOku5qz8ApEtJ+moSYnQ456:KoeNnXOqV0kB/HKJIOku5c85tQZSYQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789448, "uuid": "80995ed4-2313-4ddd-82d1-63eb9f582118", "value": 10112295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789448, "uuid": "fb0624bc-0259-4610-be6c-68299e4c1a49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789448, "uuid": "a399d2d6-53cd-4554-8d52-1dc4a8228c66", "value": "Xz1z1QPsm.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcbf1c3-4030-11ef-957f-42010a9c0016", "comment": "Malware payload (RedLineStealer)", "timestamp": 1720776248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720776248, "uuid": "9e24f995-0b57-416a-8c9f-986eefc22b84", "comment": "Malware payload (RedLineStealer)", "value": "6cd1d78e7371864e3bc5b38dba7f4b42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720776248, "uuid": "9353e8f7-6e7b-47d4-9f99-6485e7a8ea2d", "comment": "Malware payload (RedLineStealer)", "value": "497b340d509298c988038c250468e3173d2345502dc54d90a2a1fbb75367735d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720776248, "uuid": "f720a76d-b96f-4a7a-999f-8e346ad83ada", "comment": "Malware payload (RedLineStealer)", "value": "3f602097ff391bafe3e3d3102e521f4efc28a893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720776248, "uuid": "cfbd19a7-3001-416b-8c40-573822e08d8c", "comment": "Malware payload (RedLineStealer)", "value": "4979617e149de0cd5bf115e63f031f9b2d2d112350c1a67b91a3cad2d4a4d536ca6a8e4787dee38200dcd6f688e2fb9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720776248, "uuid": "47ab2781-4fa7-4d59-8cd4-85a3e2f53d9b", "value": "T115E41216A3E88032F9F62BB058FA43E30F37BD969878461B23559A6D1C73550B271737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720776248, "uuid": "03fc65bb-5872-4413-bad9-b65dcd866ce9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720776248, "uuid": "9320be90-4f86-47e6-97db-4b0d22bfe97f", "value": "12288:aG78y90JidZJhpS1fS17xSG6zKIBuK7C38fymaRnDMc1BFLHnh9fYI:EyDdNt7xnEo+CkcBFLHh9AI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720776248, "uuid": "f0b4ba19-cb85-4ff1-b2fa-e1d845801f58", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720776248, "uuid": "c747dd65-ea34-4842-b22c-ba89311138e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720776248, "uuid": "12125fc9-35f2-4513-b670-9b8df57de1e3", "value": "SecuriteInfo.com.Win32.Trojan-gen.8681.30993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa128315-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789341, "uuid": "ff9f1aae-d0c0-408d-89c1-5fae5373a1d2", "comment": "Malware payload (Mirai)", "value": "3966298930d053177b4ef18ca32ccc93", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789341, "uuid": "c2921d32-ab1f-43ad-9139-9f3455781865", "comment": "Malware payload (Mirai)", "value": "4ac4a7c9a2feccb81ea1d2e68818aaaec42910e5e1a7ca34967676cfc8fcb7ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789341, "uuid": "f9266d1f-2ea3-44d2-8c82-b848f25d1d45", "comment": "Malware payload (Mirai)", "value": "98f61422080564d6f2e049ee9c2ac64d8dc04ea3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789341, "uuid": "651ba6a4-5283-471d-8a96-91f2adfbd02b", "comment": "Malware payload (Mirai)", "value": "b73733cc7ba524252e07a83b6922e8749b020ab479e166d332139c2d077a00995dbac15a68fb20b55211552f99e9f45c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789341, "uuid": "6d93adc2-2746-489f-8f7d-258b4b9c5665", "value": "T13DD2F16157C3E4B082D05C31BB7C42D236D307B668EA70264E284EFA1B99466B2775AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789341, "uuid": "a85f9547-3a11-42a1-b55c-d727c1f97af2", "value": "768:vOZUS+ldEfeM3lV7yyIQ6GY82uX2H0waBEKl/Szs3UozM:v7S+ldofV2nbarDzM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789341, "uuid": "cd9d4d6c-0283-4342-88f0-246f6133b608", "value": 30864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789341, "uuid": "cb460e3d-f183-4bca-bbe5-21c33e3968b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789341, "uuid": "5dbfcc87-ab39-4427-bf30-9a0e0c35d2d8", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5807f590-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720759005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759005, "uuid": "b755c43d-0345-464e-9c29-d35fd5a923e5", "comment": "Malware payload", "value": "e68864e43265ccafc662ab98808e462c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759005, "uuid": "5451bba5-3990-4fc0-b7cd-356e6dab9883", "comment": "Malware payload", "value": "4af50d29c4860bf57adcde8336f3d2c9d001ac3c0daff9f7eb3c2c65a1b6b148", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759005, "uuid": "a52e96ab-15cf-4ed3-94b3-2fb876a45a26", "comment": "Malware payload", "value": "d8bfc0aed8d783072d0883f79fdc1ab4a9dd313a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759005, "uuid": "e4604d70-4a3e-492b-be3e-70207528db1b", "comment": "Malware payload", "value": "10cd9e45a38dbced8817c85b89a07ffefdd7b2de9fc4ad79bad6ee9359cc8269c14c98d01da07b5edd2da375be098598", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759005, "uuid": "64a56fc2-3b17-420c-aa78-897d56a27187", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759005, "uuid": "31d6a7a5-ab0d-4324-8d6e-a887fdb1a3b2", "value": "3:gp0RM20sdBc7Ln:ba2zdBYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759005, "uuid": "3c2052ec-3670-4b0c-a9a9-1acaa0690303", "value": 42, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759005, "uuid": "01dd805b-1ae7-49ae-9329-f131b9973559", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759005, "uuid": "a36b1b6a-423e-4dce-8782-9fee954c4326", "value": "5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d905e563-4066-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720799594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799594, "uuid": "017c802c-fce6-42e5-9f1e-2063d877ead2", "comment": "Malware payload", "value": "abbfeb716ac00b772af2d5a581f844c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799594, "uuid": "ae95ecdc-2528-43c5-bb61-3c985334d2f3", "comment": "Malware payload", "value": "4b9c6e661113712517e444529c549272bf57852a0d744dac9e77724a413e2e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799594, "uuid": "6c6f3c47-f9f1-4e64-9440-0b77b04c6ac8", "comment": "Malware payload", "value": "c54f3b6f6efa01d41344ee04a354d2bb20fde59f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799594, "uuid": "d6045288-5e53-4657-982c-495b50f4da89", "comment": "Malware payload", "value": "5104f09257d1af78f19b48762f53118ea5154deb196e86c8bb0e2a1599a0f76d30957e81a76ed2d451af959f0bc889b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799594, "uuid": "74199665-4a00-4451-8285-aad59f4bd6e8", "value": "T191E4F812797A4532DAC8D736E4D7C90057A78E4972E3E61A348933A90A333BECF475C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799594, "uuid": "06e54641-a9ad-4acb-933f-6ac576578666", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799594, "uuid": "ab05823a-8e21-407b-b22a-14d0dee0581b", "value": "3072:oJrKxJ3hmACa84OJHCbDQvojQ89u6MivhQcUeaUnxbV/n2Jl5twjMoMysPLQVL0a:C+H3hqZGbPiivhQewtvhPLCIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720799594, "uuid": "589d65c4-aa6d-4a4b-87c6-f102dbc7ed2a", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720799594, "uuid": "a4a7fe28-fb45-4b18-ab4f-defaddbae74a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799594, "uuid": "c217d9d3-9f7f-47d5-8f78-287ebd3487fa", "value": "INVOICE PAYMENT_Scan0016PDF.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb580e46-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789344, "uuid": "5c172af8-28b3-4be8-8682-1c168d6d6385", "comment": "Malware payload (Mirai)", "value": "24a4125e8659f77e99b1b31e3b1434c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789344, "uuid": "d7d95783-d577-4291-b493-3808067c2702", "comment": "Malware payload (Mirai)", "value": "4ebcade91ecb0202df82fae50ae7ee2210fb2a8a898b394ec9cf64c58a21f3a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789344, "uuid": "c25ac180-81b7-4ee5-836a-50c0b7a91f18", "comment": "Malware payload (Mirai)", "value": "3a818010c9f5bf2ef767cf5e7190f8ace2d416c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789344, "uuid": "9d86d5b9-9183-4d9c-b8d7-22dc318104a9", "comment": "Malware payload (Mirai)", "value": "29f3cb022d67990d25d8230d70c8f88528b83c42d53416c8ed507be1ad0d2057c9de97594a7a7c998e2141ffa4ec2163", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789344, "uuid": "eff66c0b-f9a6-4422-95c1-fc7999feb851", "value": "T1F7F2F1747AB66932D7D247F1F40E46653D5A07F0C8EB711E161903A92BA3D883EC9E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789344, "uuid": "8af7e86f-8990-4ad2-b91c-752eb78f5f4e", "value": "768:5BTc+EewXSszpAOhQTWzQnJZTUDfy4x9q3UELvI:rT2JAODQJZTU7y3LQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789344, "uuid": "0f2b28d4-8285-4fc1-9988-53b0539c28cb", "value": 35220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789344, "uuid": "89e44727-2a1b-4b5a-b4ac-f94986d49c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789344, "uuid": "514b0ce4-3d01-452d-b0eb-82d836bf743d", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7374fb9-401f-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769070, "uuid": "3935f7a8-df74-4c18-af86-2f67a8abb6b9", "comment": "Malware payload", "value": "9ab83ef59bbd07a14dfdb7f7822f874c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769070, "uuid": "8a0c15c8-d42f-4333-b398-345999c9dd6a", "comment": "Malware payload", "value": "4ef45d189a6e592ca3d35ade8cbbe5e1b47c53bab5076f33c1ac2535ffd0df48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769070, "uuid": "a7a340b2-b237-4975-b489-c90256624f52", "comment": "Malware payload", "value": "8d11eb1c13827e332edb7669f8592d3637d17fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769070, "uuid": "07a98bfd-64e8-4a35-92f3-e63aa03fb4de", "comment": "Malware payload", "value": "530fd5c945d2db8b0668c5ea08d6ed5a786c777b374ac4e201d7864139cfa8fe6908b1a5fda2365f2f6541697aafbcfc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769070, "uuid": "814e9308-9c10-44dc-835f-1abed9099e28", "value": "T1CEB2522DD65C832BD1A5D138C98D8E1AFD703113E226AF8F12C79B5A0E221827D5DF6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769070, "uuid": "6a9a64d3-8ed6-4ab4-ad6e-74af90b9d0bd", "value": "6fb28f224a2dc71ed82d0b2fd4effcba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769070, "uuid": "6299cdb6-ae29-4398-8f70-f210e28c7288", "value": "768:82rdn+z+n/9aIiPYiDU6qc2FWfpsWrpY02LnMX:MbIsbqciopsWdYLm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769070, "uuid": "69dce5f4-2d32-4758-93cd-46054a014340", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769070, "uuid": "e263f432-73c9-4f7d-bdee-8ffaffeadb78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769070, "uuid": "c04e434c-91c5-4ca1-8ca8-7d05cb781ebc", "value": "SecuriteInfo.com.Trojan.GenericKD.70627757.24200.17605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f32367e-405b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720794584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794584, "uuid": "dec1c448-8353-4ec9-8588-6b077c3bd4de", "comment": "Malware payload", "value": "15c6b483fd2a345742eaf54957239974", "object_relation": "md5", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794584, "uuid": "e9a805df-2641-4881-894a-dcf6a989a89b", "comment": "Malware payload", "value": "5028056c78c715c7c852be211f9fd4569f7642443ca1dfbde485e2f72cd90529", "object_relation": "sha256", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794584, "uuid": "be4e8fc4-af5c-4977-a802-77de0c4dc2f4", "comment": "Malware payload", "value": "550b10b1c9032145d95169985b9f5a86b441912d", "object_relation": "sha1", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794584, "uuid": "ea866303-ccf9-4db8-8171-a04900a581ab", "comment": "Malware payload", "value": "5a7f645ca75640c650ece4cafa4c81246243992991d8282723598ec5d43001eec6007c34290be5da7c0d16b0ee1f9c3f", "object_relation": "sha3-384", "Tag": [ { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794584, "uuid": "b5cd59b9-8dcd-46ca-8853-fc364af63eb3", "value": "T12EE423D4BEBA2CCF9924DE14296D4C644D9F4880AC417462E4FB5C4A017FAE2F7BD839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794584, "uuid": "08d13feb-3ca9-4e5a-9cce-8df8c54acb4e", "value": "12288:2qz0p6L45wWTy4MBdTY37jGNojjk8cb6Fq2oBpOdz8uMBaw:bzW6LH9tYrjGyjjk8c2FWpUQuMR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720794584, "uuid": "32801409-a894-4138-8658-62fefa4d0650", "value": 713119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720794584, "uuid": "49069d43-b067-4a70-ba16-b0be5ffe93aa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794584, "uuid": "5a50b332-f7af-4c65-ab16-12cec14387e5", "value": "nxEDficos_em_anexo_3310-_1130604032.Tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5674d2bb-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720759002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759002, "uuid": "40e5a612-079f-4229-bdeb-2730c4940396", "comment": "Malware payload", "value": "559c6637902fd2fb978ea79812bd1d33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759002, "uuid": "75efc8db-7174-4933-9b93-ded5bc9200f1", "comment": "Malware payload", "value": "5279b8407862c1c0d1563b29859b391b3da674821e5a5614eea4f71e3b8d4047", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759002, "uuid": "873c9317-d3f7-4ea8-87de-82d6790a1881", "comment": "Malware payload", "value": "6457f3bfb78b43816a682da299f2e1a871338a52", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759002, "uuid": "e3d2a8ad-e793-4580-ba60-513452caaace", "comment": "Malware payload", "value": "483a756ce8795f62ec8f0ff0e88269518797122c4aa8e7debb5a971a03f9b25e94b6a93b7512a0789e3d5f32a1d68058", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759002, "uuid": "4cefc656-0124-4991-bc1f-20303ec7a5f1", "value": "T1D4C080055C52FD2D3714656528FB34BC74D544984445C611D395E5C335E9CD1C554774", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759002, "uuid": "2066895d-fff1-4389-b696-7cdb62ffea26", "value": "3:gH/nRAXIWrS5JQo55u1PAWtQ5dFRDRRUfQT7QyiRcIWFBOPwZUYLn:8RyI2oIBcd/fUYXaGI4zZUYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759002, "uuid": "69004651-318f-4e55-bc23-837ac9c51cbe", "value": 172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759002, "uuid": "269d31cf-ba5c-4275-a6f3-dc3afa287b3a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759002, "uuid": "40ba1f51-3038-424d-b859-47a556ef0c4c", "value": "7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990a1661-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769422, "uuid": "75c1ef58-28d4-480b-b3d0-8f21e7d6893c", "comment": "Malware payload", "value": "907053d05844c24be504b4d50947754a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769422, "uuid": "bae337ff-0b6e-4d33-bf7c-f0a42f0fb13f", "comment": "Malware payload", "value": "535a2e2d89ea2dbab54f21140b805cf061f8c1352027395896a5034c8d64d3ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769422, "uuid": "2b26c36a-e390-496a-a552-3a26434c4100", "comment": "Malware payload", "value": "4ec9fb8da15492c23d118c506d8b45225b170ecf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769422, "uuid": "6df61775-197e-4ff9-9759-91adbe610d5e", "comment": "Malware payload", "value": "37c3adbe285a2775b029adc38783b8b8f0779e5b91ef86b6367e8dfbce588c61ee1188c0442222a640e8ae09f7916775", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769422, "uuid": "fde21fec-501b-4730-a04c-441517b908a8", "value": "T19C742F197A749132DD04CA3419F39E15C2E7EE6D6BE0961928D4F6AD1B322FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769422, "uuid": "6ba0f700-df0b-46cb-9225-4deb1839c1ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769422, "uuid": "e5f8016d-81b4-4323-a89b-1cd30bb81d44", "value": "768:1nq6mriP0tVNSbEC6Px7s1BWKQg2ZzEjss2VSg1I1cn0sspAgpq8hLyg1uMN0+dL:Vql1tVNTCaxuBWKQ7qPpqOLy0uyL+fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769422, "uuid": "e0e68f45-86f7-4474-9655-cff1eb4936da", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769422, "uuid": "2b7a36cf-63a4-407d-b6ff-8f2e656b7f37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769422, "uuid": "799cb64c-78fc-4d7a-892c-4fda02262a9d", "value": "QUOTATION_JULQTRA071244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eedbd6e0-406b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720801778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801778, "uuid": "149fb121-c865-45b7-af3d-9e7c31378181", "comment": "Malware payload", "value": "f4fbf4f707230042999511268dda30df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801778, "uuid": "c63f40ce-da02-471f-8139-2b466b70c7ea", "comment": "Malware payload", "value": "550e927621d95b7c58322f8a90b5c32450e15ab6c6e1b32688efa09605f24b18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801778, "uuid": "6ef01818-f74e-447b-9555-c355622a0ac4", "comment": "Malware payload", "value": "f8c703c9e001ee5ae3bd6e5bcaf0bd8bd0060763", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801778, "uuid": "a0a245eb-db07-4693-8dd4-7f3e16f20d08", "comment": "Malware payload", "value": "478c3d05e56deeca07d91df7f4508b98d124440dbdbb237f58dfaa2a0bb56c0b6ecf5db11f20ed22b2683a17dbc7616f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801778, "uuid": "e2f12cbd-dc77-4208-aee3-234dd29fa600", "value": "T14EB34B03631A0B53D5CB59F02DEB27F187AAF9E112A32141692FAF905B73BB91153F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801778, "uuid": "6f585e2a-d9fb-4207-b97c-9c96f322ff44", "value": "3072:iWZiccKLPHgp2e2Ls5p5hOG1embArEfY3n:iWZicc2xLq5hOfmbArEfY3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801778, "uuid": "c854f272-10fb-46a9-90a5-bb7ec52608c9", "value": 109951, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801778, "uuid": "b2d0a35a-4750-4130-9a17-d0779b05cbb2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801778, "uuid": "4184ff15-d6d7-4c16-a174-b3d3da774a91", "value": "f4fbf4f707230042999511268dda30df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d46307-4036-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720778776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778776, "uuid": "1aa5f19e-45a3-4b43-b24d-96eeefaa42ae", "comment": "Malware payload (Mirai)", "value": "f2e0d53372b8c14b630556e20ed21b77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778776, "uuid": "953ddca9-f67b-4bc3-9811-87dc1e135c0d", "comment": "Malware payload (Mirai)", "value": "55eb1e4d05162007976d34971a9d01370126d9b16b83cf1b8bc1a026dc10177b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778776, "uuid": "4adb6def-13c6-427e-9e9f-b1c8eea6e1be", "comment": "Malware payload (Mirai)", "value": "3eb9bbe2e3558bbd0dbca202f98cad5639d28050", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778776, "uuid": "1a6a38df-64c3-4da5-bd7f-95c8bd5838e3", "comment": "Malware payload (Mirai)", "value": "bdc68833f8adc854d4b28eab4d3ac93f205780b9ff4dee56424c345b08e9feea7906c0e7e1312f2df882afa49e155c83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778776, "uuid": "6892bace-aac7-4f73-8d35-439d95e89ec1", "value": "T171935BC7F801D9BEF84AD6370C934D15B272F2A00F930B769757B66BE936168142BD82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778776, "uuid": "b1870136-70dc-438a-af81-a674f3cd74c3", "value": "1536:jr/iZCMpSvN7FLpIvHbV70r8KQs8FgrS2QeuacWjcW0JcWcBWzpSkGaFCJqq2ZhW:jrHRfIfZ7s8Fgm2QeuacWjcW0JcWcBoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720778776, "uuid": "a40f6399-4c88-4692-9ef6-fb3a5e5ab9e3", "value": 95428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720778776, "uuid": "1e223404-1abe-4b93-8c73-b2042ce5d61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778776, "uuid": "3bba5a7b-d020-41c8-8720-933b6ff57c3b", "value": "f2e0d53372b8c14b630556e20ed21b77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee19d7f3-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789321, "uuid": "18deaa41-1e98-4ef0-b3f9-1665e1b3c2c4", "comment": "Malware payload (Mirai)", "value": "4d5649d2c3452ab2866cc2ad8c8b7cec", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789321, "uuid": "798a5842-9bd8-4ea4-bdc9-5dd7c6b76e9e", "comment": "Malware payload (Mirai)", "value": "5b28de05094666be0ae7c9e5bc80549ea29e6bdf438b28b1eea2cdf4396fc756", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789321, "uuid": "d108bcbe-58ce-4d78-975d-0933d150ca3e", "comment": "Malware payload (Mirai)", "value": "e8e43f2a9b933dd5b59ed1fa019f31e41ff3ddff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789321, "uuid": "18b37b7c-3b69-4297-9a3a-e1eeed73aad1", "comment": "Malware payload (Mirai)", "value": "31a00aa6fb461d3c943ee05730279accafefac93e8da72e856512214f0520c954c308254823eba688788d283235123a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789321, "uuid": "ac0dfc43-41e9-4d8f-8dfb-313fe2095a5b", "value": "T141E35C46FA818B13C4D517BABAAF01493332A79493DB730689285FB43FC6B5F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789321, "uuid": "d656eeaa-1cf7-4d09-8e8b-77d868373816", "value": "3072:iQHlfs+lezFwa6JiBUdKwH5m3m7phtcDfXfMYM/9Wj3We:iQFfsuen6KwH5m3mdhYXfLM/9GWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789321, "uuid": "bfcefe77-4ae9-4482-9ef7-ee643d4d1f0e", "value": 153787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789321, "uuid": "5e44d4e9-fd77-4a72-9201-0e6500b86234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789321, "uuid": "7a82756e-c641-41e1-9d18-0f6054f0eebc", "value": "jade.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c201bcb7-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720790965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790965, "uuid": "fc6e9bcd-512e-4b90-8497-72385136ffe7", "comment": "Malware payload", "value": "c3709920e86edf39cc1cd64b2c1633fd", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790965, "uuid": "ab3d30c1-74ea-43b6-af84-c2126f755706", "comment": "Malware payload", "value": "5c8b35a836b8c19fb65ab26622c51c03e8c4e7a3dd18bb24427ad2eaaa2f765b", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790965, "uuid": "a4b768c5-589f-43f1-a9e0-1af5d03a062a", "comment": "Malware payload", "value": "9a15b5d90ce62d4663e92d0eb886f668459c7152", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790965, "uuid": "3b46f678-8f67-44be-8aa0-2dcf658cc503", "comment": "Malware payload", "value": "f24cfaf8aded14dfe8bdeb51c955b9041564592affa05f7c98e4768b8ce84aa53f3e469d36a427d3e99ecad29855bb0d", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790965, "uuid": "ecce2106-c25c-4065-8814-6c4debbe3882", "value": "T1DCC73321E09AA89AE90AD5B2D18E4F1C9185899C05238B045D7DDE785BFF4C2CE377F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790965, "uuid": "81deca8a-81ab-472a-ae05-fa5946e6593f", "value": "1572864:YwUZnkmQiygGI2pCITyOHUK3aoX13fMSLh7l1ytp9mxYXgA:Y1ZnjxGI2eQX13fFreK6gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790965, "uuid": "ec826eb5-1376-444a-be9f-eb0d954df59d", "value": 53341435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790965, "uuid": "884bc5b5-95b1-48fe-8125-3071c5d1aa8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790965, "uuid": "69961aad-a34a-4b4a-ab21-dd8c44eef517", "value": "45.9.74.32 Strela DLLs 5.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e844ed-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774191, "uuid": "c14a8fd3-8375-4ce0-8f2c-c3381489462a", "comment": "Malware payload (StrelaStealer)", "value": "9df503acd64eed2a008f3cb255416fbc", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774191, "uuid": "1e873ffa-69e5-48fb-9f9f-0b97183fcb47", "comment": "Malware payload (StrelaStealer)", "value": "5d247b3658b87ae5c468451740643f7ca686cbf2d8a45d8f6bc11d12c3372c06", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774191, "uuid": "9391cd88-0062-4b06-b7cc-155cf56e1e3a", "comment": "Malware payload (StrelaStealer)", "value": "3953b57b7e4a6fe003799c19047b74a51584c69a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774191, "uuid": "a1de323d-b6d7-4617-82fd-f6f478088c1a", "comment": "Malware payload (StrelaStealer)", "value": "db36ca7d3e811f9307f32adacbbc2fc945015617bf8937ea6bb716669986f88fa3381016e73507300171667bd1d60e6e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774191, "uuid": "569b66e9-df45-4ba8-98d7-59b8e2f5c74b", "value": "T15C41BD97CCBB045A5A3385897A5DA119CA0F4E77CDEDC7FFA02D244AC57706E8C0A162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774191, "uuid": "5a6129b5-9932-4520-b1e9-dae081a72694", "value": "48:LOI+iIGj5FrqVYRFF1WU3Sbbbkdy1U3SbbbkakVW:LN+Qj5LyU3Sbbb/U3Sbbbxks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774191, "uuid": "3328736c-a655-461f-b973-b5e9e72806b9", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774191, "uuid": "8e367728-3ab3-4dbb-b195-78b061dfa3ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774191, "uuid": "9eaa5161-425a-4abc-af12-dc6d9f2753d4", "value": "995627582910112091.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03c99be-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789325, "uuid": "fc1630ff-3f28-479b-bc3d-1152b9f73591", "comment": "Malware payload (Mirai)", "value": "2e99f861455d81419eb6ae903eb3d235", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789325, "uuid": "388d4cbd-b7ed-4faf-a553-cc9ffea14c3d", "comment": "Malware payload (Mirai)", "value": "5f55f8a9b2b425ed3607898eab331e3c397421375284970da25f89c118198cb4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789325, "uuid": "b72be8a7-1eb0-42e1-8207-96e0a763ccb2", "comment": "Malware payload (Mirai)", "value": "3ddcfa7e58f91b1f6927c552cc28884b4ffd7cc4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789325, "uuid": "0881752e-9aef-4dfb-be43-3dd803e9dd43", "comment": "Malware payload (Mirai)", "value": "7dc78ef165710c329c42ae0e52784eceeb78b85dd2e5c66ebd40ef285acfd68b3f3f110bba8ef936cd59703b3c8a41d4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789325, "uuid": "dc5458ba-25d2-494c-853c-bf2dafe4687a", "value": "T128E32A0A7FB51FFBD85BCE3710EA5B01148CE91A23966B367138DD68B74728E16D3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789325, "uuid": "fc0f4d31-59a1-4a9c-90bc-a1832d3cc953", "value": "3072:/NgPgHgvgo1TNRtRSR5RtR7fKDzOZWJihixOWPKTksFyQ9mIP:uoAIUZRtRSR5RtRPWDbPKTcsmIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789325, "uuid": "b56e4773-1868-4cca-8a0f-046420aee3f1", "value": 148395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789325, "uuid": "c612c720-9a8b-4ded-a62c-9868560b0771", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789325, "uuid": "8caf9feb-8701-449f-864d-a97e7f3828fb", "value": "jade.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f7457f9-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773969, "uuid": "e80194a2-0e1a-421c-9d34-df60f8445b77", "comment": "Malware payload (StrelaStealer)", "value": "63522423029bfe28a9b54c7a9d527d89", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773969, "uuid": "eb6c44c2-3fc7-4935-b599-110f0a06b677", "comment": "Malware payload (StrelaStealer)", "value": "603b649826521ebbf7873a28b5a93db9dd5e8cd4cc3e12a52d0230799538d920", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773969, "uuid": "634261c7-2152-4149-8e22-cf04fae8186a", "comment": "Malware payload (StrelaStealer)", "value": "e57c43e41a73f02b7780c5af15cdd64c9e49410e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773969, "uuid": "bcb6812b-c9c8-4df8-8aae-478aea590e62", "comment": "Malware payload (StrelaStealer)", "value": "46f13d4c2dd3668c455d0c51063ddfe08ffd82d0f0e404751e94651d9dcd75aee2b3b874a80709c47bdbb5ad86d9cf3b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773969, "uuid": "31e61a2a-0a0f-4e2e-a8e9-03f909a3a0e2", "value": "T12041E4C6A79406D909155A28B7FF2392C87F1B741873C3BB416D1939C2220ED85BE7B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773969, "uuid": "9eab1c67-4416-40e5-812d-2efa4d41aa9e", "value": "48:LUWdMYt+bbPpRUVNo0g5FGqg1ffHhqg1ff6UU:LbSiwBOrqgvqgUUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773969, "uuid": "a4b4efaf-7a73-4c8a-9771-9644df3ac9ff", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773969, "uuid": "f4245264-6bae-4599-90c4-7467c690b82b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773969, "uuid": "a2048600-c158-4dc4-907e-871b22621185", "value": "3154892035102682.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c428d6-4045-11ef-957f-42010a9c0016", "comment": "Malware payload (PureLogStealer)", "timestamp": 1720785365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785365, "uuid": "04310959-1703-40d7-8e35-91c28c89808e", "comment": "Malware payload (PureLogStealer)", "value": "0ae959f4230488c4330142b693e70965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785365, "uuid": "d05c0633-80a2-46cd-891c-565c6cac1868", "comment": "Malware payload (PureLogStealer)", "value": "6095332b4a96dee4fa6e71a5c233842977eddcdb1a57663943685d96fb27e8e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785365, "uuid": "6985e3ee-e892-4ce6-b0fe-1640ad252cba", "comment": "Malware payload (PureLogStealer)", "value": "9656ffb496913d62cb056dd7f4bb3986648c094b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785365, "uuid": "82bbb343-b61c-4cb7-92cf-fcb6718ae781", "comment": "Malware payload (PureLogStealer)", "value": "c31e1fce1a41b9e2a4e61355a58a01669327d29c9062a8b8cacfff5563b1ab5dccb4205fa419675eb1b1b2eca5ebe604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785365, "uuid": "94c1584a-dad5-43cb-b31f-2aae79b9b7ac", "value": "T14C72F919A3C89721C8EE563AC8F31725033AA7531753D75D2CCA6BF76F277820B44AA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785365, "uuid": "b7b6b126-6097-4b32-a877-3807ebcb7749", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785365, "uuid": "9834ddf4-7e04-42a5-9f2d-ffaf581da5d2", "value": "192:CTGRektTm51YJNgnUj5Tgqe+uWw6k5iuYta97vnlQzp29NhrdzJhCRkUR4ot:Hw5wjGQuWwj5iUVkcNhrdzLdUR4o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720785365, "uuid": "77d8f0ea-39bb-4d3c-ae01-dc6b49e91a8c", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720785365, "uuid": "b8b89c4a-df2f-4de5-8b57-c8a591fd6773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785365, "uuid": "6548f41c-214d-45dd-b583-5fbd66b2c5a5", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.987.29728.6216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c3cb2e-4086-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720813257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720813257, "uuid": "f0aa488d-708c-4c08-bb10-82e781885d31", "comment": "Malware payload", "value": "3c39f5d219ff8006dbab0ce247bf7232", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "log4shell", "colour": "#F49493", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720813257, "uuid": "44969815-bff4-4eb1-9ccf-b112c9cfe246", "comment": "Malware payload", "value": "62271ce84033d4463bd6f753675466f45ccc6c3a063c78c2c5b0346c23d3c470", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "log4shell", "colour": "#F49493", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720813257, "uuid": "42ac2723-6c77-42ce-8a43-ea1a1bce2f39", "comment": "Malware payload", "value": "39d19e5df70bdaa97afdf80c0ac8cbec2bb9625f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "log4shell", "colour": "#F49493", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720813257, "uuid": "77292e14-1494-4785-9b26-85ce049c0cc9", "comment": "Malware payload", "value": "87785bc8b1b0daab2f47d82af8eec8ed849d4f6afc81196eedbd07bf079d80e6d5062c630b3e4b2ad34259088f1512ff", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "log4shell", "colour": "#F49493", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720813257, "uuid": "bf6cda25-2715-458e-88fa-5ce4f8f5b5e0", "value": "T13954086E3F4A90B1E11360330554D6393968A6EBC302458F1BFC5C9CED7AE9D0B57A8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720813257, "uuid": "8776eebf-0e86-41c1-ba6a-7e2e98f7841a", "value": "6144:DYoXFR4xZ+WStJ112liBt9+CNyELmhzPlZCiu4nVB:DvDikmlG+CM1TlZC+VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720813257, "uuid": "ea08a48a-4986-424f-bb4b-718003c3b3f4", "value": 281761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720813257, "uuid": "a085f808-d561-405e-a007-53dc2405fd30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720813257, "uuid": "35a77248-d485-4f11-ad8e-89ae1b010afa", "value": "62271ce84033d4463bd6f753675466f45ccc6c3a063c78c2c5b0346c23d3c470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff05706-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774211, "uuid": "8b118ad6-83c7-4029-8ec6-69a32fe0e004", "comment": "Malware payload (StrelaStealer)", "value": "fb27c72e4f5534a768b5c87f34fe19b0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774211, "uuid": "0512412e-b2a2-454b-a68b-2b4d0697c58f", "comment": "Malware payload (StrelaStealer)", "value": "634b6479aa998ebb8b0dfc7111ba078972c19ecdafb67aed9c112c011c36acb9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774211, "uuid": "92e74039-87ef-4db5-b0c4-10eb1abae0eb", "comment": "Malware payload (StrelaStealer)", "value": "3b4522f7beaa58cb478a8ffcc567cd9f4f6a7381", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774211, "uuid": "65c28373-e2c6-448d-ba23-c7d42ae7729c", "comment": "Malware payload (StrelaStealer)", "value": "1ffe2dff8d19998d60320f42bc84e6f24f857691a41de64fb0c5b5abe3682b3cd2934064682bd043290b433aa9494fc4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774211, "uuid": "52236f50-354b-4155-a0e8-364f2e1c79b4", "value": "T131411CC4A0D1BC4CF5C5D50EE7724775A04638A60472E26CA94BBA6FEB898ED3C0B54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774211, "uuid": "c4a4bb70-d49c-4a5e-af2c-a27da9e6f338", "value": "24:/obpHqvKu9Ih3ARcfOUWNv3vazuvemzXZvT2MvN4ilL1qTCCClvZv+Iu1qTCCClk:/o8vkSeOGzMzlBJlJaCCCgaCCCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774211, "uuid": "0e47b2a5-f219-49a6-b555-80952eeec3d0", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774211, "uuid": "5953ceb1-9522-42f2-bfe8-2476c84ad82b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774211, "uuid": "89ba80a3-9a2e-4f1c-8b39-38f22b934248", "value": "3137250091390725801.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9557b363-4065-11ef-957f-42010a9c0016", "comment": "Malware payload (Babadeda)", "timestamp": 1720799051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799051, "uuid": "40ccd4a5-b652-48c7-bfc8-d930c6fda7ad", "comment": "Malware payload (Babadeda)", "value": "b21da086e38e4420404127ee719eb9fa", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799051, "uuid": "3606f4b1-0423-41cf-8797-0e2250dad2b6", "comment": "Malware payload (Babadeda)", "value": "637c486049595567e399598c512fbdbf78d7cf9a5291261a3b802fefe867d031", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799051, "uuid": "6b807aaa-5aec-43ee-8697-25bd16d366e1", "comment": "Malware payload (Babadeda)", "value": "39f09ed025dde227bb0d8ee8e30c13c68265a65d", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799051, "uuid": "904a66e4-dfcf-4077-85f6-869a06f11545", "comment": "Malware payload (Babadeda)", "value": "a42360bea91f181759a25222f0fe19ffb5331d72f0bb43adaa5c648c4c44ca758130c476eb3b7fd3e83bcbe00cd1934b", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799051, "uuid": "cb50d299-43e2-4862-b846-c29393a87fe4", "value": "T154937D45F3D242F7EAF10A3100A6712FA73566249724E8DBC34C3D829953AD59A7C3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799051, "uuid": "29371fec-252e-485e-b4fe-df22bee18e03", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799051, "uuid": "70e4bb9a-beb8-41a5-8364-442af1175d4f", "value": "1536:D7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf5x5:fq6+ouCpk2mpcWJ0r+QNTBf5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720799051, "uuid": "551ff5ef-7b7a-428b-9fba-1f1118328d25", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720799051, "uuid": "b188631b-4097-4725-b621-06319441fa91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799051, "uuid": "3e38d21c-e4f8-4c86-a694-2ffe2076cb61", "value": "REAL ANTIVIRUS PRO 2099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1d1c25e-406b-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720801756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801756, "uuid": "aee887f7-c73b-4e5c-85cb-12946e8988a9", "comment": "Malware payload (Mirai)", "value": "bd2e71f68db7b19e3c1f127f0a0c2b7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801756, "uuid": "612a4bde-cc36-4bc7-82f2-08501e9a6542", "comment": "Malware payload (Mirai)", "value": "63d4e3e6dc17dd14aef3ca1832a85bcc92142d224b6275a688c58a5665c09965", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801756, "uuid": "c814fe27-35b5-4003-9bbc-e63f12335c52", "comment": "Malware payload (Mirai)", "value": "04bab9f0a638fb71750f2befeeafda8b2f8a426d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801756, "uuid": "a798209b-64cf-48b4-bf6c-11cfc98e5ed5", "comment": "Malware payload (Mirai)", "value": "81e7abe3bea2214b2e0bfe92507a342e4dc6030d6d0b79c70ae7a946d13c5cb4a940efb6d4674a3d90b005192ef64c4c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801756, "uuid": "6b96f81a-21b5-412e-ad49-55440b5aa8b8", "value": "T198B31B07AFB10EBBD85BCE3602EE4631148DDC5617A517397238DE787B4A2CE0AD3954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801756, "uuid": "08ce644e-fd3b-483d-85da-d3c217832a59", "value": "1536:ctjP8PzPaPQP/PpfPctew50U2Ybx5jHUmrMD2dfgkTXgfGvE5:4b8L2gHGtL508bfjH9rM6dfgIgfz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801756, "uuid": "7e6daf7b-726e-4fe0-a032-b25c7d79e80d", "value": 108917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801756, "uuid": "edd30a33-bcde-45be-b7a8-8dad804b3f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801756, "uuid": "77df78c7-6fa9-487d-b4b5-4545a61faec6", "value": "bd2e71f68db7b19e3c1f127f0a0c2b7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9635573-4057-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720793179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793179, "uuid": "2bf3e4c8-51bf-4bd5-92e4-8f2666b97f90", "comment": "Malware payload", "value": "6157509e829cd9d69957cddd573de50a", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793179, "uuid": "90b3c05e-9cb0-4118-96d9-4f126d3d7662", "comment": "Malware payload", "value": "64788fc48827d417f58c553f7544cd9a2ac287621c9e1d8e8b8cf1d243452e0c", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793179, "uuid": "57cac26c-02ec-4354-9abb-a01892cb3898", "comment": "Malware payload", "value": "634cff9aa06bd74ce76d35dead2408f413351309", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793179, "uuid": "3359d63e-8048-403e-9e1c-e71bbeb7f9c0", "comment": "Malware payload", "value": "2be808040dade1509e6072a27e27b0d5d334bcbff78f075e6fb9ca85aaf71adefe5219491c628a847a9c0d485392e7bc", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793179, "uuid": "fe52e24a-2fb9-468c-a7f9-24ff4c9ea500", "value": "T1E2942320D9E21F3477BCD8FB73A8D2987252518B5235CBFB43EA4B4E8EA3326441D651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793179, "uuid": "e7595366-4fa6-4b9f-94ce-8060d528e77a", "value": "6144:t1ai/ZSTbdb5KkJR23mOYENbR6nTJzloFjnBql7IxKWOM5KbQg:OH55PE39YEn0TR8bsl7Ixe6Kv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720793179, "uuid": "95560d62-3628-45f2-a91a-e15fc6ff9add", "value": 442429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720793179, "uuid": "f0721882-a039-4c39-8e99-71363046da52", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793179, "uuid": "e6189d06-d72e-4a5f-81e1-763c4bfd1c0b", "value": "nSWIFT.LZH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97e2b82-4066-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720799621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799621, "uuid": "aa643099-f908-4c7c-a5ed-cc0dabdcff5e", "comment": "Malware payload (Mirai)", "value": "c556014c1eb11522ebf112a4368f4275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799621, "uuid": "226295af-250d-4b37-9604-75b64e179664", "comment": "Malware payload (Mirai)", "value": "64f5e39170fe0fdcbf47290248df7c3502e2a2201bbc58be0564a67fe0c621c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799621, "uuid": "c4ad113c-81b0-4fa8-bfd9-1bf4ed7b6258", "comment": "Malware payload (Mirai)", "value": "796cfc44fa6b2c847fb23836272a59684ed0988c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799621, "uuid": "bd56bbac-7aa4-473f-a3ee-5ae99c526fda", "comment": "Malware payload (Mirai)", "value": "05c07efc45b3225efe61e4e8a089e14898105dc57a9c1917c7c0dd77614e2b9afa096fd984c899903f9e9374a60f557e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799621, "uuid": "adb2f7db-f547-46e9-b9be-6efe62d4a084", "value": "T167468E07FAA204B8D8D9C974875FE223EB64F8894121B66B6BD45F113F26F209F0E751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799621, "uuid": "d12b8eab-a2b5-4560-80ff-ca63684935dd", "value": "49152:jTFMamNDwIf6L2KlgTBygO7blatrhNwD4fy9X40pxCZDrS2DQgJjun0pzqtI4V9h:jlmBhsYqi0pxCBF0YbID7IUR4UcE+u+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720799621, "uuid": "14f7b2aa-23be-4f93-a518-a9f4e642ef6e", "value": 5748944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720799621, "uuid": "9ef502bf-1243-41d9-9877-bc927637e478", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799621, "uuid": "52a69cdd-aae3-4495-8cce-7f3c6ca17795", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42185f2-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720791023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791023, "uuid": "a9e2a8d5-17d1-437a-b5fa-cf52cf335281", "comment": "Malware payload", "value": "d7241f541c12892f6d2bd889972d1b96", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791023, "uuid": "0a140fc8-a645-4520-9e73-2ca92c8e4803", "comment": "Malware payload", "value": "655d3dd15a98e6b53933ae6f5d86025f47b2c170ae4875d4151a12c274c09b1a", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791023, "uuid": "fe077fd4-b323-4e24-88cb-dbb6e3fd210a", "comment": "Malware payload", "value": "6e055811fa48cb372d1a0287becd7b4c2ce73916", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791023, "uuid": "e9c62e1b-1333-4982-9569-444c3b95c240", "comment": "Malware payload", "value": "c4cbabcbb23e86c516b872eed3559748218299a2b003a678e450b9725b317811a0995cf68cef3264d4fe0edf0b2b6c11", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791023, "uuid": "a5207395-a860-419a-8504-6bccab40bd25", "value": "T195C73310F08A949AD50AD076C08E577C76DB899C12334781AD2DEE295BFB1C28E779F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791023, "uuid": "ce164a76-6860-49e7-8a0f-e9698bbde23f", "value": "1572864:JsB9Rh0g70YQ5CoJzfLdhEv2OhVuIxDeQp8xDL7IbNhDP:CBN0VYCzzjEO3IxaZD/IxhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720791023, "uuid": "5299c3d5-1b4e-47d8-a960-77a52cefd61d", "value": 53555615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720791023, "uuid": "ac286876-aca3-4029-9aa6-b27492a44992", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791023, "uuid": "f519f701-2d12-40c9-8356-bb50c1cd159b", "value": "45.9.74.32 Strela DLLs 7.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9399b59f-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769413, "uuid": "c54cf866-d238-40c8-a763-431547a221c4", "comment": "Malware payload", "value": "4b47a662d7b47819038dd3b4890a26ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769413, "uuid": "960a4c79-24b9-476c-8a77-32d7a7aa307a", "comment": "Malware payload", "value": "66265cabac550371ea3f4e07e0af57a16a4de1bd3592be9c15f932818850d161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769413, "uuid": "caeb3b69-da80-4f90-a4a4-6ae23077eb65", "comment": "Malware payload", "value": "b6537081363e2fed8b4aaae6040a60f57c2dcc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769413, "uuid": "328d00d5-006d-40d4-a8dc-af11beec9f8f", "comment": "Malware payload", "value": "333065a47526307d243b5f0ced7ab578eb1a6a1f82131fc27698c0d038b91e0a377f37a2843d907956c210d2676432e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769413, "uuid": "6882f28f-52da-4615-a68b-64fc5e1f7502", "value": "T1F874C95A7A74A132ED04CA3419F69E11D2DBEE6C2BE0551D24D8F66D1B322FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769413, "uuid": "eeb3f908-7801-40bb-8500-8a5a11a76bbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769413, "uuid": "f5985eb4-ea0b-4742-92b0-fab4912e0936", "value": "768:Jw0SQ51PE5HUu9Qe2VzEjss2yXg1ILcn0sspAgpq80Lyg1uMN0+dzsRU+eE1:kd9Q7E/pqrLy0uyz+f1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769413, "uuid": "e254862e-0e02-4393-912e-b58debd8a35d", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769413, "uuid": "152f1aa9-43b3-4879-ba9a-213f235cef0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769413, "uuid": "c4174881-27a3-4fb3-8774-cc100288b9df", "value": "QUOTATION_JUNQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed8829cd-4066-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720799628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799628, "uuid": "138146c3-4dca-4ca1-b062-1950982cd1a1", "comment": "Malware payload (Formbook)", "value": "b98463427ff48025b05cd711c1b2c830", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799628, "uuid": "ef22b2d0-c012-4a16-9cef-22f59224bcc8", "comment": "Malware payload (Formbook)", "value": "6725da896273bada4c8384565b8d157f602357b386d8bceaf72b28899ed09fa8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799628, "uuid": "2e426331-24ec-45f6-88f8-6769ae9a1d65", "comment": "Malware payload (Formbook)", "value": "861716752d1451a79da086cd8d4717786cc4f99e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799628, "uuid": "d2e40c60-fb77-4782-8645-98b4e36e27f9", "comment": "Malware payload (Formbook)", "value": "72a5f5e1d65a309493ba1625bf3d985e0e1164dd166d8efbb4560f2f997c505113a238fdffb5ae8f55a045186bc436fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799628, "uuid": "0deada66-152c-459f-a0f1-d27d1816c9b5", "value": "T1ABE4D80779774921CA84D736D4E6890093A79E4563E3E70A34C973A91A323BEEF476C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799628, "uuid": "10583dca-51d3-4884-86a6-106c8c98f36b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799628, "uuid": "ce42f559-3429-44b0-819b-127ffd7096f5", "value": "6144:z+IQqTIl5+RR19CUQ0uKfv6ZfKgpQ3xm:rkY1cUN36ZfKgC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720799628, "uuid": "62abb5cd-b7ca-4a07-98c0-6b8badc5682f", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720799628, "uuid": "3a012d23-5026-4703-a1d0-c3a55095f81c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799628, "uuid": "cb91f567-e5de-453f-82e8-c8110c9b7054", "value": "QUOTATION_JULQTRA071244PDF.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f33e79-407e-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720809548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720809548, "uuid": "39e46442-7b8e-48a6-8270-abacc0b975d2", "comment": "Malware payload (Formbook)", "value": "73f130e023b6bf91ab2c484e45a983d4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720809548, "uuid": "96b72ef7-447c-4958-a955-33133a4b42a7", "comment": "Malware payload (Formbook)", "value": "67842e9160df1a254a6ced45441df9e7964cc7058cf4a6453f6e497db0a8119b", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720809548, "uuid": "1de2ecec-7c06-4213-807b-a97f4abc0e38", "comment": "Malware payload (Formbook)", "value": "65a5d79aaf37fe8cc27ef53dc07f6354f0412d69", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720809548, "uuid": "7fef45cb-3ca7-4a66-b26f-0c3ec9442cce", "comment": "Malware payload (Formbook)", "value": "b74aea6238f9d3a4055cfb85f96013b3ff72ac5df7214b4f3c98797810f5aa4b633076eb640d9510da7444250027484f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720809548, "uuid": "534d0703-4d2d-49bf-9c52-d1ee55de11cb", "value": "T1AC74F7E8EF55840FD4AC6AB4E8F47B62477A4FC0E4CFC65908A63CC66FA06C465B44E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720809548, "uuid": "212f85a0-e945-4984-8b19-db4234fac674", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720809548, "uuid": "68bdbe4c-4ddd-45e8-bf37-c5d014f24dc1", "value": "1536:/c7gzDbouG81mVQeUngYriXbbDlfTDKL6COgk1oVaGuqtadlUtkkN:/CgzcrZXbbZPKnOgUowGuqyly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720809548, "uuid": "ba6f4afe-56e8-4f01-aa8d-e63ce33241ef", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720809548, "uuid": "82b1a663-ac0f-4caa-94d8-3d46d7e2d96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720809548, "uuid": "2910dc7e-2213-4fb4-bd0c-1a0cc00f7e62", "value": "XClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e91b0e1-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773511, "uuid": "b77d52c4-4f17-418d-95af-aaaa3454628c", "comment": "Malware payload (StrelaStealer)", "value": "8aa240df1f80a3b03ee08e65749b12e6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773511, "uuid": "d4e1ac4f-3b6f-4152-9409-663438816546", "comment": "Malware payload (StrelaStealer)", "value": "6867caa3662568959e0dff8daa054182cd6ba97c468b270d3f79c32b02ae85db", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773511, "uuid": "71966421-46ca-4f41-9cac-a13c19244d28", "comment": "Malware payload (StrelaStealer)", "value": "be16e8aadf46cba4cfa40653435de71d563ad6e0", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773511, "uuid": "81410be2-eec4-4ebf-a806-1ab4c551e1b7", "comment": "Malware payload (StrelaStealer)", "value": "29126bf344714ed212f40a3ad5423dbe743031871835110dcd3718a865f9a1559282d59018c74db192d30d1bc347974e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773511, "uuid": "4109c4f9-7e7e-499c-9f09-2e97327d6c0d", "value": "T16941A3CF2D4E3B9BA740E35420A50969B480A824A660D0FFBDF354C9C5BE53D55E60AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773511, "uuid": "d1bd9a79-fe9b-4075-98c0-8ef4005a1718", "value": "48:ujmvbBbbgUWRfygKuaRO7dUmUFEFVFOa1TTv2Sr3ie0Yj8rPKx3rrcwZ4k+83ezB:ujmvbh8UWRfygKuaQ7dUmUFEvsa1TTv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773511, "uuid": "09e33251-b726-4ba1-a4eb-0fc0405629d4", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773511, "uuid": "904025f3-c306-4caa-a486-e3c3cb8beb5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773511, "uuid": "c14fc6cc-5577-425b-862c-d4c66f8c6be1", "value": "6867caa3662568959e0dff8daa054182cd6ba97c468b270d3f79c32b02ae85db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dab3bcf8-409e-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720823648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720823648, "uuid": "6d827349-2d66-45c5-815a-068e771c1810", "comment": "Malware payload (Formbook)", "value": "997a2af7a155f889bc190fe63fd934d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720823648, "uuid": "af9b1ce0-5b94-4989-9655-8823a99fed9a", "comment": "Malware payload (Formbook)", "value": "6be3d2aba5d4ae48d24eb0fee3a63eca888be4a2b34648b83e78411984c9d1a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720823648, "uuid": "66fa4ae6-6d31-4e86-9831-c0e45decd42a", "comment": "Malware payload (Formbook)", "value": "2730292d90d51e300935b1393ed7ab762dd3649b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720823648, "uuid": "56c39f30-4d91-43f9-a37a-bb47e01c3b55", "comment": "Malware payload (Formbook)", "value": "a7e20662aef7cf8515d93a2488e08aaed30f1181bdcbedf54ba5051303832d0c5b754cba36ccb0d6e77024f3cab1609c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720823648, "uuid": "5bce3e52-c9da-416f-b9ff-3a20b32f33fd", "value": "T1AA45BE0273D2C032FFAB92739B6AF24156BD79254133852F13982DB9BD701B2267D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720823648, "uuid": "ea2dda10-003c-42d6-a880-4307aa9b1552", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720823648, "uuid": "fb102f6a-41c1-4712-9e28-9a1144893065", "value": "24576:IAHnh+eWsN3skA4RV1Hom2KXMmHa2CT4fBA8kpiBnJmDX++5:Ph+ZkldoPK8Ya2piDiBArD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720823648, "uuid": "78461a74-3947-4dcd-8ac1-1ed0922a0721", "value": 1191424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720823648, "uuid": "0eaa15e1-04d2-408f-bd61-07bbed1dcac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720823648, "uuid": "27d46fc1-479a-4f4e-8b40-65cd60c3b9c3", "value": "BL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81fc1685-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720790858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790858, "uuid": "0e002ee0-3376-4d2a-9376-189bb2d4e707", "comment": "Malware payload", "value": "f4dfcc8c00e503d239e0d4fa9b77abd0", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790858, "uuid": "c1b2209e-453a-4729-b817-a9afabb1ea7e", "comment": "Malware payload", "value": "6be66fbea4373a04b2db664aa5687a188150ad58f39070fca97fdf5674a9854e", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790858, "uuid": "94f5995b-ac21-41b1-bee2-7ac14ffbfa6c", "comment": "Malware payload", "value": "d357f3b3da341cd9854c103508b6b1076dc2c0c7", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790858, "uuid": "b184741b-2c9f-420e-9688-7f0a7b391a3a", "comment": "Malware payload", "value": "a966733201db126ff343bb0f03eefd66a05c090eb13596d34549dbadde192b89058fd68bec02022987ab4d3b3ade1ed1", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790858, "uuid": "c944b24b-e65f-4c87-8885-efa27c691f23", "value": "T175C73321F19EA496E51AD4B1814E4E7861DA859C02238B107C2DDABD5FFF2C19E336F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790858, "uuid": "6fd0a4b0-3caf-4464-b6ba-56fe0d5ee230", "value": "1572864:vA8gp+OlUtiAnylI6SwZRvU72Ho7l+WHujAxkMmFW5m:vDA+OlUtznRwZZUKFWHukxVSW5m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790858, "uuid": "52e08106-f805-4ec0-b15a-9d74862999b4", "value": 53554006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790858, "uuid": "175e7b80-5462-475b-a245-f54b1a92a7f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790858, "uuid": "71ee82dc-fe3f-40bc-8f35-cf2964d720d7", "value": "45.9.74.32 Strela DLLs 3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90270db3-4098-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720820946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "f1e3c8a1-9d8d-4475-b919-aa57c4ef4717", "comment": "Malware payload", "value": "4df0bf4c7b6b334992a5d69933654417", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "5c25f84d-6aa1-4beb-bc80-5dad65fe532b", "comment": "Malware payload", "value": "6bfd9a9da18a908132c425c3d0e853d5f95a1863096ac62c380a3b5a50d8025a", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "e39b1488-c227-41bb-8686-4311ef106776", "comment": "Malware payload", "value": "961c104a65f1f3db643c1b5fa1acf877255e03bf", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820946, "uuid": "77f28e5d-1a14-46ad-a7bb-bc921cdb7c43", "comment": "Malware payload", "value": "30eca3567029c34cb6a9d9f1a9416ea48b6d065ba5fa007f7ab42d659e41d6295d3514de77b4d7b7f5680f9b78acf828", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820946, "uuid": "07703d62-9d1e-43bd-8c4b-420167791f62", "value": "T10D232B0037EC852BF2BE8F78ADF25105857AF2672603D5492CC4529B5723FC6AA425FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820946, "uuid": "541fd33d-385c-43c2-986d-af7782e7d593", "value": "768:c4iTHao5+suIm2Qv75OMrbWPgtmOHPjSNjb0gX3iOctIG2vmamQtBDZzn:c4iTHaWeO8NmOrSFbbXSvaOMjdzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820946, "uuid": "c0e79e64-f3f4-47d3-b900-e850279e7c00", "value": 46698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820946, "uuid": "8965ead9-41bc-4337-81b6-fde246039925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820946, "uuid": "9b161bb1-807d-4eeb-86d8-46b7ab5379db", "value": "17208209458b9412d4e3dafb3b5d9d2ffd999c8883faa868c6e0a63a1209666a26f267ab59620.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bd3a93-407f-11ef-957f-42010a9c0016", "comment": "Malware payload (CoinMiner)", "timestamp": 1720810218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810218, "uuid": "14a2471b-d914-4384-905f-0a6dbaa17290", "comment": "Malware payload (CoinMiner)", "value": "2f98a8795ed445800e92fd1dbd6a09cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner UnamSanctam", "colour": "#E68712", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810218, "uuid": "35c51e65-016d-4e88-83ba-7d8a87bd9020", "comment": "Malware payload (CoinMiner)", "value": "6cede38891c495db2b488b61dfbb8f80e7fab7acba04d0f6e22fa9caecfa9afe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner UnamSanctam", "colour": "#E68712", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810218, "uuid": "f0dbeaec-9eca-4d54-a799-79fdca93a53d", "comment": "Malware payload (CoinMiner)", "value": "0ca72d1f4fb4e008ee671bce6a20ca27fd34a6a9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner UnamSanctam", "colour": "#E68712", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810218, "uuid": "f941ca5d-4a39-4672-b10e-2974ec4e8173", "comment": "Malware payload (CoinMiner)", "value": "6dc9360215b8ff969f91d5f1dd0d589a7b00681ab3902c51a54ef88dd92a338776cdc97002219224b38a4d3d3cf41df6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilentCryptoMiner UnamSanctam", "colour": "#E68712", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810218, "uuid": "7cc92902-502c-4112-a7c8-8e8369743e2d", "value": "T1264623901009AB0EC5ACB774CF25174B929629C3C67EF7BB5EA238A18C1145CD737E6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810218, "uuid": "9a902780-5eb7-4f3b-850e-1ec4ce6b1351", "value": "b237ac2118704db9e7609540658f5790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810218, "uuid": "312d9436-ce87-48a0-8fb7-62a6c24a3af6", "value": "98304:edXh1RIQhSmqf54/uVcguOQxW4O2y8q8KOT/XoUP95ZN2bXA7nIR:cXbyQgJ4G9uOsdhqNWN2bXAcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720810218, "uuid": "878968c8-8aff-41cf-8ee2-c4a638a30d1f", "value": 5551704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720810218, "uuid": "1b29cd8a-f137-484e-b465-e52b9acba498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810218, "uuid": "1a6dd57a-fd18-49e6-b9f6-ce0d6f5f1f21", "value": "updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5263c35-4055-11ef-957f-42010a9c0016", "comment": "Malware payload (Adware.Generic)", "timestamp": 1720792232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792232, "uuid": "dd94d665-269e-42a6-a660-3db46af918d7", "comment": "Malware payload (Adware.Generic)", "value": "65fcfcaac97b3f7cdc04af082304d787", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792232, "uuid": "19d45d0a-566e-48fb-8c53-e84f827e123d", "comment": "Malware payload (Adware.Generic)", "value": "6d1e6c3a96023c9232cdd25ae19a61d39ebeadb80fdeca80e19ded687ba5e2c9", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792232, "uuid": "7bc7c6e1-cf55-41c5-9893-8205d371d72f", "comment": "Malware payload (Adware.Generic)", "value": "0d042923e714418eb71856cc9419aed60af3fb6f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792232, "uuid": "e20745f3-19e5-4bec-ac04-8b3156292e74", "comment": "Malware payload (Adware.Generic)", "value": "56a12b9ee81a74183eb03a7812894e51e04898653af59cdfbd10b1a1fdbbc9f9a1c34514051a1fa685985af4e4ae5679", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792232, "uuid": "0afb6153-825a-4cc6-b6aa-2cde5bc16d2c", "value": "T12757332B62D8213EC55A37F501B6867099BB6E5EE41E8C0ED3F4770BDB720610E3EA45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792232, "uuid": "45ea89a2-a3d4-4a37-a709-7ae8860ec5c9", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792232, "uuid": "833e661c-c02a-46ed-8580-21afe5ec7e55", "value": "786432:Lq75U+/QXe6+2GEsNVUR/RQsWNiLtDogI4RELU+b/71RBWCfxC:Lq7tYXe6GNVS/RfWsZoV4RELFBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720792232, "uuid": "85ef8f1d-7216-4621-b2a5-c6af497db282", "value": 29290216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720792232, "uuid": "05507c19-12d6-4ccf-885f-a9f9072f1331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792232, "uuid": "cad75310-fb9f-4ef7-894a-42bdadf28085", "value": "SecuriteInfo.com.Program.Unwanted.4839.29231.17001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7d87c2-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789324, "uuid": "20603033-31b5-4f43-9a5b-55ee33a78fdb", "comment": "Malware payload (Mirai)", "value": "60307e266404660a403e980cf18f5f74", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789324, "uuid": "ab86c87d-d4d3-47ae-9e37-33f665a83c1d", "comment": "Malware payload (Mirai)", "value": "6e5dbb3bbd8a560ee9706a9a642b1ceadf8d05de9c86639c5d786327ef585cc6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789324, "uuid": "bda51a18-073f-4422-9bd3-09f32f448b7e", "comment": "Malware payload (Mirai)", "value": "96e60ba15f5b7ee5b1124207f42b2af010387704", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789324, "uuid": "e6e76139-2db0-458b-bcd9-35b1fa397297", "comment": "Malware payload (Mirai)", "value": "55aafa80a731b0636f72559456acc9a48c89e33cacd191c6f4b6a7f14b2484b51b8108aff855763b00600b3bce9a4a26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789324, "uuid": "57012397-9373-4557-92ae-918730ace3a6", "value": "T1B3E3C51E7A258F6CF39A863547F78E31466437D22BE2C045E15CEB142E2178E684FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789324, "uuid": "323fab35-905c-4877-8273-047678e65ad5", "value": "3072:jw0VJD/eGdUAHj11b68XD4QJkY7ZLNIRhc431qLOliNL5Z3P:jw0VJD/eGdUAHj11b68XD4QJkY7Z2RhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789324, "uuid": "98b74f82-3806-4138-84c1-f05b6df7112b", "value": 144299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789324, "uuid": "484a20e6-46d9-435c-8098-64df18a6249c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789324, "uuid": "7d61d02d-2a04-4e3c-b0bf-9df834d286ea", "value": "jade.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbfdc388-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789345, "uuid": "3013809c-5d50-4f79-b7a8-cd2a63cf0d97", "comment": "Malware payload (Mirai)", "value": "59a7319860856987828fbc686b6c9bbb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789345, "uuid": "774b5908-9100-4b1d-a6b0-19a0118e0b74", "comment": "Malware payload (Mirai)", "value": "6f1807bd00b271807e104211ee0a49c3d50f651d186cfca8295dab2d28329d8a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789345, "uuid": "0acd6b07-9a82-4d24-bf9f-3ff330b0bfee", "comment": "Malware payload (Mirai)", "value": "a98e3b3af9f90ce1422f5c07e2eca973f1975e46", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789345, "uuid": "8b59a1d5-6630-4ec0-a3ce-51bb5b1c382f", "comment": "Malware payload (Mirai)", "value": "d7f79c8160f771e0a0a157c3b001ea7acb417548625b4f79b1f82e9b95d90917203c8563f8d76879ecf27e93dd07879b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789345, "uuid": "2fce1035-97ed-4114-8773-9aaefa1df6a7", "value": "T12C33F1C5DB327739D8A17920B9748D8337AF27DAD1FEB5C08265B32C299354938DDA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789345, "uuid": "fdfd566c-c9e3-47ea-aa41-a0515583e117", "value": "1536:mHG6YXI/x4pNyrLKo8YEBClgw6wrLPeZDIAiXkfDpC:mHG1m4y79Eob6wLP8Dw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789345, "uuid": "4ebebf24-dbe1-44b6-92b6-0317d807e000", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789345, "uuid": "9a641322-8d93-497a-b2d9-eee843b56105", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789345, "uuid": "36a8c0a9-f0a1-43d7-b314-b31eda7765a0", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe85430-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789351, "uuid": "51dc7364-6d25-4554-9c28-90db5de523b3", "comment": "Malware payload (Mirai)", "value": "358cb1f4c4231bde8507757bb04f28db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789351, "uuid": "934f2c12-6742-4bb0-9b96-f8841a2bd74b", "comment": "Malware payload (Mirai)", "value": "6f550a80d7357ffe30c2a4d76dc7a47710b26605c4d418b8886ab761f518855d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789351, "uuid": "c64fe8b3-a666-4c3b-a552-65b61a02f98b", "comment": "Malware payload (Mirai)", "value": "7ece8535d96fda4771d319996557e598677d0605", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789351, "uuid": "e449d247-34e9-427c-9afc-e5e70354f3b6", "comment": "Malware payload (Mirai)", "value": "602150015900268eb3a87984dc0f7884be51381b4e34a8b8835f759392db2ad5393c94fd5089020b217500a231ff58e8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789351, "uuid": "478f1c13-294e-4014-b8d4-69e1710d5661", "value": "T1B5832B3899382A62C8D4F47B31FB8758F2F5321D28749A8E7C610E5DFF2479459862F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789351, "uuid": "cbfb8dcc-2d42-4831-9a5f-c35300d27a7a", "value": "1536:SiUHdc37av2+6GOqESDak4KWuRlDw6v2YUy5VrFv:BUiWd1rD74Edv2iV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789351, "uuid": "8f1ccd3e-9b8f-4615-a657-13f3e180bf91", "value": 81216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789351, "uuid": "500f1181-45a7-4e3e-90ba-cf865a71e152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789351, "uuid": "daaab3fc-97f1-445e-acce-15b6eb72b0c4", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f462c68c-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789332, "uuid": "f4ce756b-19ab-44a8-a48f-b333f73e0c2d", "comment": "Malware payload (Mirai)", "value": "20f04e462fa9451ac1b9812c99572cd4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789332, "uuid": "a2b7f8b5-5937-47cc-aca5-fc1c6d40d99e", "comment": "Malware payload (Mirai)", "value": "701f2bf2f9802cfa034b45b2c89cb0103d620b431493e307f4b7892270b89a4a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789332, "uuid": "da64ee81-d9ef-410f-95e2-bb1da4258284", "comment": "Malware payload (Mirai)", "value": "1153abeeec699458e068fa20aea506da0ecc2f32", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789332, "uuid": "f1a0102f-7273-423e-899f-32def47441f4", "comment": "Malware payload (Mirai)", "value": "9e7b1a6512fd881bb6b82981a767b759cea9480cc20af60c53720a6eb8dc0b15f2ca063250e3e612949b1f73e5dcb176", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789332, "uuid": "2d893ca4-d692-48b4-882a-1f003c1923eb", "value": "T14BD34B46EB808E13C4D5277ABAAF41493332E75493DB730699185FB43F867AE0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789332, "uuid": "b63a0f97-71f9-4a44-b076-cdbb014596f8", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZTqH+bMxVd0Yj:W9lgahz3sE1lcmiC/g1CgH+bMxVmYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789332, "uuid": "607279fa-f21f-4aa4-bdc0-650675fb60a7", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789332, "uuid": "9503e360-eb78-4ef9-aae5-ad92b37cfe03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789332, "uuid": "2137ada7-cc64-4a8d-9e14-6cec1ce0936e", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9620a541-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769417, "uuid": "ac8ac068-daba-44d7-a8a9-128258ec6cfc", "comment": "Malware payload", "value": "007eeb505de7502eb1e74d0032f8454b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769417, "uuid": "375e2660-6f30-4abf-9264-096d2447ab98", "comment": "Malware payload", "value": "71e447886f51c3feb06d6f6d1316294177353191b3310dde9d9d8c30ebe94738", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769417, "uuid": "fd290db5-b629-43cb-9253-dfda689b00ff", "comment": "Malware payload", "value": "10b34bd589fce59c29510cd0cc55a980f28b6d53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769417, "uuid": "ef720750-ac7a-4956-be03-d7ee72162ec6", "comment": "Malware payload", "value": "0d12df5ec284e77f42c8fbfb81b1214d5ee47c9993f35b1b3dfb76265fe99ec7e69c30caef5a1378789d1e3f4138abdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769417, "uuid": "9db0161f-52b2-4d74-b060-1fbde1700a07", "value": "T155A59107BA6685B2C14DA737C5D74E040362EDA53763E60E3D8A3BAD19333BADE06147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769417, "uuid": "29939ad1-2744-4f73-b4e8-684e7d9ec579", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769417, "uuid": "c8540420-674f-4e3a-be2b-fbc569f060fc", "value": "24576:DQ3jseXWCkm6Ljmsxxfbw5btv2nN2LXZ3b4e04pl+WdCqiGtSM:D6JGC36/1dcv22ue04pl+6Cjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769417, "uuid": "a9e479e0-fc82-4af7-a56c-b292ec8964eb", "value": 2121728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769417, "uuid": "65cd2e92-4a84-4453-9f1f-3d6903a22074", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769417, "uuid": "cdf2dd51-7c40-4c93-859a-6f15385ce478", "value": "QUOTATION_JUNQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294b70fa-4016-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720764939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764939, "uuid": "3bdf9409-ee20-46d6-95bb-f1deed3730a8", "comment": "Malware payload", "value": "e449e8239ec8d3910d2f81ed22ec762c", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764939, "uuid": "f65d42f1-888a-44a5-a5ba-852dbb2f3990", "comment": "Malware payload", "value": "732a6bf2345e9cc40b9a6a1164dc2e823955cbc56a5d3750e675d1c4db7f7415", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764939, "uuid": "a12cfef8-5550-4b45-ae98-7b20f40c8433", "comment": "Malware payload", "value": "07ad434b9828d917e7262713795ca91473389a35", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764939, "uuid": "edc5ed7c-e7ad-4aff-912f-8c161a9a9edd", "comment": "Malware payload", "value": "2fcf7dff3be3644b9b3e7e2863d7b0243169d5d0f1779ecb65ac53e8ed928f4bae73e55b3bc578b70f769ce82a38f371", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764939, "uuid": "05da2467-a3b4-4aa2-8b27-cc879c98768f", "value": "T112D4CEB0C62DF5DA8D22152953B5E0E36B5F252A74BFD22C231E514E2B0310D9FBA778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764939, "uuid": "6b3ab792-2e32-4274-9926-f9577c0aeaa8", "value": "12288:D+5QA/D71iL0nJvsy8+uZ2gV/dpC8U/isjNE0H37AfZwJCdPUdpYjPLMMMuMH15P:DUf/D71iCCGuwgV/bGLmK37EZuCBUdWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764939, "uuid": "8fe575fe-06fe-4cba-b4c2-aeb03a8f7912", "value": 633350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764939, "uuid": "26df7427-d0e0-4590-986f-a1ca75d4b3c0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764939, "uuid": "cc59a364-512b-439a-80da-1d3e97752104", "value": "732a6bf2345e9cc40b9a6a1164dc2e823955cbc56a5d3750e675d1c4db7f7415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f801e882-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789338, "uuid": "94832d3f-a81b-4856-b8c5-3dcf56715354", "comment": "Malware payload (Mirai)", "value": "b9d4aa38b8c081df5b67662b863ba96b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789338, "uuid": "ecc23646-3229-4841-90ed-65303484933c", "comment": "Malware payload (Mirai)", "value": "739d9f380d0e7fa1ba4c5431f04158235ad4fca102c429bdb70c60d13573fd47", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789338, "uuid": "c6ca7597-c859-4442-9ea2-9a4c7da0a864", "comment": "Malware payload (Mirai)", "value": "56f9fbd19fcb635af6eee4f2f82812d9aa6baed9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789338, "uuid": "16b486d5-0f42-4562-9e3e-498a564f259b", "comment": "Malware payload (Mirai)", "value": "5d70e3d63ed287f126a2ee1f4392a079d117c70bf0972d80bbcf4c7b2fef413180632d1bdddaa47a47c85e088a57e230", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789338, "uuid": "9dd1c95e-2564-4cbd-be6f-e70a1f9a6631", "value": "T1A3934B523328095BD4564AB019EF47F083FBEC4119F27648691EBFA60B73FB6108AF56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789338, "uuid": "c3ff73a9-8392-4387-871a-0466d11254d6", "value": "1536:C3YztHXDqikhtQ+wQXH6PbUMdFloenimHJF+KcZYDB1eR:Coz1DqK+ZaPAMdFlpBKYDmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789338, "uuid": "35b15f31-24a5-431c-b6ed-1431765f69ea", "value": 94870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789338, "uuid": "35acc515-6af3-4d61-88a7-8e6e0a034f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789338, "uuid": "da61bec5-d689-45c8-8a37-5920a76e602c", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc060855-4048-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720786714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786714, "uuid": "4f4cb60f-be0f-4c65-b846-3de41b3b8746", "comment": "Malware payload", "value": "65596da80c64cf01a226b19835385b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786714, "uuid": "acbdbfe8-f795-4946-8451-2790e1b349b6", "comment": "Malware payload", "value": "749b3f520c92d562330c4f8ce1632933917969d82cdc4fd6293ca2f465d47603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786714, "uuid": "1ae9e488-3f78-40b2-9451-9e651df05117", "comment": "Malware payload", "value": "4adf4690332eea67d1de16b1eb9196ac4911c93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720786714, "uuid": "3ecab734-d38b-4424-9f25-3eb84470ddf6", "comment": "Malware payload", "value": "85535d3e45642bc84e0586cde322e7617ba9d0024fb0ca3977c62955052938eea00ce6e345a2c505337a2adb14aabfa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786714, "uuid": "488aeaf4-5170-4ed9-889c-af3afabe6504", "value": "T16D45BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786714, "uuid": "3bca66ab-120c-4c36-92ce-4a93ce3b0c09", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786714, "uuid": "98ce3d17-da3b-4558-8ffb-c7e1bf9e22aa", "value": "24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aLC2Sbly7TWEPje:kTvC/MTQYxsWR7aLC2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720786714, "uuid": "162ea95c-c375-487d-997c-b823bbb8d2fd", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720786714, "uuid": "cf06b3e6-9ce2-4ea1-a7ad-3489e9cdd905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720786714, "uuid": "8991801c-1524-4d6a-be8c-f1764effe343", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec317c44-4057-11ef-957f-42010a9c0016", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1720793184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793184, "uuid": "0203f3e0-3c82-42c3-a9f1-7171b43b689e", "comment": "Malware payload (SnakeKeylogger)", "value": "8c0f245674a12540750ace4a664f3af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793184, "uuid": "92cbd048-130c-4781-8073-6d801d686a75", "comment": "Malware payload (SnakeKeylogger)", "value": "76afbad7304f66738d4f26200c7c1eb410a70b0e9a051794d93f836ced3fa387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793184, "uuid": "73204103-5f81-470b-9124-33dcc458fafd", "comment": "Malware payload (SnakeKeylogger)", "value": "a3809bd7cbc4d0448a6aff8bb3ae6f3b0546017a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793184, "uuid": "ba3ff8eb-1b2d-469a-b12c-fd33751657e2", "comment": "Malware payload (SnakeKeylogger)", "value": "91fd7d699d1c077244cbf87fce343f13e26d6d8cff86a1259678949e3bceec6f65af9e5734d3a632e952f63f8593d478", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793184, "uuid": "a17db856-e860-48ef-9227-be21ed8025f7", "value": "T1D0D4F185AE009B0BC431677A8465F37A07BA4A8537229B02DDF4BD7BBD16707FE1A0D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793184, "uuid": "7ca7cb01-0297-4e02-9d46-f5be199e4fb8", "value": "f677acae05efabe7411a40902b2d88fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793184, "uuid": "cbaa1b32-7979-4d0b-8d06-eb86469eb4a5", "value": "12288:XvxwRbB0H5KUjUPKCuO+ggobwxF80a/mBPjC:Xvx6bB0ZqAHgDSFa/ojC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720793184, "uuid": "8151225c-8bd5-4424-9eec-e2925044bc5d", "value": 645936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720793184, "uuid": "17d446a9-cc06-44d4-9926-0edb709bfb99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793184, "uuid": "6a5782fe-d47f-492c-b2b9-2cca04c436b5", "value": "rCompanyProfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e19de2-4029-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720773042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773042, "uuid": "7684040f-9909-49a1-8ab9-84474eb4c252", "comment": "Malware payload", "value": "9cf1b64cb6069c70fab40ae906cc7552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773042, "uuid": "c537f84f-98e0-4de9-b68f-6d671e82491c", "comment": "Malware payload", "value": "770db73dcaabcd6e3650a2019359f7372eb3510c1608ee7129c637e77df7bbb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773042, "uuid": "d06dcd75-ab7d-4852-a936-ca4be7604636", "comment": "Malware payload", "value": "04b7f293643f28f355123c0fd90c07c658065f9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773042, "uuid": "672ee630-cbe4-4fd9-b19c-c705aa4fd229", "comment": "Malware payload", "value": "c3700f497823e1bd49a9e0904fbf6cb95c7729a1c876b93547f8c34abd6ef58930d1a6e9b2cc4f79881fa7a6ac36a361", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773042, "uuid": "469302f5-b71a-4797-8e19-a37995d4d770", "value": "T1DF4733B3614E16C9D6A48836C037FD8875F4178F8B47BC782AD6D9E10066DDAFA0B853", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773042, "uuid": "1d4f4b24-9c3e-4242-a9b2-068e342689fd", "value": "9174ab7ca09135e613f81e91b8718fe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773042, "uuid": "a1322ea2-2299-434e-bca6-28d8dbcef2c8", "value": "393216:K5LejT8YqfuAb6Exw3hqOPPWzxgOYVhOZnXiE/bThOsfrEFpm2jzDFSxpTv:2Lmo96+0zPezudhOZSEOUqc2jPyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773042, "uuid": "09944d1a-7a65-4409-83bb-f64e761bd99d", "value": 25907200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773042, "uuid": "e6499f84-099f-4a16-bfbe-8a078bbcc51c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773042, "uuid": "dca97dbd-bbcd-4066-a005-4bf30904283e", "value": "9cf1b64cb6069c70fab40ae906cc7552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcff28c-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769426, "uuid": "cafe464c-722a-4044-b532-59e6fde93ee1", "comment": "Malware payload", "value": "9eba0acc24948313118af1f7146b6f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769426, "uuid": "dc94b173-0f0b-40aa-a6eb-93e59414db7a", "comment": "Malware payload", "value": "78581ba63d35dfb491d5c0660e4a694be41e3ea74ff01fc0b4267c0681925bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769426, "uuid": "a92b2d9b-a50c-4f0c-81d7-5fdbf6b366ce", "comment": "Malware payload", "value": "ab8d8176822b2cb2058243075b254204f5665bbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769426, "uuid": "c9d8a47c-3554-4d19-ac24-b73ad62e3dba", "comment": "Malware payload", "value": "93fe847bc70b80f28be401c5f8d11a67b04d81b9d8e035707c8567c8f1912ebbe8eafdb58fa040c763d5b0beaed2d944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769426, "uuid": "8b942647-41f9-4f9f-9ad7-bc97e58f9fa8", "value": "T13C74C95A7A74A132ED00CA3419F69E15D2DBEE6C2BE0551924D8F66D1B322FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769426, "uuid": "1f5d32a0-b0fa-439a-8ab6-4f872cf609bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769426, "uuid": "4aacb04b-13a2-4421-a2c1-a759f1417611", "value": "768:BzQe2VzEjss2yXg1ILcn0sspAgpq80Lyg1uMN0+dzsRU+eEC:BzQ7E/pqrLy0uyz+fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769426, "uuid": "595c4c4b-4f98-4305-b321-442ba2d5eef0", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769426, "uuid": "a8fb95a3-d553-4789-a6e1-f57032a06063", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769426, "uuid": "a4ab187a-13ee-46c5-9bb4-5fc421319b0a", "value": "QUOTATION_MAYQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76966db3-4014-11ef-957f-42010a9c0016", "comment": "Malware payload (AsyncRAT)", "timestamp": 1720764210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764210, "uuid": "ec2e2bac-234f-4c48-b625-e56ed7b9681c", "comment": "Malware payload (AsyncRAT)", "value": "85a84eff8bf73e4661824726438e21ee", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764210, "uuid": "d7fa36db-1dc8-42b0-bc40-716fddc4035b", "comment": "Malware payload (AsyncRAT)", "value": "78e20b9f9e36578c45d1c0e28e68299620ce085953ab3e468ab10f633e586cfc", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764210, "uuid": "54ab0893-6e70-475f-88cb-196aaa8e2077", "comment": "Malware payload (AsyncRAT)", "value": "a2b5401bbe15125c0d8d9419d87425366c991fa8", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764210, "uuid": "b7dee7ce-ee0c-441b-83e2-dc2da8df80e3", "comment": "Malware payload (AsyncRAT)", "value": "d5ec3b6aac30a2fab80c424c83b3a6ecba7c440db96bdd4a85a821d21384d002148ab8d0ece067748d6bf46d1a271217", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764210, "uuid": "f184d378-2bef-4777-aea6-f5f4e8b598de", "value": "T151448C3B9312FEDBCF3C4C44E16A2D492E9899A78368E24CFF8450A661E7511DF6D1B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764210, "uuid": "5f8dd642-5156-4bb8-b4cc-fcc73d761f18", "value": "6144:07TZQO29BnRDqjNITiIy0VN8Iq1e0gOYPWSOoHf9KU9Gw7:YCO4EOpQe0gO5M7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764210, "uuid": "4a4f07b9-532b-46eb-97d8-61c99bf5ff40", "value": 256764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764210, "uuid": "e857af5d-d4d9-40be-8dc7-590e3173f165", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764210, "uuid": "596611c6-6ba5-42a0-b4ad-86bea302eb35", "value": "update.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5afa5609-4036-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720778767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778767, "uuid": "c447e2e0-94f8-4e7c-8534-2940df1d8af9", "comment": "Malware payload (Mirai)", "value": "ff79e19760084a2f37c28721c0324160", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778767, "uuid": "d7f0e7ea-2658-49db-8cc2-3bb4b59cf887", "comment": "Malware payload (Mirai)", "value": "7a3c2c28dcfbbf25487222fe9fc2d035647a321e327146a4f3d2018dd2f98bf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778767, "uuid": "50e58f49-c19f-46f6-9bc3-dea0c781bfd0", "comment": "Malware payload (Mirai)", "value": "b3115609176f1189270682da57b0f8302ec678e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778767, "uuid": "0e328501-768c-4d24-a93c-b1678f98b8cf", "comment": "Malware payload (Mirai)", "value": "91aad4498493afaa15c3cd3078e6376d8cca92744c0f9987b73cfdc3c05ae600cb59d242248ce54b42769922b1db48d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778767, "uuid": "ccb6d075-61b2-4479-8c48-c16e6e7eec42", "value": "T18363AE22E4543CA4C82216F4B1B4E5B683127DB240C65DB5EDADF59204A3EECF98E7F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778767, "uuid": "59610ae2-bd82-493e-802d-8ec2d3b9c4a3", "value": "768:1JHKJowrjyi3MNZubPbPblAnaNAkltUefn3TlLh/eDF4LHyzBAyg64UJysl27ctn:1Ivpr7z57PT7s4LHurooRPq+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720778767, "uuid": "7a0b3d5e-1544-4b84-9a17-81cf40c146b2", "value": 70368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720778767, "uuid": "9a11f274-0af2-4df5-9ff6-6479f0e3e5e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778767, "uuid": "3d353210-5a88-46ed-a20d-274df0f77b4c", "value": "ff79e19760084a2f37c28721c0324160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f270bc03-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789329, "uuid": "414282df-7c4f-49f1-86cb-a107a1353d13", "comment": "Malware payload (Mirai)", "value": "cef40e9ed7f3b7fbd42c06f98bc78a94", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789329, "uuid": "b0f47d0e-cfbd-4fcc-bc7c-4495f7e17fbc", "comment": "Malware payload (Mirai)", "value": "7affc30dfd26500d70666f646a34ca05722fd37109f80f2412a230dd5d5b1884", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789329, "uuid": "10c70b95-5cf1-4222-be2d-d7ae0d254f3a", "comment": "Malware payload (Mirai)", "value": "ad5c9bdf8c6410a593ffd21355e4f40d9ded9a96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789329, "uuid": "14268551-1469-46a0-b1f9-dbd3cb150c89", "comment": "Malware payload (Mirai)", "value": "00045b3b00fbaffb099ae36f5b045eccf503b5729aecb724bcca021ca30223bd90e465355f421fea10783220c15b4728", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789329, "uuid": "0ee52323-78f8-40db-9c52-732f8c9d61a4", "value": "T1A1A34CC0A653D5B3CD83377810A7EB364531F9A6272ED647E3ACAAB66D027807047A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789329, "uuid": "66a401e0-2c03-4deb-880a-921194e5bf30", "value": "3072:OOS+AxMyDXmaWKq0TNORKMhThWhIwhnoI:CyAmaA0soMhTIZZoI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789329, "uuid": "d6ff2f9c-315e-4c11-b770-f8a7feeb160a", "value": 103089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789329, "uuid": "b9583193-5459-45e1-9fd2-67f34e3a4c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789329, "uuid": "2c9cc56c-2edb-4f4e-89fe-4b0c82fc9fd4", "value": "jade.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecb491e-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789322, "uuid": "f7ba3a42-d9e8-4066-a0a8-eba0cbe6f47d", "comment": "Malware payload (Mirai)", "value": "daa02ef54f6741e37e4246688f9fc986", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789322, "uuid": "5dda080e-ec89-43f8-8a2f-f1a9ba69a6b9", "comment": "Malware payload (Mirai)", "value": "7b1ea574daf4c0cf71d0edbc3bac0021774e1becc29a248fadde878bc194dedd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789322, "uuid": "09d214aa-6d91-4508-9394-42f9251634b4", "comment": "Malware payload (Mirai)", "value": "e45186c9403188876fefcb99dec7985a5ac9ea54", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789322, "uuid": "d249bf23-7c6b-435e-b715-7a260045701d", "comment": "Malware payload (Mirai)", "value": "3d63105794019dacbf1ee60c1b08e2f4eb0ea59136145e0e21f588c55e5095b322f549e732513aa37cce00790d46b145", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789322, "uuid": "92432bd0-46b8-4b58-98b9-fd2beb64eb90", "value": "T11C936ECAF441CD7DF88BE57A48164E1CA93172D10B930F2793A7FEA7AD76058394AC81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789322, "uuid": "248b6460-9b1d-4ceb-a0c4-7122113944b1", "value": "1536:vQy/6or/RQCeVKESfAg856aGQeuacWjcW0JcWcB4pHQRerNivty+Eyf:IySor/R7eVKjoGQeuacWjcW0JcWcBgHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789322, "uuid": "7dce1810-8a65-4fea-bc5e-0f66c815fd00", "value": 92724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789322, "uuid": "90593d33-81ff-41dc-9f6d-39343fb35207", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789322, "uuid": "963406d4-9497-4235-aeba-4ad5962f508e", "value": "jade.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bca8f3-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769420, "uuid": "93153912-b2db-4d4e-b153-c1dbaff0725c", "comment": "Malware payload", "value": "56d4a5ddd00c332ababa48e718ba3658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769420, "uuid": "02663fa2-66fa-4644-bf93-dbe9bbed151d", "comment": "Malware payload", "value": "7b6d6dd8fdabc32536d3a4f433e5e34d84e6619cdfb04c2e1b37f768b770e224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769420, "uuid": "3fc152b0-5192-4b3c-b43e-b2950a29edee", "comment": "Malware payload", "value": "76c6acfd48d0f21b66673d211f150c80cca33c42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769420, "uuid": "d3ae0963-da7b-4e52-ba8c-4c720d036179", "comment": "Malware payload", "value": "9ef76d36931d976c207a191ac8ff40e99af598ece32c7664be75d7e4cb595f973d94c46395b60d6edf034768b1df5fc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769420, "uuid": "3a95f517-f7ec-4c3f-87d4-75caf97ddd67", "value": "T1F8D407147FB4C233DABDC67650E68B4083A78D4A5AE6A74A55D0B6FC2A713BD5F03083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769420, "uuid": "c1deb7b3-6271-4c7c-94e3-d023263f2376", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769420, "uuid": "d39dd33d-d7e9-4268-99de-d071d6c41a3c", "value": "6144:V/KC3LXEQ8G2VQNyTcRmS5GQhAwx865gP9znhOw4g:N338LVQNyTcRmypx6P9lOwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769420, "uuid": "81535775-f87d-4458-ab6c-f528cd010715", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769420, "uuid": "a7d215ce-9c01-4e7b-98b2-6b477caffdd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769420, "uuid": "d0e225d4-e242-4787-9d7a-9fe50c14baa3", "value": "QUOTATION_JULQTRA071244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0c182c-4059-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720794073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794073, "uuid": "94a1b853-9094-46f1-97d6-b0bd5476ccb9", "comment": "Malware payload (AgentTesla)", "value": "48f2a6e2003057f7900db879e8c94d9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794073, "uuid": "90b93929-0ec1-4859-8a0b-e6c2e187cdf9", "comment": "Malware payload (AgentTesla)", "value": "7bfe8d39f948b86e84170769fa493b74b8fbed7d2ecb15333737bf9ed374929a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794073, "uuid": "73d07416-b7d2-4ab4-af0c-dc7b00643a8d", "comment": "Malware payload (AgentTesla)", "value": "4ed9b508adfd1a6eb3c4875bb8d2f35008a3b871", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794073, "uuid": "02ffe00c-c2cb-4757-b5be-6a4ed639bec9", "comment": "Malware payload (AgentTesla)", "value": "84479bc77afd1edc0e54e2c541785a6df01c5848962670d640087ad642c622ce7573ee94d4bba0174ce0fe9200cad295", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794073, "uuid": "00557f3e-8e06-4d2a-9ceb-09e999bab687", "value": "T1EA951262BC5B8C97FE9A24B8D9D235F226FDAD4378F4A90FDF11AC0455A00BF6241271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794073, "uuid": "42fe0568-d1e3-4908-b987-1e32d2917189", "value": "12288:niwXqIxx5Hvvwax02Gryho+eP87PD7AhwmgMNxXS/AYPQ1mRx:niARDvvNmNryhHeP8zDUhxbYvRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720794073, "uuid": "f918d7e0-757e-44c9-9c6e-d3c8995b5f3a", "value": 2034785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720794073, "uuid": "ecff89f4-628c-4100-9e09-fd61442a09e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794073, "uuid": "e9ee3953-4793-469f-b9c9-6923c3dfd626", "value": "rT__B__TAKSAGET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19df287-406b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720801783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801783, "uuid": "3f27dfc3-8445-411f-a3b3-9249735a56e7", "comment": "Malware payload", "value": "563a9b1fd2ddb52af3a49d71dd5d718b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801783, "uuid": "68e3fa57-f050-4f8b-9780-b0d625407791", "comment": "Malware payload", "value": "7c8e77ea0486fcff95895908b51f76109e7d4f401dcbee24c6951dc9f86ae96f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801783, "uuid": "804e09c4-02f8-4c13-b217-835e6d5dd67b", "comment": "Malware payload", "value": "3847664074fb2c7e687678de6c4c992368bd1f8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801783, "uuid": "2dd7e4da-9ce7-4978-9416-1314f8371e04", "comment": "Malware payload", "value": "e99c55e601c2780c6b3c7f30c50671e4bf805d08e49c4d9fdbb99ccb6ddeb1d61b64f6c1b8e0004d529451e801b88f22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801783, "uuid": "458eaa02-ced3-44d2-be06-34eb2032c336", "value": "T114C34A33772A0A23C0E6543141E79333B7BAC7D525B55207B6A09FAC2F1A6D03963BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801783, "uuid": "a37f7cfd-fa23-4b99-aeaa-5c207bfcdb8e", "value": "3072:j7lZfrZW8Niqu60XcphaEfIvE++qmPwAs85Y5n:NZfr/wRXcphaEfIvmqmPwAs8C5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801783, "uuid": "768b868d-c9c6-46e5-b865-1c5d7df69fa7", "value": 127247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801783, "uuid": "3ed6dbfb-43ee-4ee0-8d94-95215b723713", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801783, "uuid": "2ac88485-5305-4927-a348-2804c4e670ab", "value": "563a9b1fd2ddb52af3a49d71dd5d718b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f803c2c-4015-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720764467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764467, "uuid": "bd3fd96f-e698-4af2-b417-2d7070d3915d", "comment": "Malware payload", "value": "c9d56cd0a203897f2a7e757c6f56367d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764467, "uuid": "7ec97972-ec9e-4a04-8baf-14dbfacec23e", "comment": "Malware payload", "value": "7f797431b98fc646e12d1c85be00527bd78a991830dc5160188ab77854959f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764467, "uuid": "7344da39-3e06-4ec0-897a-aa360793a372", "comment": "Malware payload", "value": "f3ce65c3ddbc08ed507de1486992ed5d4dd67b6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764467, "uuid": "cf0197be-12bf-4a13-a1d7-16701b046779", "comment": "Malware payload", "value": "7d9d5bcefded816db55105bb56948a7ece62b76f66c37d7f45a0dccb0dc9166b14777fcfa8961dad9d0ff2febcc3d1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764467, "uuid": "84a17406-a7f8-43cb-be2e-e172cbbf6c85", "value": "T18945BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764467, "uuid": "0b8e3c99-2dd7-415c-b403-f510006e4327", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764467, "uuid": "02a8b800-ba46-49ca-adfc-4303c272b3cb", "value": "24576:MqDEvCTbMWu7rQYlBQcBiT6rprG8aL32Sbly7TWEPje:MTvC/MTQYxsWR7aL32dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764467, "uuid": "f7377ccd-6c46-420e-a1e4-1b084aa7e560", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764467, "uuid": "383f7210-a7ac-45ab-adc2-1eee70c2e366", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764467, "uuid": "25c42430-881f-41fd-bdab-526fbdc8e4a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ddac3b-4005-11ef-957f-42010a9c0016", "comment": "Malware payload (AsyncRAT)", "timestamp": 1720757795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757795, "uuid": "9dbb892a-2d87-4e7d-a4c0-eed71a03421e", "comment": "Malware payload (AsyncRAT)", "value": "eb1aa23f0faa87ed7e91acb9b96e056b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757795, "uuid": "ae105e1c-79f6-477e-82f4-a6df9ba88a9d", "comment": "Malware payload (AsyncRAT)", "value": "7f8a3c9b1f5fffc4627c130c5145f17870e20bb1121ab44ec948e614b3516dca", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757795, "uuid": "8d24a8eb-3833-4b74-b6a0-fa912fa4752a", "comment": "Malware payload (AsyncRAT)", "value": "30d55ed172ea1ed224c29b93973160d3a41e849e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757795, "uuid": "af496526-d60e-40d3-bc84-672d9a2e6fe1", "comment": "Malware payload (AsyncRAT)", "value": "5218eec3408b3752950d8759b1b874d42a92cc49f5e637feca0a0c6e228a05305c2e89852941a1ae6f8f000d24350c61", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757795, "uuid": "ef3aa08c-b9f3-427d-a870-e775a37ca563", "value": "T167D4BF0866FB6F0AD4B987B10175941463BB746AA777F35E0FCD24EA1F63B808A10763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757795, "uuid": "b735ab2a-a5ca-4c1e-bc4a-63989bf933ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757795, "uuid": "55141952-4060-4cbc-91d5-045fb7c35f5a", "value": "12288:xQfrYZpmxk/t/+El9Bq86bmB9nJ8P05AKDSlPvEUbdf:x+r2/t/+El9BRumFa0StPvEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720757795, "uuid": "cb54708d-2cea-4fe0-9600-f94e395f3dee", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720757795, "uuid": "b3eac376-f22e-4203-947d-e657503499bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757795, "uuid": "052724ab-a3fa-4ca3-a607-394c5dbe23c9", "value": "SecuriteInfo.com.Win32.RATX-gen.31110.7671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b20ca8b-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720759010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759010, "uuid": "595ff621-b74a-419b-b11d-9c8ff19dfb33", "comment": "Malware payload", "value": "5b937ca8959de385c000c72c1c54f7ee", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759010, "uuid": "e51baf29-3369-4542-b500-e80326bf39f2", "comment": "Malware payload", "value": "803932547753ec18d524c74f4b1bb82a6b4edf1635d78330abfbbd4ccdd032df", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759010, "uuid": "6651bd92-9581-4c5e-a4bf-a23f83318ee6", "comment": "Malware payload", "value": "c4546d7ef0a7a28ce59ba734f15ba64338383af1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759010, "uuid": "3057e79e-1e02-485c-9265-bedd5ec411a0", "comment": "Malware payload", "value": "6ebde5dae05bf751aafa8f78a940c4daadf9bf08aa2c6b3c165d3dda94c6d7daf2f76e7622fdcb8ca89f0f0f1b1750fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759010, "uuid": "aec07536-aca6-4476-be66-529ccac64de4", "value": "T173D0970AED32DC4E2223743018FB243864E1541A00CBCA0A87AED6E219E9EC0C28DF3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759010, "uuid": "a88cde02-63d6-4b9b-8ea7-e79254c5df0f", "value": "3:gZYWsXHRscTEJVOAq//VfHMovLCE8RAXIWrS5jiKRAXHekKfQkivFiaRRUfQT7Qz:+ARTTgVvadfeRyIbibOCUYXaGI4zFcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759010, "uuid": "7f96507c-abe7-4aef-956a-3cceec47ec05", "value": 254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759010, "uuid": "745c8d77-a5f4-4f5d-8708-52e371cc839e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759010, "uuid": "19e07d08-b494-4b9d-af0a-1e8a01459f3a", "value": "1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbff6161-4000-11ef-957f-42010a9c0016", "comment": "Malware payload (RedLineStealer)", "timestamp": 1720755737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755737, "uuid": "8869ae8d-4a78-459e-bd4a-25b926c8e629", "comment": "Malware payload (RedLineStealer)", "value": "0e4b0dd3ee5d91b69296e3887bde2d2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755737, "uuid": "ae93d9ae-43ed-4091-9449-8f279804385e", "comment": "Malware payload (RedLineStealer)", "value": "8042e30a34f07a606d6e8f3768f59d52133820a41794275481e3506b1e2d006f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755737, "uuid": "f1b5332f-a8b4-45c4-9d07-639963adb6a3", "comment": "Malware payload (RedLineStealer)", "value": "a040a44b9bb38de4b7399ae8856557e818aa68db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755737, "uuid": "212683c7-9018-4c13-b8b3-de13e07a0803", "comment": "Malware payload (RedLineStealer)", "value": "51196d781f03ff968de97ccfac10e1e74ceb5a9e77334aa0c84d20e52e476d0d3642b538a052e3b04e610b201354e575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755737, "uuid": "befc6309-948f-45df-bf6f-0a30e19b956f", "value": "T10EA35D30679C9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755737, "uuid": "5bc076e0-a820-4d2e-8769-b6c475a7b9b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755737, "uuid": "76726a43-8386-4819-b8b4-ba88d9736cf6", "value": "1536:5qsIbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2JtmulgS6p8l:XywiYj+zi0ZbYe1g0ujyzdp8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720755737, "uuid": "f8aff212-efaa-4186-abc5-141ad54befd3", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720755737, "uuid": "452a0755-e0b0-47c3-b7e2-84de1cfdc357", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755737, "uuid": "38225a48-997a-4f37-8dbb-177598def8ca", "value": "1b57c64883831484a42351afc0319f33f2dd4ed19b60461a9f65cba5bae1ecd5_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bfcd54-4080-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720810614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810614, "uuid": "5f5c4e8e-a45d-4340-a656-588f94590db8", "comment": "Malware payload", "value": "ef005053f5c2f717d565e0b1c147a693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810614, "uuid": "4b8ed28f-8679-4166-90b4-0a11bb6fc0aa", "comment": "Malware payload", "value": "81237fbe3332d33d317c4319a6d36b3b53d622efd4e6dc1cd1ddde3061a080e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810614, "uuid": "9c286b84-d5a0-48f0-9901-f393f882cbf0", "comment": "Malware payload", "value": "48d82279cb4e778cf4bacb4c07423f4c91124687", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720810614, "uuid": "c2a598ef-20de-4e67-ade6-c0721aa0e91b", "comment": "Malware payload", "value": "d906633a17d045b6f04b11b9370fc59921c887a4bfc95e8f4d74bf7885091a44a6548e67c5c96a039a828d3e5559272b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810614, "uuid": "f0e13a11-3943-45fa-8414-837bdfeea2df", "value": "T1A545BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810614, "uuid": "d2d8153a-6f71-41e9-a3b7-18eb1d990dae", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810614, "uuid": "1b2ab0ac-1046-4c12-aae5-136b8f22ad90", "value": "24576:BqDEvCTbMWu7rQYlBQcBiT6rprG8aLn2Sbly7TWEPje:BTvC/MTQYxsWR7aLn2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720810614, "uuid": "284bb125-2328-4c0e-a164-cecb4802bd05", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720810614, "uuid": "fd2df96d-aab8-45f8-b12e-8a2a385c4708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720810614, "uuid": "3ce81446-4561-429f-9079-4670fece23ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "088d5c50-4053-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720791084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791084, "uuid": "0930c212-a873-4f63-b9f6-701c562f2e3a", "comment": "Malware payload", "value": "c5af36e36e2a6e70b92ad7ca0ba104ec", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791084, "uuid": "78d0a083-d7d8-408b-a24f-b1706d470d09", "comment": "Malware payload", "value": "81265dbe98d5ca285182f6cd8225ea048ab6c2866d0994f77bf130dc22ff8b60", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791084, "uuid": "d6375505-1960-4012-8b65-4b5b8f3f1699", "comment": "Malware payload", "value": "a0ead9a8eae2a2dd8d2582017f43464e761cf43c", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791084, "uuid": "ba6e9b40-75b2-472d-96d2-32a7327a1523", "comment": "Malware payload", "value": "44a3b726e329a5cc5bdecc406153069bc092eb1cac89e1e28eaf3b63b8f0bc034666125064398e05d8c5caa064744a30", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791084, "uuid": "2f028cab-9921-4c5a-8ead-1515a0eecac8", "value": "T185C73390F5A96893D615D671C08F6B1C7295C5AC022346006E6DDE2D9AFB2C2CE73EF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791084, "uuid": "eef4e88d-3fd8-45c5-b8fb-e333561f069a", "value": "1572864:iucVsuCehofyuKr74DSfsSOB2sXDLDSOW3Bx8eW8XWa8VRnk:6ph+y7MSfE2szCOW3Bx8eW8Xd8rk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720791084, "uuid": "6d6b461c-be5b-430f-a1c3-5d145fb1190f", "value": 53560379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720791084, "uuid": "70cb9260-5ca0-45e8-8aed-59b62d7688ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791084, "uuid": "a4d43a69-1230-4cdd-9441-cfa3c7d2471e", "value": "45.9.74.32 Strela DLLs 9.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffde61e3-4064-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720798800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798800, "uuid": "98e11063-7122-4b41-86a9-458c4141287b", "comment": "Malware payload", "value": "7d0a24f4cb20164ca7e1704e28193a54", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798800, "uuid": "28bb6306-e6a1-4426-8426-b511c229677c", "comment": "Malware payload", "value": "838a3a717b2fb4bf0efb1ffcfefbb11477cf2676214679eeccf995ffe4049f41", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798800, "uuid": "7e83b20f-1a1b-4f90-80f4-46b02825fe6a", "comment": "Malware payload", "value": "8f2a52526a1a623a98a9d408be90eeaa9343a24b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720798800, "uuid": "3c295ddc-2467-4f87-bf90-dce230b6e03a", "comment": "Malware payload", "value": "2a84dce4d59e467e01c7e2617a356a4dc817694924cd940a765cdcd87dcd146c1a3ffa91c8e177ae3620aca1d53feb0a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798800, "uuid": "06613264-33f6-467a-9b96-9949510d8d26", "value": "T10AF6335C3A89736BD388F0FF376708CECCD553646E3AA889AA4DF271E3285512652173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798800, "uuid": "0925b724-1582-4ef1-9cc7-72a39baa3217", "value": "393216:S1Sen+F5G5C/iu+8GwcYED/Ywjz3EociEIIXiM0fzCcU9DJ+Cb:ubnM51AeY/p3YiEIfblvCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720798800, "uuid": "3cc34424-5e44-4581-8ad1-3b1cd3f5cd4c", "value": 16582938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720798800, "uuid": "32770f34-5b68-490b-a0c6-dfe898caad41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720798800, "uuid": "70133a2a-974e-4e35-9068-44ed6b8d79af", "value": "7d0a24f4cb20164ca7e1704e28193a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b71e723-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773909, "uuid": "894c13fd-cf84-497c-a8b4-015f71d5bb77", "comment": "Malware payload (StrelaStealer)", "value": "bf566417be09df69e1a64d8ad61a7725", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773909, "uuid": "9f9d055e-9c01-468f-aa12-8a13c7239270", "comment": "Malware payload (StrelaStealer)", "value": "84a32c041855c2f29a31501fb942f00c39a7982f9afbcce445213f23f39b7a2f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773909, "uuid": "7bfceaab-6a53-43d8-8ca7-880a3b8adf08", "comment": "Malware payload (StrelaStealer)", "value": "d5641906193be0361f00617d78d47348a2652d3f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773909, "uuid": "2e6b9483-e492-407e-acf3-66960c199a42", "comment": "Malware payload (StrelaStealer)", "value": "4d7e0f7c120d972df915d25c875522c0a9a5404917395a470aa4540d5cf93489d5aed85200ce58533a32f0ccec130d36", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773909, "uuid": "59c497d1-58ed-4dfb-bc39-913d61a62ce7", "value": "T15E418396C55C26047538492FECCC7529EDC06FBD032BE9D8B92F42ABE20899F7701487", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773909, "uuid": "eedd591b-bb9b-4b4c-9dc2-dd1f113ac276", "value": "24:OooGe1JeOHUVqnY/7J7B6ctMQdTob7re2ksrS8UPFEbx60+2bW5bMrh0+2bW/6Tg:5clHEqYFNdZdkb7Vc0+2yO0+2y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773909, "uuid": "48b43d08-9b8b-4265-9d89-047aeaa04cf2", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773909, "uuid": "56626923-9eb8-4d72-b60f-2ef93f435580", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773909, "uuid": "3c5f697e-b2a1-49e9-96c9-3650e2b672f2", "value": "23737186353201203.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c3d72a-4018-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720766034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766034, "uuid": "55e3c225-0171-45dd-9104-2c454f52463d", "comment": "Malware payload (AgentTesla)", "value": "82327d9cf26cb8125ed650a63cd16fe4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766034, "uuid": "8c051c64-e5b0-49a5-b918-70d2188a6bdd", "comment": "Malware payload (AgentTesla)", "value": "8747e56c9e9e2503dc7664fde2a9be12186fc7696ab06a4e86c932f65f4f2a1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766034, "uuid": "1e4b0968-3a2c-40cd-8618-4835aa1cf8ae", "comment": "Malware payload (AgentTesla)", "value": "7b117e9a75b039d67262e39b095721f292b93eef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766034, "uuid": "b37f0396-0ce7-475d-889c-28414ba5dfa3", "comment": "Malware payload (AgentTesla)", "value": "9751c3081d156a63566289a4a1135eae81b449d9f1ad36269b2154ef4a53bb8f53d9c3fbec006a9d60b7ad2be90d9de9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766034, "uuid": "9f53fd0b-2174-46bb-ad93-1bf89d1b3ba4", "value": "T12BF4F1986AEBAFA6D9FE07F704716C5403B2751A6534F31F2FD620C72926BC04946B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766034, "uuid": "d052450e-1607-40d6-bd7e-9c587f1ad298", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766034, "uuid": "a6a75552-5b7a-42e1-9ba7-40ff24b713e5", "value": "12288:kLsUBk7L7lPFPacXMza6afhu0N99WShm/ZebGA5QuNqztRr8K9nThtmm:msPZIcXMWfE0N9oSh+e3Wuc7QsThtR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766034, "uuid": "bd1743e5-8beb-4464-a09a-dd2db5215e70", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766034, "uuid": "44eaf030-7585-49f1-adfb-afeb3c2d2e35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766034, "uuid": "74ecb3e4-8b3f-4eca-bc5c-36232085ffaf", "value": "Products and Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec83f6cc-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789319, "uuid": "102b7a51-c032-4092-bd60-043b69af45b1", "comment": "Malware payload (Mirai)", "value": "fdd7c89635ebe665bae72ad30ac12e66", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789319, "uuid": "864eeb9e-a23f-4532-8f5d-d4eeee1752e2", "comment": "Malware payload (Mirai)", "value": "87fd8142445e05adc5eb5ffb4287de5043137b78c74ae0c42ad61f869f5a3e23", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789319, "uuid": "6207e889-fc0f-4192-93a3-044e8a92cabd", "comment": "Malware payload (Mirai)", "value": "caf86b2d3484fce02c0bf9368cb42b05ab3be763", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789319, "uuid": "80d771ac-8bcf-4a46-a914-56dc33cb7ac0", "comment": "Malware payload (Mirai)", "value": "8d02dd1888b2d780a7d2358cbd76ffd3d7b459923aebb3c9fc8a131cb3e918043ad2e8e641a954bf5e416f24d1a688a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789319, "uuid": "ab74a5df-c5e9-4c98-97b9-12d1a5e6c115", "value": "T17043C795BC83892AC5D413BABA7E01CD332573E9D2DE7253C8204B543BCAA1F0D67E95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789319, "uuid": "4c89f0f7-3dbc-416f-b72f-a19e32c1457e", "value": "1536:/nRQoujsxvPlKPHtcBFLVjPzjobyx183RBzonn:qougwcT5jPo2xO3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789319, "uuid": "ff55f548-ee61-4482-b4cf-27eeb3e426b0", "value": 55216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789319, "uuid": "b1dbd8d0-27ff-4d1e-afe4-a04624119dd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789319, "uuid": "13826e98-50df-487c-b2d7-4faf4c95dc8f", "value": "jade.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4c7af0-4061-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720797131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797131, "uuid": "e1b8aca5-a74d-4a61-83bf-f00e0f0dd9df", "comment": "Malware payload", "value": "90f9973120104179d008e06cde39670c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797131, "uuid": "1c987d8d-b0f8-4b17-adb5-d116d7d1534a", "comment": "Malware payload", "value": "88c32d5d4132b4d58d1b02b9d183fd954f87f449f3d51ea3eaec8f9d12f913f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797131, "uuid": "81de6efa-1a3d-4bae-8aa9-be9220537f75", "comment": "Malware payload", "value": "75b4479066accc2320385d0bed8d7c5d1d666bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797131, "uuid": "3ee97fe4-ff5a-4f8f-9091-e21df12a0699", "comment": "Malware payload", "value": "b724b4b2b9ab159ca2cc1ee6e8c6d1a21f6de5f1fdbace47ab5d8fbed4ea1e0d47244b04f6a64dd9008b6f898f8bc036", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797131, "uuid": "44fc5cdf-8029-4688-bdc3-3e82010159b0", "value": "T1049413A296D2DC9AE75A6BB4D03BCD9861553C74EE843638C361E11FF52034BC85BB0E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797131, "uuid": "e3d1b784-3d8e-4bf6-abc7-420e7b7f927c", "value": "5a8eb7c995095bbe76f458d24b691038", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797131, "uuid": "aa707587-8510-46c8-9ddd-8fa12500af3d", "value": "6144:rGdCAohu2CHYuZXL4HURkKd6Sq4Tk6XlC9RukP5vBH0vwr5LtOztaOaZIm09Pkfy:SuT3u5eU3kFRDHvLCa8ea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720797131, "uuid": "882f84e1-f72e-40ce-a06c-f09270afcc0b", "value": 411136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720797131, "uuid": "88b3b3eb-c409-411d-8d14-b50aec5f6d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797131, "uuid": "be596bbb-2d32-42a0-84f1-3e77eb699c8a", "value": "SecuriteInfo.com.W32.PossibleThreat.19610.21891", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff312185-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789350, "uuid": "3d2a65c6-3e8e-4671-8962-776b95b5dc11", "comment": "Malware payload (Mirai)", "value": "b59f2bbfece2d6b2c1cb9c2678d0eb1f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789350, "uuid": "01477a1a-ef02-4097-b594-a460a2b1a379", "comment": "Malware payload (Mirai)", "value": "89a9bc22d73997e766ad7dbe295598f073f58e63565ea68f8223733f808eb0b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789350, "uuid": "d392cf07-5757-4a74-b4ad-da273f251d70", "comment": "Malware payload (Mirai)", "value": "b471235cd57df9786aba092f15681c45b57c1e17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789350, "uuid": "01c73e59-4e1b-446c-b0fb-22ddb8943d0d", "comment": "Malware payload (Mirai)", "value": "8f149dac763d77218f2bb3f4d64527d235c986988012d87f2a3d360f3134ea88d9e5d7564164ca69a772e8795f1f22db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789350, "uuid": "be5f0100-ff0b-4c7e-ae9d-cfec3a9aef0f", "value": "T16E637CBDE2B85E44D29149787D104439C723F406A6D62EF6EEC6814FA99BEDCF104BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789350, "uuid": "48be69f9-6eb0-4bc8-9f73-534340c344c6", "value": "1536:q/BtF1dgaBnYzFUFpm+gcZcV2fs31dPpoHx1ygCY3:qZtj+anYzH+gcZJf+XSHx1yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789350, "uuid": "3189d546-c3ec-4d90-9d91-6419bab4c77e", "value": 70644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789350, "uuid": "9c72dd20-3551-4bed-b59a-1e4eab3bdad8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789350, "uuid": "910d2ef0-120a-4a16-ad27-b4805b5bda09", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909d4593-4098-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720820947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "bfc53977-905b-43c5-9799-d57174f56d84", "comment": "Malware payload", "value": "86450a034e05af523bebe56017fa418c", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "1186201d-ef70-4bf3-936d-92c9c9e22eac", "comment": "Malware payload", "value": "8f3c947d5d1e2d3e3fd92acd79951c6c39320ab9d599fd5ae52e11fce00ace41", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "30d32918-61a8-44b8-bf64-9cc989e720b6", "comment": "Malware payload", "value": "c619e02ab6d4cf7203860f88e934b225744a5407", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "95ebdf90-1cf7-4a38-a9cc-ea8b7472db24", "comment": "Malware payload", "value": "173809f60be1516fc552131e7cf637b241979e2e1d3ef2ee323f1f1a3f48bba5dbe778f8e37c622bdaf63130cd705ca8", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "5fd631bb-0130-4806-b2ae-baec8eb608ce", "value": "T192846B2377E4E53BD2FE8B35E43206116BB4D596B616F38B5A1C50F82D223859E4C3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "fdd15e62-df8b-406e-8c2f-7e02a7a4af71", "value": "6144:6mlMJmfK4EiauLppbLUO0JIQyna0Sjt2a1gZ:fkmJaul9d0Jxyna0Sjt2a1gZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820947, "uuid": "59daff8f-f892-45c3-8b77-b4c90c4eb674", "value": 371777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820947, "uuid": "549ee24c-7cbf-4421-9dbd-832adde05559", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "0c538d0f-b3fb-451b-acb1-bbaf23142a50", "value": "1720820945de99614a76e6ef15fc20964aebf2f4497d38c108b1a74655fe9b343ab757e4a6418.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17627f84-402e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720775217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775217, "uuid": "44566427-6203-4697-a2f1-9bc7b9d64a85", "comment": "Malware payload", "value": "fc7e97b595adcde38e7ed10d94c68d9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775217, "uuid": "464962b7-68f3-40ce-80dc-a41f0902b99c", "comment": "Malware payload", "value": "8f770135b76bade3370fa0db1cefb4d6a9897c27e19284c0184d74d60de8fca5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775217, "uuid": "9fefc803-00ad-42b0-ba3f-4f68312feaf8", "comment": "Malware payload", "value": "0344e908e299d07f6538522e244ddabf015ca1d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720775217, "uuid": "ac0fb3db-f059-403d-86ee-1aa71b1e1093", "comment": "Malware payload", "value": "e545dacbd5375c8df7019e202b598f00a265de400c6543bb989d5ffeaa760d4811872390f6e5287a147d30a02aa08df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775217, "uuid": "f097e18b-3b9d-4b84-865e-6998497f47cf", "value": "T123527C9099948071D962A8F2307C62F3E90C04B56314989B9B572DBB7FA04D247FE3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775217, "uuid": "5f16c7a4-d1ec-4b41-8568-8aec48e4a1f2", "value": "384:TX5Y8eFgIdfxZdnwjidxP1SiSdVBbvGMhS:TX5Y8e+yPdUdTthS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720775217, "uuid": "e3369a1d-2395-45dd-82aa-ab7bd8f39b91", "value": 13887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720775217, "uuid": "f038a6a3-f40b-4599-9810-5d6e8f169b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720775217, "uuid": "300ad676-4057-4636-b406-7f94e81a42a9", "value": "fc7e97b595adcde38e7ed10d94c68d9d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ce1513-4005-11ef-957f-42010a9c0016", "comment": "Malware payload (Smoke Loader)", "timestamp": 1720757815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757815, "uuid": "f22229a1-f2d3-486f-b2ff-02e8ee21e9ff", "comment": "Malware payload (Smoke Loader)", "value": "f7384f89717636b18a0b9a2f38a0bdc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757815, "uuid": "0386a5c1-fbdd-4d1e-8204-7e6eb9bb4ab4", "comment": "Malware payload (Smoke Loader)", "value": "8fd4c66e2864ac0827a57b3fdb27a2a1adb28228969134bb1dd9971b07c7144f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757815, "uuid": "16e0152f-8717-47c6-8960-69e031acfaa6", "comment": "Malware payload (Smoke Loader)", "value": "deb3bcce0374a5a815fa240ba3a18cd0b6064529", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720757815, "uuid": "ce809678-5f58-487d-abf1-a5d935409fa5", "comment": "Malware payload (Smoke Loader)", "value": "b03ebd63001e92988233ac5ee2abc4feb69b99e4ef1bb7ff16116cb19f6f0773acb7015f3bec8717f0d56dede3435563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757815, "uuid": "4a324794-1aa3-453f-9682-3999fd10834c", "value": "T10FF36C2076F6BC36F3F79A34297497A41A3BF9B37E70915D2258121E0E226C0BD55B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757815, "uuid": "0079754a-d0b2-4a14-aa69-d46b238f5a05", "value": "94dae44f10027b0c4f2dfac439252c40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757815, "uuid": "de867608-7a3e-4127-ad07-e92dc6d8ea65", "value": "3072:9jGcLI2Kn7hVxtT78Pl5IhhoC5olyRTvq91lFIi:ocLI2Kn7/H4PlihhYeTi91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720757815, "uuid": "ee20e681-9ac0-49b6-abd5-3b5b46266018", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720757815, "uuid": "f8f5ee1e-e13d-4345-b8c9-989a6c6cbf10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720757815, "uuid": "28602b2b-ec84-4804-b19f-b587a4fe94e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903de6fb-4098-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720820947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "85b74ddb-f8ef-4757-aeb7-bfb79e80f57d", "comment": "Malware payload", "value": "50fc3bd88b8871050c2395db3486ade5", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "ccee74f2-fa95-41a6-bab9-3cbf5ab8bf5d", "comment": "Malware payload", "value": "910a2275f247bbaa7e79a2d1d7cd07cdd29a32176d05df4ee884cfa13821bfb2", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "8cfc9083-ce59-4d60-a7ec-57a09b40ff55", "comment": "Malware payload", "value": "84f986ae08e08a567e960af2c0d167fdba1224a6", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "055f20fc-7e2d-49d0-a10d-cc426946fccc", "comment": "Malware payload", "value": "167865b5dba1b194422fa5149300d0fe148955f4a34f3fb41818125e19de983c0a7b1ba180b974bb736177a10b94d688", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "f69da7f8-49b6-4cf1-9d81-5950479f2e30", "value": "T15BE2194A7BA58225C6BC1AFC8CB313210772E3478472EB5F5CDC98CA4B676D44285EED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "6013e69c-2f74-481b-81b4-3477c107723b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "90af6482-9f85-4e3e-99de-90e2fc3fc882", "value": "384:R0bUe5XB4e0XFOZD3pixEpfEWTBtTUFQqzF1Obbx:KT9BucV3piM/bx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820947, "uuid": "c0ab77ae-1efc-47e6-bd48-99343c49985f", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820947, "uuid": "99362f42-218e-41cb-942a-147415746d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "abb83a38-fc9a-4e1e-b837-a6f78be36e5c", "value": "1720820945e1f3427512d3c6e28bdc1352b59f0a6b85b9ba33d17b5d68d69d895f412b1edc220.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4866b36f-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720790761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790761, "uuid": "0d1966d2-1ec3-4273-ae0f-3af3fbc64853", "comment": "Malware payload", "value": "3fe67ed979c38761779a2af0e1286d5d", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790761, "uuid": "a3b21c1f-1b6c-44e6-902e-5dfa61dd1189", "comment": "Malware payload", "value": "911565730db5e8b59dc5d3411b55efceef46c2d5216a3b82ecbab8fb7a5a8121", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790761, "uuid": "3957b2c9-f550-44d2-b6ee-73ca83752f47", "comment": "Malware payload", "value": "51dd3d2800452fe6c7de51b3c45fed2bcae5eac0", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790761, "uuid": "275dd755-b352-4a45-b375-356840d99be2", "comment": "Malware payload", "value": "b3b0726eb1bf20bae77aac8e9cf854da5817f7049244059ab5640840e63100294eff5ad97d02752423ce5da4932fa6d7", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790761, "uuid": "d83f1b44-bb2e-4d93-ab95-ff74e7d73287", "value": "T1A2C73361F49E9467D20ED074808E672862A589CC05378750AE5DEF693AFB1C2CE736F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790761, "uuid": "1d44b41a-f1d9-49d9-92d5-f039eaaf2e44", "value": "1572864:XAEaJ7485X9smu/3zkSS8UXxydoATpmucBca8ZX6/WsR+gq4hdxLrKKl:XAP8819lc3zkSS8UXmHViBc7X6OsBB31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790761, "uuid": "c2f18af5-5260-4551-8090-e0081841d3b4", "value": 53558297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790761, "uuid": "50353153-724a-4dc9-83cc-458999bcd4de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790761, "uuid": "ffa2db69-972f-4f3f-abf4-4921621dd57e", "value": "45.9.74.32 Strela DLLs 1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ea3637-3ff0-11ef-957f-42010a9c0016", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1720748589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748589, "uuid": "d035ca13-b59d-4857-bc68-bc9bf9a884a6", "comment": "Malware payload (SnakeKeylogger)", "value": "c7b7ebdf4930ff6779d76bdd45946948", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748589, "uuid": "c1272723-c992-43c0-9a71-10332b5fa7fe", "comment": "Malware payload (SnakeKeylogger)", "value": "913cd900bac8b259d001c29ac6b2416bbc00b53808d91b03cb4989bdcc39c9de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748589, "uuid": "326b68f5-a608-4216-825f-7ae2cd9055f2", "comment": "Malware payload (SnakeKeylogger)", "value": "1bbb3e379757b85618127135687a41024786c7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720748589, "uuid": "8e2aedb1-abd7-4f01-aa2b-706f1571e605", "comment": "Malware payload (SnakeKeylogger)", "value": "d56e4cce91ce836b810486476d216b5edc2acf8e2daac1f871880cadff816898e9e6bbaaa8ee8939f1f339d829f14a00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748589, "uuid": "18ccbf39-ba5d-47dc-acbb-502cc9890e8a", "value": "T1C8E30910EB69C236C9BE2B7AF82257310FB5E5C66435D7E64A841CFE2C537488D40B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748589, "uuid": "f50d5536-bcc0-43e8-9767-9852e06c60c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748589, "uuid": "35137f91-a3c9-4dd0-aa69-c3f225e5e6d5", "value": "3072:8wRtcJTMywvcBxgj75NubdG1HElGL6a4QUyA+cEr/X:tj7SdOE8L6a4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720748589, "uuid": "a63e939d-68a9-46e9-8e63-22c0a0e2b26d", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720748589, "uuid": "d21dd3f5-6ba8-4da2-a3fc-864560de1bdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720748589, "uuid": "7efda499-6dae-4e54-a9dc-e0d065699ce4", "value": "ER987654567909.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a7e6e0-4055-11ef-957f-42010a9c0016", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1720792226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792226, "uuid": "14ef2eb0-c1b7-4da3-b796-b4aa85bd41b6", "comment": "Malware payload (SnakeKeylogger)", "value": "d0600192505848cd995a4fd00409fd4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792226, "uuid": "cd3a9450-038c-4271-a8fd-569f8d0d001f", "comment": "Malware payload (SnakeKeylogger)", "value": "9190f2a2da37d5b77fbedac7a67049355a778cd0fff6f6d0c11e7a34fac24405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792226, "uuid": "caed4f43-28ae-4d0f-994f-41cd5f91ec49", "comment": "Malware payload (SnakeKeylogger)", "value": "47f909d0611d16aed132b9be1bf4048824fb8a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792226, "uuid": "1189432d-df3e-4a3f-bbc2-a1e21698ef57", "comment": "Malware payload (SnakeKeylogger)", "value": "8bdcabf4e02cf974ae96248723209cdb2217fa44a64e7960e9517468f513acdf57c4c010d43223c213ae09c3777bc5df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792226, "uuid": "89aa2c75-e18e-4344-987e-b26b76ed4813", "value": "T164E46005B7A45750CC28EAF25A225960C53CBFC5A7A8B8470D3A36EF5A33D83DA47D1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792226, "uuid": "a734ed27-382b-4efb-8250-4e67d99386bf", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792226, "uuid": "58429ec5-d02a-4253-82a6-f35b1a05c7dc", "value": "6144:96bAcJM0Y9JnNJP3fyLv5s6MZgrSmArB14lqE7HjqDA/VbVwq77EUT:OPY9XJP3fYv5sBXnrT4lqE7DJbVv7QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720792226, "uuid": "3ea7abce-a973-45fd-a152-93c84cadc674", "value": 684915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720792226, "uuid": "11ebf87a-5813-41fd-9eb2-076a372f274d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792226, "uuid": "c0f388ce-d9ca-4cb2-8e9c-fd4d13229f45", "value": "SecuriteInfo.com.Win32.SuspectCrc.2428.21334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499e7647-403a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720780455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780455, "uuid": "5a7f61b0-affb-4fa3-8113-1d8f2317744c", "comment": "Malware payload (StrelaStealer)", "value": "6b24990187f40efa2dbd847dd45851f2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780455, "uuid": "56dd8853-d5c2-4db7-acb0-b9ac03814638", "comment": "Malware payload (StrelaStealer)", "value": "929cf94ab330c1b33a4b35b344b83f5313a0e174a02b2b844d4f2596363c9398", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780455, "uuid": "4145bf06-aaac-4c4e-a8f6-fa06c7fe21cd", "comment": "Malware payload (StrelaStealer)", "value": "863ebc36b620ead9e1da9dfaf5c28fb41d0da3b8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780455, "uuid": "96141e19-eaa1-4ff2-a117-15c238a2c41d", "comment": "Malware payload (StrelaStealer)", "value": "8a71b50c46ff6932541950de35ec114e2079f8ec2c9370685eebcab239b944099b2c7f6b8434f2927dcee562f11752ca", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780455, "uuid": "dc0efdfd-396b-4ff5-84a6-99b1b10838e4", "value": "T18941AEC4F577C6D8E718F903395AFCB0CAF28E722A51F44E80C5835AF2F640C0A92086", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780455, "uuid": "0359aa01-5671-4474-8452-1eeaaf64800b", "value": "48:vrptlLqQPhl1iDqU62zYzm0jzOFti0ptY0Vzz:vrptlPTQO92zYzm0jzOS080Vzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720780455, "uuid": "0947b4db-6b22-4b53-a604-e5808101320f", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720780455, "uuid": "edb14e50-fec4-431f-b21f-2838ec1dea7d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780455, "uuid": "ed019cc2-d8dd-4374-b14b-f61a89806b7f", "value": "240162345316727422.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe32c82-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720756166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756166, "uuid": "56b6563e-531e-4034-8be2-c01163b8f4de", "comment": "Malware payload (AgentTesla)", "value": "ba8f4e01db94f311b3ccf3ffa1374010", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756166, "uuid": "c6e513c0-0b9d-4bcb-bdf2-463ea4ca6ea8", "comment": "Malware payload (AgentTesla)", "value": "96a1656ba39abe013fe75a41eb52d9b698f723aa7b5f2ba836a8bc3dccb47e2f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756166, "uuid": "edb5165e-4dff-4a96-ab6b-befaf14b096f", "comment": "Malware payload (AgentTesla)", "value": "046871f85902bc859834f2da3b6985c46be9a536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756166, "uuid": "0b0230ed-a381-4d31-b213-eff11596da1f", "comment": "Malware payload (AgentTesla)", "value": "6cbab89b442d77b47483414f1222eaed418560fdeeb20de0e0e989256b7ac4041b37bd06dd27eee779ea359ccf7abbd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756166, "uuid": "ac08086f-d9fd-415c-92a7-dea84e884836", "value": "T1BE358C02739180E5FFAA91735B55B20156FD693831338D2F12981DB8BDFF1A12E2DE62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756166, "uuid": "d5f86e4d-c990-4340-a985-34f5d47bead7", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756166, "uuid": "6d5f2960-28df-494e-b52c-cd372524a112", "value": "24576:JAHnh+eWsN3skA4RV1Hom2KXMmHaUXydRKPdmT5:Qh+ZkldoPK8YaUXydR8dO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756166, "uuid": "c4a663cb-fadd-4e27-aee4-1e3194e55a66", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756166, "uuid": "8c35118b-63ae-4a27-bcfd-8605a0afa621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756166, "uuid": "a9bc5985-bbe5-4862-ace1-623db58553de", "value": "ss.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6a55ff-4017-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720765673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765673, "uuid": "b0219b25-869a-4f8b-9101-7b444d6f0378", "comment": "Malware payload (StrelaStealer)", "value": "064de47cb0bd8c57cb6e8abae894ce35", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765673, "uuid": "92d01b07-0927-4a43-830d-3e866eafdcc0", "comment": "Malware payload (StrelaStealer)", "value": "97a514ee6856c58d4ada1a7be778a9cd6a5d41818d27bcb71688d0ad4bf52361", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765673, "uuid": "a1e060f3-adc7-42e1-8178-73ec9cedadfe", "comment": "Malware payload (StrelaStealer)", "value": "c28cb4c17b8307878cc08af74f6070b71d6b8017", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720765673, "uuid": "1f981fec-4b04-4fb2-8066-63ee9afce0b5", "comment": "Malware payload (StrelaStealer)", "value": "9b37595ca2d2fc89c923ff1c2d7dbbcbb8f504c8f44886e47e1362658bb4dfeb96d41dc5e8adb7c2d46a3c806488bbe5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765673, "uuid": "c2e0fc35-0c0d-41e6-8e36-13f82c5f064e", "value": "T14D41A8C7738B99F60D22DACEFE176705642C7A783D50C5AD920C666391644BFCC7404B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765673, "uuid": "a4c9d586-ec03-4692-82bd-ce2dd5ba826d", "value": "48:60lcdE/G6fOwi1zST8l0dPk4zTrPEBBxxXJrPEBBai2kN:D3VOwisejsTrPEBBZrPEBBaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720765673, "uuid": "171e8101-b723-4c26-9203-5b88c54c935e", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720765673, "uuid": "91ad72cd-1bb7-4c26-badd-64a1d91d5019", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720765673, "uuid": "231a77c6-97ab-4906-8a44-44d0a636cd11", "value": "7510241902649329577.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0b0428-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720756003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756003, "uuid": "8ff2f8e8-7d56-42c5-8931-d240526de205", "comment": "Malware payload (RemcosRAT)", "value": "84bafe55d9087cdfce20ebdd74b8610f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756003, "uuid": "ea9e4efb-e92b-4553-b1aa-1ceae53a74c9", "comment": "Malware payload (RemcosRAT)", "value": "99a37b119f17a69497cd85b20466e078ffe63573266437bd62cbec91205465e2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756003, "uuid": "2d90b150-e92b-4e62-91a8-fb64d1dbcf6c", "comment": "Malware payload (RemcosRAT)", "value": "738c8db7918e79aba33bbc51949a51651a8da74c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756003, "uuid": "a6d036b6-63ef-43c3-89f8-e33965fbb7ee", "comment": "Malware payload (RemcosRAT)", "value": "322eab369424799104df2084618bf5b5fd64fdce4f8ac0740574d2f58d61449d6d2b0febce7ce1c83a97137cf86444a2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756003, "uuid": "87fa3f82-7c12-40d2-b5ca-806462f3dabc", "value": "T1CC93244CD78F44A6CF64A277432A0A8886FCB77EB60515B5706C93B537ECC2D40A697C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756003, "uuid": "249249e6-cf8b-4a2d-869c-96a6197905d0", "value": "384:nVyE+1+h5MyFEHm6U8MpkmNBpi6WbOmwazu9vbz182xgO1DqsNT:nvAuueEG7pkmTWb9MvX1HggJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756003, "uuid": "43438733-e53d-4327-9ed5-a46655b8dff0", "value": 95272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756003, "uuid": "3c7ad368-85b0-4d77-ac82-aad0e341cb95", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756003, "uuid": "5e22f527-7dbe-471a-ba8a-5c973d9025ad", "value": "84bafe55d9087cdfce20ebdd74b8610f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac49dbe-3ff8-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720752352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752352, "uuid": "b0c1efcc-7ad1-49b7-b719-f87014505f55", "comment": "Malware payload (RemcosRAT)", "value": "52c34c59183a5b51c6635a5c07dbe83a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752352, "uuid": "57c0e9e8-f68e-4c54-80e6-3a6c183f8720", "comment": "Malware payload (RemcosRAT)", "value": "9addebe94747ecae48221b2b7efaca6527d5e5a9fa8b792699e2d885d26004a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752352, "uuid": "e7288525-1bff-48ec-a619-a2979204a9a8", "comment": "Malware payload (RemcosRAT)", "value": "7def618896505fde8a6d91fe34bff462ccfaaed9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752352, "uuid": "05ec7d23-e86a-4766-ae2b-e6edbc6653dc", "comment": "Malware payload (RemcosRAT)", "value": "fe4cc236e71a67bb0eeb08519f2b1498658cf79ec6ee234eb6bfde8236945ce77cdeaec92da7298f02a9da97af999b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752352, "uuid": "3d26192d-734e-4b1b-8406-156f10ef3517", "value": "T14735F195E6A84F42ED7C9BF454322D1003F77E6678B1E24C5DC970E63A73B820522E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752352, "uuid": "4d280e29-fd15-468f-bb3d-47090ae93ada", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752352, "uuid": "612bbbac-9c3f-4f07-9928-9011eca33780", "value": "24576:wMIQNlECrbLafnmKvsdgIS0sR7v/vMJ7tHNVuq0CR3NNgz/5X:JIQNJnufXggIHsBkJ7tHn/xRdA/5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720752352, "uuid": "43d70bb5-3ddd-45bd-a063-8a6620ca296d", "value": 1113088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720752352, "uuid": "1726a927-ca11-4b3a-81a9-bd3b3b691e78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752352, "uuid": "ef721278-ca83-4e48-b960-c3ac82688b33", "value": "HOU3ED3EDRFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a4843a-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720790993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790993, "uuid": "5dba60e3-a1fe-4655-8dc5-6f3f4966e9c5", "comment": "Malware payload", "value": "2c34ab60ae04e40c740d89fa24a764d1", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790993, "uuid": "87721be7-c6d9-4427-a35f-f17d91564c83", "comment": "Malware payload", "value": "9b87b62391f32ae8191d3cc4ae27a66acad2394f5dc37ce4ccd8acfcd06e6e0a", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790993, "uuid": "fb241c10-b55f-4535-a61f-96641879b4a0", "comment": "Malware payload", "value": "bf9c7398469a443dae821c069906bec94c879dfd", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790993, "uuid": "70004e41-c4b6-410d-81a3-fe05a02d1607", "comment": "Malware payload", "value": "b0b802ca011f9f84c8d9b12f42c70315798ecc87e00ff180f2b6fae601ade081bc38986c900d53e36f67b3ee8bdb0bb2", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790993, "uuid": "8153e64b-7908-4506-a2e6-4e33420fabfa", "value": "T1F2C73351E553A886E90AD4B1908F1F2852DAC9AC026787154C2DDE397BEF1C18E73BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790993, "uuid": "ca631cac-336c-4dde-a42e-261aa8f8ca0d", "value": "1572864:FGRbwu02JwoDScnCHJaDyQkXrAb+Nyp3DsLMTpFZ:FkbwmSNWyQeUb+Nypz2MTpFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790993, "uuid": "1e1d5022-4e2c-4391-810f-47b02e21e927", "value": 53548163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790993, "uuid": "7c84ce75-5f47-42e0-a8dd-589b590374b6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790993, "uuid": "752846a2-f942-4317-bd11-531ea0434b0f", "value": "45.9.74.32 Strela DLLs 6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc5a042-3fe9-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720745623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720745623, "uuid": "61639fa9-577b-4db6-9c8b-7b6208838ff0", "comment": "Malware payload (AgentTesla)", "value": "d6b4a9e8ed6be51f3a6f37b753cbbdf8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720745623, "uuid": "5e0e4627-9b55-4ce2-bb79-847133891ace", "comment": "Malware payload (AgentTesla)", "value": "9cb78844b0d23a887c049f6a1de76e7429ff2c81c6e5c92fd42deb0b5be2b4ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720745623, "uuid": "c3f9be84-c36f-43af-b175-6cef881a7824", "comment": "Malware payload (AgentTesla)", "value": "cbf0dad01f0f3d535bea58161fc5c56d8f7e6905", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720745623, "uuid": "ac69200e-ee50-4d62-a660-14cb54d2a8f1", "comment": "Malware payload (AgentTesla)", "value": "33630be3dbfe8a31d09b7c0d965a7b5fc67eb20820c999dd41d502356dbb3b1e5e1d9d4d87be607479df06f8881af324", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720745623, "uuid": "e048f32d-b061-4817-b2c5-235fe3b9124d", "value": "T18EF4020563EC8652F6BA22FEA49D04D85F70B41B56C2C7E9369C97DE2C62B83450733B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720745623, "uuid": "4f97f51e-a71a-49e4-8234-f0012a62033b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720745623, "uuid": "9a7fd70d-deaa-489a-a2e6-13717849834a", "value": "12288:5VUM0xC0MOWW4oiuy4JbH2BIjj6psEi6s7vc2XCq2zI/fYe4LlnYhNP:rJECacwbH2BIjj6pE7vRXII/fY7BENP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720745623, "uuid": "173959fd-ac58-4d62-acf7-670595672929", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720745623, "uuid": "8f2c0f77-ca3a-4319-92d7-a16a59cc5746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720745623, "uuid": "78059a9a-06f4-4559-9f24-636ba42aa808", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5513ea-4003-11ef-957f-42010a9c0016", "comment": "Malware payload (RedLineStealer)", "timestamp": 1720756811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756811, "uuid": "a8132fa6-badf-4d52-8559-38478209f0b7", "comment": "Malware payload (RedLineStealer)", "value": "897eed97e49be61757f1a9a4297f669a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756811, "uuid": "d33aacdc-e3eb-47ed-91f9-19b036cd5496", "comment": "Malware payload (RedLineStealer)", "value": "9d3a9d1466d81346ab6324ccd10a855137c6b93ac6fdd6cba5e67621b047fb63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756811, "uuid": "cabaf6af-aec0-41b3-b3a8-60afc9de8590", "comment": "Malware payload (RedLineStealer)", "value": "e7c07af23f6048b8661b3896ab1451ead71552cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756811, "uuid": "5dc7d80f-6373-48fd-9893-8e13de8709ce", "comment": "Malware payload (RedLineStealer)", "value": "df42cbb09d27fdf8231d15ff12cfba605a1e27218f87057b94dfa32640dec88750957e6c7e5901acf2f0424e6cb3fe60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756811, "uuid": "bd7833f7-8c09-48d6-93c8-5e1ed4b9022e", "value": "T1FF15D050A6FA6F06C9BD4BB121B5850127BB742A6677E35F0FCD10E61FA3B808D19327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756811, "uuid": "04680069-300a-4e97-bf01-663e7702b558", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756811, "uuid": "af7a113f-0fea-495a-82c9-5bd62d026326", "value": "24576:1Zxi1l69gP8V0H/9x39tL7sXtR4JAy0UiZKBWHI9Mx:tsl6q8VG7s9RGAyCtGMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756811, "uuid": "531c0115-a6b1-43f9-958e-2d695aaa260a", "value": 900504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756811, "uuid": "37d85068-5808-432d-bd0e-356550854df7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756811, "uuid": "cf4fc51d-995a-4e59-aa9d-a76051bbe6fd", "value": "Purchase order(600010310,10303).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd92d072-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720769510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769510, "uuid": "dc9c8ab4-d4e2-4ea7-b239-26033f3a2d43", "comment": "Malware payload (RemcosRAT)", "value": "4d5aa2285d7426050f478210bae7c5aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769510, "uuid": "c5910256-1071-4f0b-bfaf-5dd746820e8c", "comment": "Malware payload (RemcosRAT)", "value": "9f200b4426729f0d0f0b5977709c26f9961594f6612468102cec4dde53afc124", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769510, "uuid": "25db8fca-4f41-44da-af9a-5ff94edcada3", "comment": "Malware payload (RemcosRAT)", "value": "54d7e8ce63dd56acc9dab89d0fe9bdeba0acda96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769510, "uuid": "8665661c-6cf4-4f12-b806-0b8d5f8959c8", "comment": "Malware payload (RemcosRAT)", "value": "6db5a724307f5df53b4fcace0af97acf955d25a53fd8c3ced1dc115287aa03294d74807836dabd4e2b3dc25f367fb2a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769510, "uuid": "aaf07886-52be-4579-bd4b-3b8fc8d5bc12", "value": "T140B4F1516107F825D92297F01BE9CB3D0BA13FCB285B8606FE867E9E3873382029D5D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769510, "uuid": "e77fa5e8-76ad-4c1c-a493-4d62335b3803", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769510, "uuid": "53cf8379-8a23-49d1-93fe-1dcf014cc766", "value": "12288:R0NwzBmcW5C5E3FRSnknkt7PY4vgxCZ+5JOwxyU3Bb/:fzwchGVRFktENxCZMtRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769510, "uuid": "35b34b88-c760-401c-ba6f-0766840305bc", "value": 495888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769510, "uuid": "797a80a6-e094-4537-82d5-1b13f4535181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769510, "uuid": "e8753f89-9dae-455e-95e7-30bc5e09be05", "value": "RFQ24060084\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71eb93c8-4014-11ef-957f-42010a9c0016", "comment": "Malware payload (AsyncRAT)", "timestamp": 1720764202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764202, "uuid": "65eb5d7b-63ec-4215-a334-ae60f081cdb5", "comment": "Malware payload (AsyncRAT)", "value": "114cfb0a1a06cb6c621edfbe35c6de7d", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764202, "uuid": "1b8274f3-ab6d-4874-8f60-3e15f03c812c", "comment": "Malware payload (AsyncRAT)", "value": "a07479025c1100c57c7240d438305e85db5ea96d4d31f7103c3f27f044e19bd3", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764202, "uuid": "35672655-d38a-4e85-8deb-ab19a94c8598", "comment": "Malware payload (AsyncRAT)", "value": "c8f44299a96807e741507423fae47e46afa8d434", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764202, "uuid": "9bb8bf2a-f850-4d65-b5b2-267605970458", "comment": "Malware payload (AsyncRAT)", "value": "cddcf9f3aecaa304cc82adad18e65f74b57971d50c8de708c2e5a2108a2ae4d2020b82dea56eb91da32bf7e90f8f45e0", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT-HVNC-Grabber", "colour": "#78E6E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764202, "uuid": "07b745b1-2cbb-4011-bedb-49b4ae67206d", "value": "T1CA149E99BFD2DA6DCDB07C33469317850305E4C2A1B09B579D8AAEA05C53A9C2F067CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764202, "uuid": "46f0be00-18e0-4652-8463-29af33b1ced3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764202, "uuid": "fd646608-d5fc-4a52-9f42-905c9b65370f", "value": "3072:a4BXIEcFjraWaHC9dZa6y/WKiHCDF2s87j34Ih0TiRurbPaxR:hXKcXi9dZa6kWKrhKj/h0Tsuvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764202, "uuid": "442ed568-9414-4146-b935-bcea11a065f5", "value": 192000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764202, "uuid": "56437696-9131-42bb-9c74-cc8fbfaac27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764202, "uuid": "8a80a661-509a-4440-9a16-a06719baa580", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59140e3-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773791, "uuid": "67cb5751-649f-44fa-8a6e-6fdb2eb61ac6", "comment": "Malware payload (StrelaStealer)", "value": "17cac6e52940a11d051201a6d0fd5a21", "object_relation": "md5", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773791, "uuid": "c6e51106-9a34-437a-b08b-09c2c4439e21", "comment": "Malware payload (StrelaStealer)", "value": "a08b10acb648cc12b07c69d184cd00b1bde9ba9606a38ece8c505facfe161955", "object_relation": "sha256", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773791, "uuid": "133636c0-15a4-4847-9f08-32efc9c2ee65", "comment": "Malware payload (StrelaStealer)", "value": "90ff14df2ea5d5b69b167d00149d5a357ffa38be", "object_relation": "sha1", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773791, "uuid": "72163bb8-aa99-4ef2-b921-232c22126fe7", "comment": "Malware payload (StrelaStealer)", "value": "d19811aa1b051edccd4326fa25b5a80dec65431bd4410a37f29c81b7247edcd2a3a9ccd8bdcd1363f4fa48e9b1ca15bd", "object_relation": "sha3-384", "Tag": [ { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773791, "uuid": "61ad61f1-f262-4ba7-b947-598dbcc7a67c", "value": "T118F06208801ED190C80FC6B4A123FB625088A309C58C6C1AA2BD40A2DBC62F4AA34E51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773791, "uuid": "6eaf530a-c98b-4cbb-b29f-53eade6710c1", "value": "12:5j8A0jy/PNaPFdvcP8RbfQ0BgYaP0Hasq6msBQ7iqNAp6C7taeX:98I/eFZ481dPHasq8Bupgb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773791, "uuid": "6a8ddeec-4f63-4d7b-8d5c-fc23394d7a3f", "value": 650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773791, "uuid": "927de4a5-542d-4386-b5c5-53c62dcbaa9d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773791, "uuid": "27f884c4-8da9-4d1f-b371-9422d3e2632d", "value": "Rechnung,68974.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714df280-4039-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720780093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780093, "uuid": "2ed8a5e2-c57a-44ed-8904-8d6876b1f418", "comment": "Malware payload", "value": "f013565b3f9e18d9ac83432b4f0c08f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780093, "uuid": "9696afaa-c9c3-4023-803c-2ed62c00fe50", "comment": "Malware payload", "value": "a2da67b2c6bdded8424c239e2ddc36a5da7f556e967a25b5c3ec0db4473ae31e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780093, "uuid": "511de696-e1a6-4186-b7b2-373156b51a2f", "comment": "Malware payload", "value": "d2cf38dfa9f307618ad3ead673285af0960697fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720780093, "uuid": "5c1f2c04-df99-4cd7-aabd-8a34d369acc8", "comment": "Malware payload", "value": "3f39f009b3aeb34e31c00dfd43aa1b7a3b9cec40ea2b5cfc2cb18265132aa5719038c0f1c80fa50f7c38354d0432af69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780093, "uuid": "5e5c948b-5af3-4016-9483-ef76db401c17", "value": "T18BC422308485DCA1C67763FAC0718E19826978B1EFD2122E4762F76AFCA1743D14F36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780093, "uuid": "34634916-55e3-4ed1-a5c0-0e1cf8e30976", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780093, "uuid": "53611daa-09d9-4ca9-854e-8b919c3e6815", "value": "12288:MFLN7pJxDibQF4ulRCX11Ab1i0n9aMd50jm6s6OgIUkBJoKISZxNex:gN7p/DjF7CHIkodP6OVjpZjex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720780093, "uuid": "6ef9d89d-3bc8-4c2b-b6d5-2809c3b02fff", "value": 588288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720780093, "uuid": "246930fd-8fe3-4db7-9f9c-5865c7b0dfd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720780093, "uuid": "7fcace2f-debf-4cda-97f5-0272ddbba60e", "value": "SecuriteInfo.com.Win32.Malware-gen.17934.1638", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b93d4f-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773527, "uuid": "a19bc87d-6a1b-42e6-a92b-d94310864b73", "comment": "Malware payload (StrelaStealer)", "value": "c7cfa157c555fc50310608a516a337d8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773527, "uuid": "545004e3-3ecc-41d0-b03f-773500ab7319", "comment": "Malware payload (StrelaStealer)", "value": "a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773527, "uuid": "9724f17e-c014-4e83-9cbf-dbdcd95e2def", "comment": "Malware payload (StrelaStealer)", "value": "b4427847f0f0b46cd728373f2867f20ace446b49", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773527, "uuid": "caa02836-e3cc-4446-8d52-8e8b39f24bb5", "comment": "Malware payload (StrelaStealer)", "value": "76acbea143a6c268eaa148b0b49100e72ba2a7710b7dda3c16a274a8ddef462e2856401f967d7f7f119229e5e9d29709", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773527, "uuid": "a72cceac-be90-4bb3-ab28-5c3046dc2195", "value": "T10D4159EA8A90905B8CB3AD0F76C7B8E28A11DD32CD35847C69354D0AD13F0AC98B1337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773527, "uuid": "d8dc8c61-e124-44c1-8cb5-824cc8fbd1ac", "value": "48:67qjKYW/wAL9e0rJpUD+HZgGJOqqNgLJOqqLh:6ug429eJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773527, "uuid": "78b67403-8f79-450d-86e9-393d84bee610", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773527, "uuid": "04e55011-c3c9-4edd-b744-91eb412088e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773527, "uuid": "13967308-0d75-4ed8-b915-c3f399e0aab3", "value": "a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791a6d5f-400e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720761637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761637, "uuid": "80e07695-cc64-4f24-a63d-439c40bb1318", "comment": "Malware payload", "value": "7b5889dd0e754b146ff199e1555942f6", "object_relation": "md5", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761637, "uuid": "10c08cd2-f529-464e-a692-77e7c62ff703", "comment": "Malware payload", "value": "a370c7ac61fe327c2079326aa3afec127b611aa29c97bfe9dcd1041d301c152e", "object_relation": "sha256", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761637, "uuid": "eaa6e4f2-d1a7-4cb1-90b9-3c3bf488338e", "comment": "Malware payload", "value": "882f5eec218fbca49d10fe1eeb9079fca1a6eb46", "object_relation": "sha1", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761637, "uuid": "60aa5d5b-595d-4867-9725-f4fd69be03a9", "comment": "Malware payload", "value": "8f81b3d2e6025b086e0c3a3babad744a2a02e80d147f5264f07b50365d79595eddf3c03ca9dc7b2872d8ea14510e1e0a", "object_relation": "sha3-384", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761637, "uuid": "f27b8cfa-c840-4d87-8e75-e99191f64ac1", "value": "T13682FAE0D5622B9C1C4733F39C75B7BCC6248CF66433432B99A7B4695D063892DAC4EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761637, "uuid": "e08ee6f1-1339-4db6-a5e1-c87dfdd39553", "value": "384:4G6wA1T89Hi6IUAxq19/Aj1M07MA+zOTNE4SQQOhVpz:x089CI2S/ApD+zOTNE7gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720761637, "uuid": "52d4772d-7884-4c15-a543-c9ba06eba2ec", "value": 17977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720761637, "uuid": "02c27819-a552-40d4-88b6-c90514ca10ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761637, "uuid": "da999a62-3cd3-4f48-bb72-bd74590c9ab6", "value": "a370c7ac61fe327c2079326aa3afec127b611aa29c97bfe9dcd1041d301c152e.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd394ff5-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789347, "uuid": "76a1ce0f-4aea-4cef-9f43-bccff8c6c243", "comment": "Malware payload (Mirai)", "value": "b3c18f1e74d45a65c6b361ee37190ee9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789347, "uuid": "258c9e75-2fb3-4e27-8ff2-62d05d0c7eb5", "comment": "Malware payload (Mirai)", "value": "a3ceea3616f2476242e165c5be0065505ed61a1ebcf4f41873a7056f73894d57", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789347, "uuid": "78bb3d1d-c329-451b-bd9c-a3252c59e305", "comment": "Malware payload (Mirai)", "value": "106796e62e867d8c58229f504f1bc21dfae198fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789347, "uuid": "7f97ff0b-ed24-4d00-91a5-f19a1a5f8507", "comment": "Malware payload (Mirai)", "value": "4e23ad148fe9494c253109fe6038840e63024edd88f5ce1da4aa7ee6133cdea791e7bb4ccd5c2926606797c7c363dcd7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789347, "uuid": "3392acd7-f5ba-4ed7-9b93-849bf452bcba", "value": "T1DEE2E1145B1165E1E153E17D4EDB37B42A300AE2EC221C8AB4EEE143DBC94793ADB7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789347, "uuid": "eb6fb0aa-80ab-4291-a827-f1e9478e64bd", "value": "768:GHiX0hIAjIBfYwftE+k4TG4u6idlBiBjFEqfW1/sDvJgGlzDpbuR1Jh:GWEIBwwftlPCez1DtVJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789347, "uuid": "f4b405c8-52c0-47ae-b781-82269466304f", "value": 31476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789347, "uuid": "eab024e7-cc03-4f16-a8c4-a2b9ee926213", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789347, "uuid": "8e50ce8b-7793-4d39-af76-afa4ccbf009d", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e891dc-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720759006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759006, "uuid": "7abb0e1d-d711-4458-9068-2da957714895", "comment": "Malware payload", "value": "0d9672164ccd3bceb58117e207c050d7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759006, "uuid": "269aef11-275e-40cb-935c-2fbb185d29a9", "comment": "Malware payload", "value": "a51a1dbc0cc0d84e014a801c8dbf35262c74b9beb1faef41f216b0b1a7125af0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759006, "uuid": "61beed37-4d84-41e9-8bd4-1d71e856731f", "comment": "Malware payload", "value": "b7ff9e9fab3e928ce1f6b3550043f02fdf0d7e5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759006, "uuid": "3650ee00-e2f5-4252-897c-036c2fcafbc4", "comment": "Malware payload", "value": "1b6378a954a6e21f4cde8117489821d71a63ab43d0ba1af74806ef9ea728c664c33d91c930fe8ce5d1fd70510a390f7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759006, "uuid": "c7fb2810-b2db-41c6-9299-d791a484baca", "value": "T1AA9002E31C24C51E0566A06445ACB60D84D560163489D881A1C18055A7115F07F84550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759006, "uuid": "182d4527-a7da-4257-b013-03e0cdae7b5f", "value": "3:gp0RM27WXMevGc7Ln:ba2mXGYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759006, "uuid": "759a11db-3690-4f89-a9a3-d452f0f35c16", "value": 57, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759006, "uuid": "f5f2d053-6f4b-43a6-98ea-7ca402e0574d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759006, "uuid": "75e54416-44eb-4ce7-945b-a5ab1475f9b1", "value": "4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ccdb532-400e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720761643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761643, "uuid": "dcb9a59b-640c-4a35-aaf9-30788114890c", "comment": "Malware payload", "value": "815a26732b8fb0b36d6cf93858def357", "object_relation": "md5", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761643, "uuid": "21cc58b4-767f-4fcb-813d-ea4647c5915c", "comment": "Malware payload", "value": "aa012e5b757959f95b14b9866f36c49335096a95b4f058ee9a85b6552a0e168d", "object_relation": "sha256", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761643, "uuid": "b71c7fb6-f17a-4633-8273-8076ee22325f", "comment": "Malware payload", "value": "11477fd544c21dfc7762df7b815f389a0d49253f", "object_relation": "sha1", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761643, "uuid": "6bfd88b9-dc51-40a4-ab3c-0cb54c94e6a7", "comment": "Malware payload", "value": "fe76294aff1b86209337995537371c90a9803c043a1ae202bbfe1f94ebefd00c1fe033ef36dcae7c9c0bc34c345a6bdb", "object_relation": "sha3-384", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761643, "uuid": "2475ccd0-adf8-463f-baa4-50b71e63d51f", "value": "T10782A10439713BAF098B3EB38C6A7FB096741CF38577E3A15928B07C2924655BD1D1EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761643, "uuid": "1379124d-edd2-466e-9cd8-1a46db0c3e22", "value": "192:6Txoz2Qoh/LvIdCurkHzv5Y2flOTSLg9Me2Z+WcdvRwqOf0i3IykU/7CcLOPpFBq:yC2QSzWA3ktg+prVSIsGdFBnuzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720761643, "uuid": "3bc5bb38-d084-4759-86cc-0bcfba1dc268", "value": 18872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720761643, "uuid": "5066dab7-ea01-4ec3-a2f6-043cddef15c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761643, "uuid": "25118a41-547d-403c-9393-64daaab20d3f", "value": "aa012e5b757959f95b14b9866f36c49335096a95b4f058ee9a85b6552a0e168d.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda0ed55-4018-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720766155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766155, "uuid": "5904bb3f-d0e6-44ea-bf69-e3bd293ce0cb", "comment": "Malware payload", "value": "bc85062de0f70afd44bb072b0b71a8cc", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766155, "uuid": "4440731d-0138-49d9-9504-2dae5a3ff851", "comment": "Malware payload", "value": "ab56501167fe689fe55f6e6ddc3bb91952299bd5c3ef004b02bf1c3b4061c7cf", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766155, "uuid": "7e2e8ca7-a75c-43bf-bcfe-dced2694f035", "comment": "Malware payload", "value": "66fb63e6e49c2c201a0b6204e1d0269812a4b662", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766155, "uuid": "678c2629-1698-418d-af0b-221b474ca708", "comment": "Malware payload", "value": "bfdc3f94adb9365262fee6092918b3a20c13912188561c21b1dbc25c7fd0b556d6700f61e9bb2567f3e474b3def41297", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766155, "uuid": "ff7cbd73-5b53-492a-99f0-51aaed8b0652", "value": "T1B1C37D1B73A500BBE4778239D9531A06D776B81047619BEF03A046AA2F237D4BE3DF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766155, "uuid": "6afb87d3-7b22-4473-89ac-dbfb75ecdb80", "value": "0cd7b92b97ccc7e255df1f46b5299986", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766155, "uuid": "afe33539-e476-4448-a8d5-985246d59caa", "value": "3072:MaWH1sVXJZWcTYdGaz5qe/PyUAL93TP7MauW0dK6gO:hZWcTYdGgqe/PWMauZdK6gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766155, "uuid": "78388d61-9c27-4a58-af5c-9a936edb9a8c", "value": 126464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766155, "uuid": "22cb78e9-0dee-41f2-aef1-638c28c0f1a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766155, "uuid": "2e3788c9-3056-4ba6-a5a1-103a669370a7", "value": "ab56501167fe689fe55f6e6ddc3bb91952299bd5c3ef004b02bf1c3b4061c7cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6b6e06-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773534, "uuid": "df720b16-a740-4c53-a0ee-9bf3c46b30ce", "comment": "Malware payload (StrelaStealer)", "value": "9ba0b163812a4980351730a24619c8be", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773534, "uuid": "2c39998c-f05b-4769-b50d-9e0ad7b41acd", "comment": "Malware payload (StrelaStealer)", "value": "ac8a3a7801060b81e75b1645f2498609321b622020193a6f507f2ed028d5ae04", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773534, "uuid": "b9e46eba-beb2-4886-aca9-708d2df81a24", "comment": "Malware payload (StrelaStealer)", "value": "8db9fc421a599c453141f8ddc8259b396df432d5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773534, "uuid": "8b6c8395-0625-4ed9-828a-a721d7d0e930", "comment": "Malware payload (StrelaStealer)", "value": "c33ef7e204e673e556ccd6a8fc7333861bbe952edb841c751f380fc58787a738fdf65dba9acccb3f7437d5fa2d7e21bc", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773534, "uuid": "019349f9-cc8d-41f4-9523-35295b1ef0a1", "value": "T1E04180C14664B3249CDDD018FD36F9A9701A153BDCD8D92D2522AF83D98F05CA9687F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773534, "uuid": "f42f1849-64cd-4420-b2e9-a91f8a91b031", "value": "48:bL/pOBXL3MepD6yXHWy2T88AL+22h39ZL+22zuYGV:v/+LNvLmZL2uYU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773534, "uuid": "96285523-8204-4f64-8c0d-54c0f686b62b", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773534, "uuid": "77de2948-07dc-4868-8ff3-e28d3c411b93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773534, "uuid": "40d29e15-4fbc-42ee-8323-42279a0db161", "value": "ac8a3a7801060b81e75b1645f2498609321b622020193a6f507f2ed028d5ae04", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdf3352-4049-11ef-957f-42010a9c0016", "comment": "Malware payload (Adware.Generic)", "timestamp": 1720787177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787177, "uuid": "af4be3e6-cd02-4475-b8e7-a882c5879466", "comment": "Malware payload (Adware.Generic)", "value": "a2a21a088de389387181f38572f1dd2f", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787177, "uuid": "658e26e5-f0aa-4b98-a7ab-46d41d975b50", "comment": "Malware payload (Adware.Generic)", "value": "ad3401cdf40d2ba56d75cd69efde6b9661f2cf231dabd847e592010b4b3c9e5b", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787177, "uuid": "97a379ab-c9b1-41c7-aaa4-7b1987199880", "comment": "Malware payload (Adware.Generic)", "value": "441424a9d4662e5590c32095d9bff2fe67aac72c", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720787177, "uuid": "c484b78d-8e89-47a9-9c5d-d7f71ceb09c1", "comment": "Malware payload (Adware.Generic)", "value": "4bfd94259b1d1719c9778e38343689450edb5b48fa444486e24704baf906c2d7eaa04a251ff5c73533f3a3c416cba220", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787177, "uuid": "4173e0be-ca59-4794-8445-061823e02f3d", "value": "T1D4A7333BE218652EC45A07355872CB30967BAF62640E8D4A47F83C9FFF764601E3B691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787177, "uuid": "fbcde80e-4b10-4e3b-bf65-8f1307c1047d", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787177, "uuid": "e9b8fe62-f4e6-454f-9e69-1dcedd870475", "value": "786432:UYmH0vUnqzJv89NpuOUnB1OHiYMrgcfGX7bGIjZ6m0tBLvHxGc/ABapOnrtOVEhO:UdH0dz+nS14cr7fGLla7LzppOnxaET6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720787177, "uuid": "29b8d019-0014-466c-af25-ee47d6f9e451", "value": 44274736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720787177, "uuid": "19159891-4bc6-4c68-aa30-4935554c1df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720787177, "uuid": "7b98fe19-21d7-4719-a25e-e34da878aa6b", "value": "SecuriteInfo.com.Adware.005b5c2a1.30290.30025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92fac867-4098-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720820951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820951, "uuid": "3a6a1c79-d6d1-4fd7-9a2b-f0ac1a241e4b", "comment": "Malware payload", "value": "09b872989ce605ddaec4afa9ff048578", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820951, "uuid": "680e4f6e-e834-4690-ac9c-0b69b3c9ae61", "comment": "Malware payload", "value": "ad6de1f3cbfdc2e918d6fa6f3add09b50c88574b60fc794a06c2563bf179988e", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820951, "uuid": "2d61b6c9-f742-4ccd-94df-82ac29f9558e", "comment": "Malware payload", "value": "1f16f6b0ed308578a5f021461be176afbe8de33a", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820951, "uuid": "8b793e0e-1ee1-4bb7-a461-b2911e12d060", "comment": "Malware payload", "value": "f7047503a8e1c9a36d99e84bc8a259d4003a00833dff12fc65927b4b93f502d6ddb2e16f6f4bf8853d4164ab48ba5a30", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820951, "uuid": "5b8a3b55-11fb-43c8-8c54-a8cadfaa637b", "value": "T1A7E2394A2BA8511AC2BD5AFC8CB303100772E2438532EB5F9CDC44DA5BA76D07695FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820951, "uuid": "0ecb229e-e5cd-49df-bb2a-dafd15796b59", "value": "384:68EW+4HU36e6uSF9eJEzEWTAtTUFQqz9WObAm:oW303a3ei8gAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820951, "uuid": "2ff988af-6249-4126-9635-83512559755e", "value": 33050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820951, "uuid": "4b6996da-aa0b-48dd-9004-dfb673f0768b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820951, "uuid": "c6733f1b-15ea-49f1-a470-89c72a715e29", "value": "1720820949b19d89c737f0028976a99306f174333faaacecee3b19a8c35a4eba5343bbce75314.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c556cd0-402c-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774340, "uuid": "3c145714-f0c3-48e7-a923-9a2104480ac9", "comment": "Malware payload (StrelaStealer)", "value": "b8f474dfc79014375c5af5b3ee5be4a3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774340, "uuid": "8088d56c-5938-40ed-b585-701789cc54b1", "comment": "Malware payload (StrelaStealer)", "value": "af96f1e7ff2da4de3ecaeeab8985007f24b2b281b6d8f8f9165791049be01324", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774340, "uuid": "a54f7406-af86-4688-98df-8728edb942a8", "comment": "Malware payload (StrelaStealer)", "value": "53cdf263820d0fa937369d2b9a8302f3f2891eb7", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774340, "uuid": "18481ead-4e3d-45f9-a0d2-19ae010bc86a", "comment": "Malware payload (StrelaStealer)", "value": "30ab6db8cab812ac1a48a9be3e98537e983e6abbacd63117b08be306126d2627bac2abbe0311bd477f8cf3f8b9453596", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774340, "uuid": "1f71066c-eabb-49e1-a519-3cd1dc5ec7fc", "value": "T1D74126F764391A86B8B4D19E7A8AF568E4D6EA32ED7FF24D427550B3CB1051C0E0C607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774340, "uuid": "7c9c8289-ec38-4672-a3e6-6eb545221781", "value": "48:5fXGxmRMAUVlV9wXu4MyGY5lvi6IhUwAY56IhUwZdsk:9ASMjVlE1TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774340, "uuid": "6c1a7527-281c-42ab-aea8-39464119b97e", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774340, "uuid": "a39ac9dd-52f1-4406-aaef-004f91491833", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774340, "uuid": "f851c460-3c9d-409b-ae7d-aa6f75705850", "value": "284835805604429055.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7f0435-4067-11ef-957f-42010a9c0016", "comment": "Malware payload (Xorist)", "timestamp": 1720799734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799734, "uuid": "f003b535-c3c8-4dcf-b5f6-bb36c31d7d71", "comment": "Malware payload (Xorist)", "value": "1af347b1b2623db94b2989c2a484f478", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ivan Permyakov", "colour": "#D71A1C", "exportable": true, "hide_tag": false }, { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false }, { "name": "Xorist vmpsoft", "colour": "#9BDCA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799734, "uuid": "1f6c7c50-acee-480f-9af5-41c99bf82abe", "comment": "Malware payload (Xorist)", "value": "b013b979c5af00f1bf252afd94595a5adfd0a88e53267d7c17c9e89d18ec4b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ivan Permyakov", "colour": "#D71A1C", "exportable": true, "hide_tag": false }, { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false }, { "name": "Xorist vmpsoft", "colour": "#9BDCA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799734, "uuid": "b6ca7739-8cc0-4ff6-95bd-49cdb0ed5bf4", "comment": "Malware payload (Xorist)", "value": "e51910554a9f8cc0af056abf449ca176389ebc4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ivan Permyakov", "colour": "#D71A1C", "exportable": true, "hide_tag": false }, { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false }, { "name": "Xorist vmpsoft", "colour": "#9BDCA7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799734, "uuid": "7f92b94b-bc08-4cb7-930c-d93b5faf8f56", "comment": "Malware payload (Xorist)", "value": "3d506192bdf16eb093b69e00bf00b4ac4ea84fc20d199be93602ea3894e08c1f1893217edb2005b315ab1474162125a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ivan Permyakov", "colour": "#D71A1C", "exportable": true, "hide_tag": false }, { "name": "Xorist", "colour": "#EB0FB2", "exportable": true, "hide_tag": false }, { "name": "Xorist vmpsoft", "colour": "#9BDCA7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799734, "uuid": "95384b04-857c-43a8-b11a-82b9300309fa", "value": "T1D4A633961C9E90F5E6C42930861BAFEB37B717B50D804C387DC1288AE5A2FB77076C56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799734, "uuid": "25f00b57-4dd4-447d-9367-ea01fa8ffd8a", "value": "af670800db98dbd67ae7bfacb5b0eaa3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799734, "uuid": "ac47263e-4f9c-479e-b9b1-c2789c6cf041", "value": "196608:1/owwGS5r7uSEjLucA1Qr+nXEU/NCevTkIFOylylEv6rcV/sH/b:2DdrSSEjLTA1Qrs1NCevwIFkaEfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720799734, "uuid": "6e29fad4-be92-4d11-9c1b-e8a6be2e3c9b", "value": 9733632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720799734, "uuid": "85cce83b-8431-46ff-8e0e-231db63afd9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799734, "uuid": "dd7fc51e-444c-443f-81cd-b746017e84d2", "value": "vmpsoft.vmp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e257fab0-409c-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720822802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822802, "uuid": "d99c303c-b7ae-42b9-b3d7-1b956c795df0", "comment": "Malware payload (Formbook)", "value": "cc8d02e1fe7f46e0ef80728a20659038", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822802, "uuid": "5b309937-4959-45ec-9552-fa904dc42f48", "comment": "Malware payload (Formbook)", "value": "b1352a6d15922a859937a191d75c7feecfd66a6b648e56382acb5174c797e190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822802, "uuid": "668e0f5f-f71f-46f6-97a6-ddb9134f7c24", "comment": "Malware payload (Formbook)", "value": "481777eb05f14b227ec2cf875c22cbd878132d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822802, "uuid": "f2ed024a-04f5-407e-ab95-2bb232f7b651", "comment": "Malware payload (Formbook)", "value": "c5d17acd5c8e069ea51e05b035fc6b3658b61de09f7dfba9850cf1abaa2453319020fef7498f1429e5fd6cdd1fd57aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822802, "uuid": "f6a7ae83-71e5-404f-bb21-66823c896d79", "value": "T1C00501087ADC1F76CABD96FEF56308D49F71A027A90ACA6A44CED4CD2C467434A07397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822802, "uuid": "4c0ff6f5-822c-44c9-b447-9e4f9796a4b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822802, "uuid": "fd5bd57b-a094-49aa-aa07-b82df3234372", "value": "12288:xF1PGOLe+JAtV+BjczGObx4Kip9xEU9eoqssgXI1DavYf:VOsl4+BjmzbiDh1qs5Y1D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720822802, "uuid": "ec5c0874-49fb-4cae-8397-ccd1d32fbc66", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720822802, "uuid": "1d50e273-48df-4521-aaa0-0cc2fbe8c578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822802, "uuid": "07c6a237-06f1-4586-a153-302bae90eb26", "value": "OrderPI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38fa1f52-409a-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720821659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821659, "uuid": "73ef82f6-227a-4bbd-98a3-2f69d6f83626", "comment": "Malware payload (Formbook)", "value": "4a7d2fd983aa91d5d3b7bec3c430a825", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821659, "uuid": "b0cf1841-cfba-4269-b120-4853ce886474", "comment": "Malware payload (Formbook)", "value": "b193b97622b50825390d67d4bc9ae41c2da72c2c7f2beeb3b9fb0666fe892ae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821659, "uuid": "0b5b8984-9748-4049-91aa-a4e6e9117a6d", "comment": "Malware payload (Formbook)", "value": "34d5c4c7e639a9cd89dc857dc2322f3a86962a3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821659, "uuid": "8301f448-7642-45be-93aa-5deb1f518078", "comment": "Malware payload (Formbook)", "value": "9eecc8e47696751e94853f79c7edfb199d6f28d788a6ec3c383d369b4ca60d7867ff5230a33da969df1d4a78a7e3a8a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821659, "uuid": "cc840760-f03f-4bde-a231-c70476ca1557", "value": "T16845BE0273D1C036FFABA2739B6AF64156BC79254123852F13981DB9BC701B2267E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821659, "uuid": "57b44b36-1b9f-41c3-8915-1997df940b58", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821659, "uuid": "da2a6c7b-3abb-42f4-b495-b4b1d87cbb82", "value": "24576:cAHnh+eWsN3skA4RV1Hom2KXMmHalp4NWTno7LjUyuDRl5:7h+ZkldoPK8YalCNWzo/CV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720821659, "uuid": "767989bd-2696-4c0a-b448-36f652047f09", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720821659, "uuid": "7c702cc2-18a6-47b3-9ccf-633e383f93e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821659, "uuid": "6ca29ca4-ae38-44bf-8fa5-e8923111fdbb", "value": "docs_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f6e67c-401f-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769073, "uuid": "bd80a1d1-a371-4b13-be05-b012d3161ba4", "comment": "Malware payload", "value": "e3beee1d53659c1ee1c7beb23b2249dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769073, "uuid": "70d3c8bc-b0c1-4581-8cec-bce7c9abbcd0", "comment": "Malware payload", "value": "b1c4b467477156b95bfadda0188ab811445f7fdcd12c3dde3a62242359c8cc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769073, "uuid": "dc56ada5-c860-4d3e-9a9e-6fe85d5b443e", "comment": "Malware payload", "value": "148d7842417ff6ac5f6d5f9c89d3c1ac8afe45ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769073, "uuid": "813be94f-5072-4198-8d9e-836297927074", "comment": "Malware payload", "value": "bbfca352c30363279517ce8288f6e540444a8ca3be1ebd4eac595145fc67d44751c0cd2923406a6ae78f7e2ec21b3adc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769073, "uuid": "d7da7215-1165-46ef-b9fe-ff1e6d98f164", "value": "T160C2532D965D436BD194D134C98D8E1BFD743113E226AF8F12CB8B9A0E261827D9CF6C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769073, "uuid": "98c53ba8-0591-4d7c-ac75-dea8fa22434a", "value": "6fb28f224a2dc71ed82d0b2fd4effcba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769073, "uuid": "a28f7935-1011-4307-be88-085f6992aefa", "value": "768:FUPAk3/hZKUUYiDU6qc2FWfpsWrpY0qnMm:rpbqciopsWdYNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769073, "uuid": "bde68c17-76e7-4210-98e8-c9a14d58922d", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769073, "uuid": "46330417-3ba9-443e-97fd-a0468e92cef6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769073, "uuid": "d3c2cd0c-e124-4b33-94ca-d652f7d1e686", "value": "SecuriteInfo.com.Trojan.GenericKD.72194289.451.16105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df7d498-4068-11ef-957f-42010a9c0016", "comment": "Malware payload (Gafgyt)", "timestamp": 1720800354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800354, "uuid": "2bf07c43-9539-4d73-8177-59faaee83f51", "comment": "Malware payload (Gafgyt)", "value": "e444ff3dbabc6c9ada4b25ff27392831", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800354, "uuid": "5a43337e-fac7-4983-bf67-0ef391b22b4e", "comment": "Malware payload (Gafgyt)", "value": "b33fa8ea826ead4d17150ec493bae7f4c2f89c30fc16840addc5f225cb05a5d4", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800354, "uuid": "dfb4f1a0-ad31-449c-a888-a1359c7ab032", "comment": "Malware payload (Gafgyt)", "value": "cd8ec0c32e45c6b7551750c6c8c026b96e0b6e5b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800354, "uuid": "9d0d53b1-71e8-43f1-b3bf-2d9a7c1d546c", "comment": "Malware payload (Gafgyt)", "value": "bd7ba021920b9818e5f7af6cdd8cf00ff46649dff0f8b014c9432e6e0ca59f5eba499d15ac9a86dae4e84bea3307e05a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800354, "uuid": "6ab63cdc-6505-4b9a-93ff-ad44a5be6109", "value": "T15EE33B09F6408B53C0D32776B68F530537239BA5A3DB330A9924AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800354, "uuid": "eb9c3ed2-a022-4a88-967d-1c18de1c8e92", "value": "3072:tdntU2haO5H1XacBoGmh9H5U5hDiGWWmV7f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hi5hDiGWWmV7l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800354, "uuid": "21073b5b-554f-4369-b014-4357f1f713a2", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800354, "uuid": "8fc6f60f-6f9d-46e6-98be-bf06d7ef0672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800354, "uuid": "7bc5a639-b985-471c-a61e-6c5e1a7905db", "value": "fuckjewishpeople.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58247fe9-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720790788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790788, "uuid": "de9d64b6-6a26-4a81-8434-a9fd56839790", "comment": "Malware payload", "value": "0b4a6c1635eccfe1e2d14fcb1ac1dc5d", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790788, "uuid": "f6153228-1217-477e-a37d-b1edbd2acc04", "comment": "Malware payload", "value": "b3d768ea03a96e24f685e30258501131bd9685a894c49ccb3918b4f38f0733e6", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790788, "uuid": "c98400c2-387d-4a83-a35a-0fa62303a1f7", "comment": "Malware payload", "value": "3e177874c60f2966e818a184aefb193734a4176d", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790788, "uuid": "d7239435-1529-438a-ac7d-59745a32d615", "comment": "Malware payload", "value": "1077fe3b213d8000057e64c5a37d3613741173fdf74bf6e6ac5e45640ea86bb7892fa1030283d775a9903fd15d13e94d", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790788, "uuid": "159562bb-8072-4b5b-9fe1-ee13449b3d6a", "value": "T1E4C73361F05A5456E10AD1B4908E476423C6C9EC54374641BE3CEF2A6BEB283CE77AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790788, "uuid": "1768b2f9-0ee0-447d-a8ec-5c0366481424", "value": "1572864:9NjhU4+5iKQAQYjwtnZ/MgogCjrHmsP8gM7gaSINw:904+oKQAQYjwtnZ/MgyPmuViU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790788, "uuid": "2dd0ca8d-9c92-4a30-b5a3-ea3f350885b5", "value": 53563340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790788, "uuid": "b9f5d00e-eeb1-42da-80a8-fcbccd799765", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790788, "uuid": "5ba959fc-5014-401e-bd23-734f419eff66", "value": "45.9.74.32 Strela DLLs 2.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37992333-403e-11ef-957f-42010a9c0016", "comment": "Malware payload (LummaStealer)", "timestamp": 1720782143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720782143, "uuid": "743c0010-8143-428a-8d9e-0a358f11bf9f", "comment": "Malware payload (LummaStealer)", "value": "1d99224bfd51d67634f3af5bfa6ee6a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720782143, "uuid": "831f3f1d-b266-4e21-a762-0dee9151f9a1", "comment": "Malware payload (LummaStealer)", "value": "b5506154118a2e8b5ad65ea8c26b37f0e1ffe683472cfcd98f48e8d5723a5ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720782143, "uuid": "c8583e70-98ab-442b-b953-5471e78dda01", "comment": "Malware payload (LummaStealer)", "value": "430f022cbbd60d6b5be75e8bd89891270e03966f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720782143, "uuid": "26735861-607c-4eb4-b974-e4702b85cc40", "comment": "Malware payload (LummaStealer)", "value": "181d5f99661fe24498eeedcee4c8e6115299e616fe7fe3ae17908251a21c297501e5998f9e073cc1a14d7eb447ac8bbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720782143, "uuid": "aa0c76bc-39d0-4180-8f05-8a97e4631552", "value": "T1B9546B0AD77751B1DC87447A32FA733F9A342F0382288EE7DBA4DB9465133A2617AD05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720782143, "uuid": "3e8664c8-cfd9-4d2b-ad15-74f4868145bd", "value": "93d38faa538d34592b2dd571bcadf806", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720782143, "uuid": "fe6307e8-90d2-4e14-8f56-89b701f66e82", "value": "6144:9qrRttG7XoL9E5NMOIe2ZMF9rX5Yh+hLbcLre:IXCECNMY2Z82+hLqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720782143, "uuid": "2b5e823b-3d97-41b5-9ade-ef13cba69a2b", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720782143, "uuid": "04ee0b71-844c-4361-9ce6-11b7832946c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720782143, "uuid": "69437e97-bbe2-478f-abff-0ed6473adc29", "value": "1850a11acaede15b70cf7fc93830cd13ed4855f5e6226ef8110427fab9651ddf_dump.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b09fa6-3fff-11ef-957f-42010a9c0016", "comment": "Malware payload (Loki)", "timestamp": 1720755166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755166, "uuid": "ec38ba19-4baf-48e0-8268-cb99e49642cb", "comment": "Malware payload (Loki)", "value": "b24af86265030c8eef122b4c1ecd3872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755166, "uuid": "1f7722c2-43be-4597-ba54-0fda451d914d", "comment": "Malware payload (Loki)", "value": "b6a40b8140bb8ebbf10c47b649052c765a55c3620246973e97ab937f6361bba8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755166, "uuid": "66eec84b-f14f-4aa3-96cd-1fbbc8ec07fb", "comment": "Malware payload (Loki)", "value": "9d938c83cecf29582c57c43a40406f577d78e88a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720755166, "uuid": "51501528-6d17-48ce-aca4-317394b8777a", "comment": "Malware payload (Loki)", "value": "ea6851ac49d756fc39e9535e7f69585d9f28a1710e2f20ef0a80623e0dcda617296cc688ea63b04498c92094c9c621d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755166, "uuid": "0ef8867d-f136-4fd1-b10f-17e52692ff41", "value": "T15ED4F10263ECD344FABA51BFF8AD44986F70A82759C6C3B9728D56C91C62B83450B377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755166, "uuid": "57f902e4-c5ad-4715-9020-85aeae8ade84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755166, "uuid": "eb622483-90e3-423d-b963-248f65e7f651", "value": "12288:TVh0xC0sCe+1GOZzDzd8wGUXd7x0bbU7zODAKD:ZhEC4xoOZzDzd8whx0UzOcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720755166, "uuid": "c8bda3fe-2f96-4fe6-884b-254025322184", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720755166, "uuid": "8d854894-b9d0-41f2-b574-54a41c6f55fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720755166, "uuid": "edf19166-2754-4aec-806b-7af065643dd2", "value": "c76qotShuobGjnp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc1c416-4022-11ef-957f-42010a9c0016", "comment": "Malware payload (RedLineStealer)", "timestamp": 1720770312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770312, "uuid": "6c6bc729-29a1-463a-9d35-22cc7171fcdf", "comment": "Malware payload (RedLineStealer)", "value": "965690b2881041a12b0b63d8d68be854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770312, "uuid": "e72bd2aa-dc68-409c-b459-7a9f0d3dd435", "comment": "Malware payload (RedLineStealer)", "value": "b7585402d354395dd4cb9031486b62c65856189cdf27ebf5e0a9a3685970f187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770312, "uuid": "9d477fef-144b-4e28-aa3d-a55b550c2b32", "comment": "Malware payload (RedLineStealer)", "value": "86ab14ecf043d8efd1133a89623c6ea808e710a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770312, "uuid": "15e86218-7a6b-4aaa-9976-bcbc887d0815", "comment": "Malware payload (RedLineStealer)", "value": "b6c7c17ecaa076260fb64e33724ca3b2d4573ceb82ae71f9603b9848d32a670a8dd3642a2ae08483a09676fddfbdc0da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770312, "uuid": "ed62f815-4554-4043-8f2e-12496000f686", "value": "T14EA52205752B5E2BFDD69178C9D231F06AFC8D4B74F3862FCF21AE99999067C0462231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770312, "uuid": "4e373e49-c2a8-4465-9c4f-67b0198ac200", "value": "12288:pJZ0sqcLkZ45tofQaRqlbnw3P3U5rV5vMPxY5ByvyOIGsm+qt1ahWQ9HeZZY:prXqt4/2qVw3P3Ar7vMPurWSqtUh/9QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770312, "uuid": "c400bcaa-467a-4b18-8b1e-ca9b71aeeeeb", "value": 2237025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770312, "uuid": "19c9db0e-4367-4f32-a8a5-6a7d315cc00e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770312, "uuid": "dca0e7a4-ec59-4879-bd3b-b9110c149f7f", "value": "inquiry for AP-103- FM-2400 project.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32cdf39-4073-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720805141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805141, "uuid": "edd25c7b-3bd0-4c85-822e-0ff613d7ed58", "comment": "Malware payload", "value": "a23a21b1823fb87ab05e49693a6df08d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805141, "uuid": "939630ba-a9e2-4fd7-9af8-d60a3f857ecf", "comment": "Malware payload", "value": "b7b40e80d14b0655535785997e5694ffb71aa60fc209e8ccef46351c3b20ddcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805141, "uuid": "52a1da88-e57a-461f-b0a0-0a702b7a6c79", "comment": "Malware payload", "value": "0c655019e7190814a3e518e49f9a8f1089566076", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805141, "uuid": "aa979f03-4396-47e1-a1fe-6257dd774444", "comment": "Malware payload", "value": "ffa82b353a0e498ab82f24053a1657cece9b4ff301128b8a13bfedf0a2e2c2cc07e5a2669f6bc374dfe15fc9c0c20394", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805141, "uuid": "22a46e3a-f0da-40dc-a28b-9fde659e5cb3", "value": "T1C8A6335C3BC8231AC3D8D1BE334754DC9CA5066AD513F4889E4DF6A98728BF276423B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805141, "uuid": "28f1ff43-c57d-4cd1-bc52-83eb3621605b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805141, "uuid": "d1953609-873d-46a7-8419-5ad94edadb04", "value": "196608:M083gwvavFxaMpeCUf8JdE++nB758MQCR27E3FZioP4Qc3j:M330FUMWf8JdE++nJ58MQCR27FoP4Qc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720805141, "uuid": "ad2fb6a3-b6e0-409e-95ea-0ee6b4d0d7ff", "value": 9614848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720805141, "uuid": "f633f493-59c6-4ddb-a6a0-9db17b47c394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805141, "uuid": "ab61efad-22a9-443c-9774-383414f17eaf", "value": "SecuriteInfo.com.Win32.RATX-gen.28387.25625", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e3b5ed-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789334, "uuid": "03db92a5-1abc-4cbd-bca0-5d7d70b58539", "comment": "Malware payload (Mirai)", "value": "0237893081ff16849dbf9d4118563855", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789334, "uuid": "ee864493-f4c6-4033-a1b1-ad31ef5940a6", "comment": "Malware payload (Mirai)", "value": "b8a151997632334d7bca5e76bf7a3b16b59def44a6926f987e9e2d33e90bbe2e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789334, "uuid": "c9616e9a-7c2b-4e77-b26d-c06ba0d43faf", "comment": "Malware payload (Mirai)", "value": "fca5dd5312cce0feb91bd8e95053abededb0f28d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789334, "uuid": "138cc86a-99ab-4d4f-a865-f1a314fa1c9b", "comment": "Malware payload (Mirai)", "value": "f62c533ad63b8a5af9661ef19c6c6121820f8cbe6c1dfe3b14d405b1937f378f182866bd7ca898bad2a79bc4dcbe9db6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789334, "uuid": "527c1cf1-04fe-4419-8f37-4b430243650d", "value": "T12E735DC6F402DD7DF84AE67B4C164D1CB631B2900A930F265B67FE97AD71258291BCC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789334, "uuid": "6b75e1cb-b60c-46e9-a6e3-b6014ae343f3", "value": "1536:M3f2UMrO67YYBnHZ8LgzLQeuacWjcW0JcWcBKPZfwAgX1PYQ9x:Yfv2O673BHLQeuacWjcW0JcWcBcZfwAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789334, "uuid": "0275eaf3-f77a-4141-8ff3-e7b2ad137312", "value": 75176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789334, "uuid": "15718813-4bf4-48c1-b8ff-c906c0ca4765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789334, "uuid": "084a963c-60ab-4897-951c-3631a7765250", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6830cb7f-4055-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720792103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792103, "uuid": "bd6c7946-abdb-4a3b-906c-d7300f37576c", "comment": "Malware payload", "value": "9ef88513c03fe6f865123205ccc83097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792103, "uuid": "2b50caf4-416f-4928-a29b-2c2ce0abbbff", "comment": "Malware payload", "value": "b92c4f3b24c0772241f5ec985be12c3070858c0922155ff6d2c88410a593a5b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792103, "uuid": "e8432b7e-da72-44f0-addc-a3faf2f13825", "comment": "Malware payload", "value": "be1d9d7f4aa6f4fe7bc111a72edcf972f8a6360f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792103, "uuid": "46ccc7dd-d0bb-43db-9526-c8ebaf38b41a", "comment": "Malware payload", "value": "b7494c6276deb2c8ce4cac265aa2feee68f9438073d706d2433bab2a8c89f7793b01bdcb24f67c156204e8c9b11a726a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792103, "uuid": "6a311fdb-c6d9-4893-80d6-fb42b5e0fcb8", "value": "T13BC493C6E6ED45F1E475C03C4871E12ABAF57C9E0B2097C7229CF60A0E72BE56979720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792103, "uuid": "a889a6c8-5336-4856-9ce2-a36e14875d10", "value": "579eedde336129a7589279b2113961c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792103, "uuid": "0a6def68-8002-47b6-877e-bdfb805f241f", "value": "6144:utPGgri0txv5z42AkBejR64TjyY/9HVgoh6OGZbez:ir3txZ42vGR64TjROooOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720792103, "uuid": "618225e3-659a-4aa2-b9a5-e81bcf267f38", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720792103, "uuid": "2c26c5a2-e441-4671-85f9-46a4b52392a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792103, "uuid": "097fb8ad-f299-4cb4-9c44-42222d5498df", "value": "\u7533\u9886\u4fe1\u606f\u586b\u62a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23ef649-4066-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720799502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799502, "uuid": "9554bed7-848c-4df5-8fe7-be52d35e910f", "comment": "Malware payload", "value": "b29695130dcaf6b051536b867d0690f2", "object_relation": "md5", "Tag": [ { "name": "askq", "colour": "#49971D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ransomware vmpsoft", "colour": "#D0ADD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799502, "uuid": "d0d234f5-f1ee-4092-8f58-632bbf3cef5d", "comment": "Malware payload", "value": "b96e337d6eae6158b7f3f04df84deba4dae1a603caa69d9ed161f8185724fff8", "object_relation": "sha256", "Tag": [ { "name": "askq", "colour": "#49971D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ransomware vmpsoft", "colour": "#D0ADD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799502, "uuid": "5f0e7b36-0bae-4b37-9ceb-41b09a1b67b9", "comment": "Malware payload", "value": "1bb320c27322d42629e0cfc447aeaaf76ae4ecc7", "object_relation": "sha1", "Tag": [ { "name": "askq", "colour": "#49971D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ransomware vmpsoft", "colour": "#D0ADD4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720799502, "uuid": "df6dfe30-431c-4f03-8295-1f83e3e4dcb4", "comment": "Malware payload", "value": "18cfc10cf0334ac023ccf26e5a5e766b342b41879655c314b6447951efafbe3315acc9f867c9c54f7d05b03519fe44e4", "object_relation": "sha3-384", "Tag": [ { "name": "askq", "colour": "#49971D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ransomware vmpsoft", "colour": "#D0ADD4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799502, "uuid": "3d612900-c7f1-43a9-bbc0-45d496e557f1", "value": "T171E44B343AFE9019F2B3EF769AD474D7DAAFB7233606955E205003874613A81DE8163E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799502, "uuid": "9278e7e5-475a-47bb-948b-32e12ce2b903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799502, "uuid": "d4a27ad2-d018-4d9b-8f40-22be332b4f3c", "value": "12288:UqLdd12KMDfXSlR7OBzLQnSvUWgNAQIdFfr5drkKl3MO2pUu90wDyV4xYAtz6N:UqLLYfSltOB//U0Pr5drkp+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720799502, "uuid": "f6474d68-3302-41d7-bd22-d3f5b893c095", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720799502, "uuid": "82e834b0-12f9-40b1-a64d-30175c981a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720799502, "uuid": "08945aeb-dd7c-4777-8fe9-21ab4d47175c", "value": "vmpsoft.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a9d875-404d-11ef-957f-42010a9c0016", "comment": "Malware payload (Amadey)", "timestamp": 1720788876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788876, "uuid": "1fb3d04c-d4d2-4af8-95d0-b07913afe113", "comment": "Malware payload (Amadey)", "value": "8cdbb4f2b779e6d1d1c31144a31deca6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788876, "uuid": "3eb69e11-4203-4916-a44b-66a9380c977c", "comment": "Malware payload (Amadey)", "value": "bb25aeb8d3150e94b5ace83bc5d2550776d71dff9c78898951faab7a1af751e8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788876, "uuid": "c3e679b4-2ace-4a43-a9cc-118841d4fb97", "comment": "Malware payload (Amadey)", "value": "48f9262ed6283c824e52a49f1981318fa7f712ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788876, "uuid": "b560aaa5-7cb9-4082-b5eb-a4e2944faf3d", "comment": "Malware payload (Amadey)", "value": "4e82430ffa6eea0fde460e4aeeaae44f45466ee6df3fcd87ad060641eb9f2a2151a0461fe880bace03851ce351819112", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788876, "uuid": "6cd95531-a959-4b0e-839c-ec1e0f787515", "value": "T1E19533931452F4ADD63D03703BE49DA53BB6E79EB2585A8F2D064A22733679C307E80D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788876, "uuid": "a6c0c1d3-75ef-4cbd-ac6a-11609e806cff", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788876, "uuid": "b8f4fb35-2d55-4673-aba7-0c21f896972f", "value": "49152:4VjQ5fRdyuULwLakuM6WAKx+1G18+ZpE0/eQM+7PTId9J:UjufR4uULsPVvxjy+ZnQ+L+9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720788876, "uuid": "89bcdc4b-0c56-4181-b6b6-53504e07a396", "value": 1921536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720788876, "uuid": "ec7c1596-0fad-4d11-b180-92e6da0a9b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788876, "uuid": "be5f4857-29c3-4f50-9a41-56e1682df3f9", "value": "amadka.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36909900-4052-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720790731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790731, "uuid": "90e64b30-f983-4a34-a3ef-ea8b7f590ddc", "comment": "Malware payload (StrelaStealer)", "value": "c8d0f61e97e865ad398fbf1f99eec674", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790731, "uuid": "9430f1c6-79e1-4191-bd13-10e5fdf14700", "comment": "Malware payload (StrelaStealer)", "value": "bfe7803857dcf6a2b8eef074d0205dd365e9bdab322fc4c5ffdefe7d81b999a9", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790731, "uuid": "d2716191-64cd-4b4b-80b4-9e177f93362a", "comment": "Malware payload (StrelaStealer)", "value": "9084569f22fe967a9743acebaf5a5ba5aad538f1", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720790731, "uuid": "282e69ac-9ec6-4706-996d-91a0ef866e91", "comment": "Malware payload (StrelaStealer)", "value": "cafe5c9d34f21594a56c7208df68c1eeeb9c937b5733c1fded05a9f6b3ff79b1727c3d337112d366d964d051659ed27b", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790731, "uuid": "b1d3df7b-9490-4057-8109-34f9c531e911", "value": "T1DB973311E05A848BD909DAB2D04E475C11A9C5DC037343A16E2DEE7DA7EB2C24E77AF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790731, "uuid": "402c5a5b-c273-4c44-b29a-874e69577c09", "value": "786432:0g2cvnu39mvIJRhw9oeE2Q95Vz/rxIvDUFfvuVMcP7x82r1cVi6f3eoezWzqG6l+:FzqEIJR+or22kvDc2yczx8McffXeiqGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720790731, "uuid": "1156384f-bef5-48ca-97d6-e2d164980b32", "value": 40936635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720790731, "uuid": "d5bdd5e3-1df3-4cad-af5c-66ba5e4276ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720790731, "uuid": "5f142462-fb09-4ede-b196-9b2e4822f79e", "value": "45.9.74.32 Strela DLLs 10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47c2a360-4055-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720792049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792049, "uuid": "13207e43-268a-490d-af35-094d977314c3", "comment": "Malware payload", "value": "469dfea6446a8bb5fada116bd28483d7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792049, "uuid": "c1d66e7c-1290-4206-8c78-e98cbe218b04", "comment": "Malware payload", "value": "c0855b309d0032c4551ec622713624247412befc1b9f60af2317757004fc737f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792049, "uuid": "f1e85569-1c90-4d14-a174-d0dcef4a1642", "comment": "Malware payload", "value": "6c0079493a3aa2ad5bcfbf4284a3ab741cca9a0f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720792049, "uuid": "e791ac8c-f347-4cba-b928-59d51b2600f0", "comment": "Malware payload", "value": "552307f6c11a86f0ca2d192124769bfaf2f3f1fe0e33c68f6cabc4776c2a12e13a6fc80edd47db80f0c86c898a4a3f80", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792049, "uuid": "c95aa09e-bfaf-442a-a7d4-e4e0f58d9280", "value": "T1D9269D52F7415A32C8FEA33559B5872077769C4A87C39B432808B6B87C7B6D07B85BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792049, "uuid": "2be65eb3-525d-4632-8550-5ccc128b7eea", "value": "49152:CAzKrSoPpsZx1j/6okEijVCbw/zfr2FO/v21R5dOICIUjCrq7fsapzggszG8ICHX:CAu4b6oWjDzfr2FUW5cAhrSk2zCC8IYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720792049, "uuid": "deef1909-4a5f-4f3c-a993-15b7906241de", "value": 4852725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720792049, "uuid": "02912fe6-defe-4aed-92bc-489e9495bfde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720792049, "uuid": "6f2c6765-072b-4ab4-bf35-d71efaaf6d01", "value": "c0855b309d0032c4551ec622713624247412befc1b9f60af2317757004fc737f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a18a502b-4060-11ef-957f-42010a9c0016", "comment": "Malware payload (Stealc)", "timestamp": 1720796924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796924, "uuid": "8ad96db3-06b8-45b0-a20a-73f2f44ff754", "comment": "Malware payload (Stealc)", "value": "be934ec22037ff0e960f7aac46914ba5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796924, "uuid": "826ed251-e8f6-49d6-b074-24edd65b4640", "comment": "Malware payload (Stealc)", "value": "c19e844a529bb52d59a243340243e2208ad23ca059aa6b095f555f415d22f687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796924, "uuid": "bc5b24cf-abcc-4ce3-96ea-ac2e288134da", "comment": "Malware payload (Stealc)", "value": "c83d95fbdb2610bfdae718c485e5ee339c940905", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796924, "uuid": "dd568b03-f140-4418-bb52-0144ef808d19", "comment": "Malware payload (Stealc)", "value": "05afaf68c86a1e33cab00c350a0f10d006f5acc2c2a676bd657ca4931713bdcff124b52e1e5974fc37303f4b440632ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796924, "uuid": "f74ddd04-2e8d-472f-994c-03f14cb43992", "value": "T162B53368E4AB12C4E6F081715BC8F9E556B81BCA611E3BE5133D7721F0283E909D5FCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796924, "uuid": "e6427d35-91ac-4a87-bc5f-70a7e1de195b", "value": "001806c33a6e9fe5fbff34bdbd79b591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796924, "uuid": "e5cf166d-f7cf-473d-8dc2-46a6142ccdda", "value": "49152:YlFyP1lG+KRGsl1z5dkQ7N0MqdODEZ22buRhIwh4h:YlQcGsbk60M2ODEs2buSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720796924, "uuid": "145c5fec-4c02-41d3-9a8f-fad88c430ab1", "value": 2465792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720796924, "uuid": "475ca12a-6b23-4332-b8c2-efa437ba6cf8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796924, "uuid": "f2af425c-a09f-4eb9-a9e4-a0cfa2e2ddf9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9529db08-4058-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720793467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793467, "uuid": "ba2f5133-ba86-491f-96e4-c7826a456df9", "comment": "Malware payload", "value": "aca885ce18f6b6cd19d04f79e606bf8e", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793467, "uuid": "730999b5-005d-4d8d-80bc-4857c14947f8", "comment": "Malware payload", "value": "c2e492da957ef5c76b3cc8890007c4f419ec510b5f9f259c2a0161c032ebc987", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793467, "uuid": "d3e1b9c7-1ce1-4326-a4c6-e0dacbf37766", "comment": "Malware payload", "value": "d5790536c534cbaf83a02d802afe2b1f233baab4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793467, "uuid": "a59c6b28-a1fa-4ef9-b7e5-eed7a00d60b6", "comment": "Malware payload", "value": "13f23674c47748b6c77db5db4b79194e6524dc470195a36e20a573ab43e96010c9489b343c76edc268ecb2a5902f9ce0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "Bitter", "colour": "#E509A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793467, "uuid": "1cd88f84-e64e-4a5d-a97c-86b56ff3f7eb", "value": "T162133B50572D4B33C7AE05FCE8E5511753B182EBBB12EB865EC8B1DA231BBD00160AE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793467, "uuid": "cf1f2931-8e95-4d39-9bf2-daeffc43197f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793467, "uuid": "aee45ce2-c228-4200-b651-f6b8fdec3794", "value": "768:/+H9FklRwvMZFx9m/c1VsQuhQGrQ+7GFJ+8liiYLxIS/cW:/Qe9p7uhzDGf+8liiYLxqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720793467, "uuid": "fb6a11fc-d106-4778-95b0-d83a49b4025e", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720793467, "uuid": "736a36e4-00eb-47de-bf2e-ee58330ea4b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793467, "uuid": "798235ed-bfa2-415a-9d47-f1f29cf2d359", "value": "convrs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed463d0c-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789320, "uuid": "35a3af0e-cf32-4817-8c26-658043256c54", "comment": "Malware payload (Mirai)", "value": "660bb51ebb9b018870f465cede468f0d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789320, "uuid": "680e884d-a6ab-4988-a4fe-603980e7b537", "comment": "Malware payload (Mirai)", "value": "c34a3a35baf1ac198ddc1b3dadb9848f47ba33eabc52f35bacf5b5c42eaa05ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789320, "uuid": "0ee22102-ab03-4ac0-b9cb-6968789f8120", "comment": "Malware payload (Mirai)", "value": "dda86fe6c34bfcf3a51195cefe7aa24a4127151f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789320, "uuid": "b2372cd6-f2da-41bb-8906-debe90d65982", "comment": "Malware payload (Mirai)", "value": "100c1e0b84ae9d5146eefbb73e53f15f6465d45777be1612c126b6e713c3d9800a32cfc5b701e9eb004c8714d9f77d50", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789320, "uuid": "c5b4513c-13d7-4520-ae00-e56341b54fa1", "value": "T1EAE35C46FA818B13C4D517BABAAF01493332A79493DB730689285FB43FC6B5F0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789320, "uuid": "41f016ed-9dc7-4776-bd81-75e2c1082ffe", "value": "3072:iQHlfs+lezFwa6JiBUdKwH5m3m7phtcDfX1iFxVWj3We:iQFfsuen6KwH5m3mdhYX1iFxVGWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789320, "uuid": "fb30f245-6846-497e-b681-d1d6d86c5d4e", "value": 153787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789320, "uuid": "7274f97d-8c52-4852-82f8-0928926bee37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789320, "uuid": "e54f920d-cd4e-46ab-8448-1789839602cb", "value": "jade.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014f3511-405a-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720794078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794078, "uuid": "fa9dd12d-1530-4408-9db7-77e5900b10a2", "comment": "Malware payload (Formbook)", "value": "8a380b585835b98c5b44204c7511c663", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794078, "uuid": "6ad2948e-4ec4-4f81-8e59-a460ed582337", "comment": "Malware payload (Formbook)", "value": "c4e016f81ae94b30829cde12b6f2e5491b389042dffbe1d4f2568b53b08ac338", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794078, "uuid": "cbab6ece-802a-4293-8fc0-4211b6a23e9b", "comment": "Malware payload (Formbook)", "value": "c0239e54dde27b616190dac68575ca49bf29cdea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794078, "uuid": "388dc21d-15db-4d67-8b44-ecb4b50b7647", "comment": "Malware payload (Formbook)", "value": "00c8eb74baaf3abc1f5bf8c5bd106a54ddb81320991a875f1d0e2c300b73bd8d7cc2a8d0fd2e0b7d2bdad86bfb867e2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794078, "uuid": "8018458b-d315-4e82-b177-13bc0979453c", "value": "T1B7D59E91BA478C87FC1212B1C8DAB9F010FD5D5B70F4520FEF667E1266B227E106693A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794078, "uuid": "04df114f-862f-4130-a751-11632a28cd08", "value": "24576:bEziwomHqtmR3rl9h2R/Om/VYLHR3SdIP:1mKERJ9hWxKTP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720794078, "uuid": "8ae61d76-a29a-4651-b5ec-46c4ca80c358", "value": 2851397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720794078, "uuid": "9f4ecb08-a8fa-44fe-bea5-f5ce0ec8cd8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794078, "uuid": "a900bfc7-2b57-4c1c-af35-574ca8a096bd", "value": "z46Ordendecompraurgente___s__x__l__x___.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379248bc-408b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720815214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815214, "uuid": "23142ee8-84b1-48f7-bf4f-0f0a3807d90f", "comment": "Malware payload", "value": "e76ca5eabff809d8274752c8d07e4cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815214, "uuid": "2013c2af-a86e-4bff-9ef1-6a1bfeb540d0", "comment": "Malware payload", "value": "c5034694257f3a5be556cbd4b3ca71d55896592658f0a87dd146360fff44736b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815214, "uuid": "4103b897-b214-40b4-9b89-3d3f27e662c2", "comment": "Malware payload", "value": "598368ab30d59abfb905c19225175c7880c134f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720815214, "uuid": "d214a57c-9483-4c16-8f5c-3002be9158cd", "comment": "Malware payload", "value": "d8db4ed3945e379e25e2e3775e199603acf07c754e2c8931b2cdc2f6758b4f2a8d9d739d48353cf2b290d9fd28b8e28d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815214, "uuid": "9441fa7f-a337-42c6-a52b-04a6e3448893", "value": "T16DF18D42EF3F09FAD76E3AB742FF84C00B0818016B3B8B443DB9221708D4538021D22E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815214, "uuid": "2fe956c9-220c-4576-b993-5391e0fe3edf", "value": "223085e800c147c92544147933e9d7e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815214, "uuid": "04ff44c8-2bd5-4ab1-a1cc-79270ca23b7b", "value": "96:2HEm4EwgFByP61YFv8XVbRvH1WnRC43l7UZO4W1R7F+GREZBs88XQJyf2HEcrrE:2kmbRTjXdWRX32Z9W1R7F+GiC6z/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720815214, "uuid": "9bb01f2f-fa93-467d-84b5-70435bc02c6d", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720815214, "uuid": "9faf8f1c-621b-4bd1-a0b4-c504e7488250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720815214, "uuid": "57c17e63-e009-4c2d-97a3-66e37dc9d345", "value": "ptiza.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a97776-4018-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720766141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766141, "uuid": "5b594e27-ab68-4c43-b02b-3a5403d6ed88", "comment": "Malware payload", "value": "d72f202c1d684c9a19f075290a60920f", "object_relation": "md5", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766141, "uuid": "3f924969-7fa0-40b5-a26e-2f2e0e951dec", "comment": "Malware payload", "value": "c6a3a1ea84251aed908702a1f2a565496d583239c5f467f5dcd0cfc5bfb1a6db", "object_relation": "sha256", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766141, "uuid": "fa33a77e-472e-4648-bd73-039bdc0b114c", "comment": "Malware payload", "value": "2cc76a0434a1d489c1547c7021a3dd68499141c3", "object_relation": "sha1", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720766141, "uuid": "02048216-30ff-4778-8393-c2ad848c19ba", "comment": "Malware payload", "value": "79f5a1f2692146342dcd587f4b435114bbc64b8d6d155b304c6a38e0fc4a1ac85b66d4fda6f3fce05c3e2ef6cab7348a", "object_relation": "sha3-384", "Tag": [ { "name": "APT41", "colour": "#BCAF0B", "exportable": true, "hide_tag": false }, { "name": "DodgeBox", "colour": "#3A7D92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766141, "uuid": "26d411aa-c1ee-4636-9d5f-557a15469126", "value": "T11B047C2AB3A140B9EDBB8234CD935A05F77238054734AEAF03944775EF2B390953EB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766141, "uuid": "836f83e2-78e1-4ebe-ab93-d051b35594ab", "value": "aeea1135af87e6b6b23fa7da995967ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766141, "uuid": "138bae15-2931-4e6c-9c9a-efcdaf29f3dd", "value": "3072:lRslWZi6MQZzw2yuGj26PI1ugixnkisONPAz2Fum5lSEbW1R6OXhQ:lalWZivx2u01upxnkLQPAiFumrSE8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720766141, "uuid": "8eda7eea-b7c3-4fdc-aa46-542981d35777", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720766141, "uuid": "54c4f1c5-e9d9-408c-9d98-406d5a626688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720766141, "uuid": "7daff5a0-a322-419b-8e6b-474fb4352d05", "value": "c6a3a1ea84251aed908702a1f2a565496d583239c5f467f5dcd0cfc5bfb1a6db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae5a202-4095-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720819622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819622, "uuid": "12fde7a0-3b65-4b39-8292-0d10864cd9af", "comment": "Malware payload", "value": "82abad6c7bbe3fd34944fcfb9312f9fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819622, "uuid": "be1c974f-f767-48dc-b97b-b78745051ca0", "comment": "Malware payload", "value": "c8180ea3e9b2c7d95239450d888dbbc19226bc580662d9ec60fed58de76b2949", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819622, "uuid": "97967972-8f9b-40a2-a23e-5225a56f7c21", "comment": "Malware payload", "value": "398fcc340e68214aaf64e1c852c84c632861b2e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819622, "uuid": "55f45921-1f84-4296-9815-54883ea4f33e", "comment": "Malware payload", "value": "b8fff15240e21ef90c477181419f53c24bf092446a1d22b5bab460df3811a22e0a544e28dc0f05df4e38337edfa1b048", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819622, "uuid": "e71ba4c7-c82c-42d2-ac4c-965477988faf", "value": "T165C633DB4B777D72D415A7BAAAD23C0EA3A5D36E27C74504CC0B84E354A53CF8762A80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819622, "uuid": "060f7d81-4c23-44b8-8d1c-dff168eb0955", "value": "a68b38a9ec17f4875321eb5727ec2ed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819622, "uuid": "3842ec1b-7faf-4d3d-8b90-c75b60da6d34", "value": "196608:h6ughw3r+bpE1dZq9tRPWJz7n11xzbH6hqGE+TQh+yN8NOpyr3KZ50eOXWoUuKcx:h6C3r+OEYZ7n1bElTkzBQuH0eOXN8Q60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720819622, "uuid": "6c925343-9840-4478-813f-f336e7bd8531", "value": 12112912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720819622, "uuid": "ac36294e-2cb7-46a5-8fba-9a03991ddb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819622, "uuid": "4207c112-70a5-4b49-bb30-1b8f340e0644", "value": "SecuriteInfo.com.Win64.HacktoolX-gen.11863.1266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9132b40c-4098-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720820948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820948, "uuid": "afb52d9e-7422-4dc9-9eca-6c8c1d8142a0", "comment": "Malware payload (RemcosRAT)", "value": "fb827555c8ef70538f5a02fd7d970fef", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820948, "uuid": "1964927b-a173-4d21-b6ee-84d42e9c2d80", "comment": "Malware payload (RemcosRAT)", "value": "c9197ccebccea890b5dd438e3bd1a735038d697ddb8d94bb262e6568a0e6ef40", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820948, "uuid": "dd6e955a-a5cd-4943-ab21-ee1308352f24", "comment": "Malware payload (RemcosRAT)", "value": "2b208bd4d060a487afd936b4fe2d76213317f9c4", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820948, "uuid": "b8644bb3-d4b3-43f5-be78-04996000429b", "comment": "Malware payload (RemcosRAT)", "value": "43e16490a6d0f51184b2bc7fba284570e5c27c915d7a9df9fd499cab9546b6f8c8f19f583a187747960e70665703683f", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820948, "uuid": "a3ab10ab-3725-4dd3-be73-f13dcd94469c", "value": "T161B48D11AA91C031E8F71E300E2AEE72FEBABC5015214C6B77DD0C7ABD715407A25EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820948, "uuid": "df74259b-a52e-4771-9921-e5896fca5234", "value": "6144:Z7BJulkWSG6QdqI2DBQ/l0/U6fsjLw84xToJs5iAuMcNDje104ZV7Xocy6Tdc:ZVJuKWd21Ea/U4sj084x8qVxZVLZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820948, "uuid": "e9e6fc59-f4dd-41b5-94f5-7237c9200dd7", "value": 525414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820948, "uuid": "751bd18a-4a60-4062-9c2a-13533318e24e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820948, "uuid": "c631ea0a-db30-4e12-ac3e-998075322b59", "value": "172082094700db9e9091b6a6dbee178a20f02e04b0e858330e4aa6383213e7388d36089f4b506.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3fa6ff7-4068-11ef-957f-42010a9c0016", "comment": "Malware payload (Gafgyt)", "timestamp": 1720800364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800364, "uuid": "fec288ec-7773-4104-bfcd-5acb3ed275c3", "comment": "Malware payload (Gafgyt)", "value": "b1b96aa16796d9374e6c079dd5264992", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800364, "uuid": "8182ba99-ff81-4802-85b1-cd0abb32ca63", "comment": "Malware payload (Gafgyt)", "value": "c93409cca58b99bc0350f27ca2ab588f49d1aa5d91729faa619e1ae6d2f10c36", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800364, "uuid": "9d83fa2f-55e9-4d64-bcbc-19d93d06b989", "comment": "Malware payload (Gafgyt)", "value": "f5a5f284186c75e77b682cd24bfc7a3502a96fae", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800364, "uuid": "8c77c33a-0913-4c81-8e82-391c4a3ec53a", "comment": "Malware payload (Gafgyt)", "value": "f3483e20321f0344a4e6729a4c019028bdc300ea76c33e6f756a039d2bd5c7221fdf59c37dd7c3484f81b9bab35dadf0", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800364, "uuid": "d1a1c7b1-c32e-46b7-adb0-c4850f4df04d", "value": "T1CDB32809F5148753C1C32B7AB78A834937226AE557EB33056638BFF47BC27A91D36980", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800364, "uuid": "f819a24a-c9c6-4309-812e-455fc743e63c", "value": "3072:AQvMSj3F21eNAwaQYCt/F5h50trNkwHGmoQxu1bXHIn:VvFgDwaQY2/F5h5+rNGmoQxu1rHIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800364, "uuid": "c4a2abb7-c13d-4656-b2cd-6008c36227a7", "value": 116125, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800364, "uuid": "cf48d7ce-3a6a-4451-9583-0393786299cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800364, "uuid": "2f920d98-3997-4e3c-ac0b-e73b2bf80e8b", "value": "fuckjewishpeople.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b57a7c-4015-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720764475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764475, "uuid": "e5a01fdb-da9b-4a8a-ab51-070cf3ee1dc9", "comment": "Malware payload", "value": "f8b3088250f0bd7358564556b7620de9", "object_relation": "md5", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764475, "uuid": "0f9c38ff-7582-4241-b9b1-4600c133f236", "comment": "Malware payload", "value": "c9c5bb8acb89ba11e7813b59aad5d3de6d0d4f38839d4a7a74636ce9c9c6ecea", "object_relation": "sha256", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764475, "uuid": "513726b8-7ab9-4591-9d4f-3c16374762ae", "comment": "Malware payload", "value": "aa31d2a19d7b2f51fffce135736b192d3cdab875", "object_relation": "sha1", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764475, "uuid": "80dcdf24-4d97-4c94-880b-4ebca9cb83cd", "comment": "Malware payload", "value": "f1d7f78454ae5a05526f7b6455f985f015c8bcd62c0c915ea51d1c3016dccd65217273c9fed9690e04924e98e16cad2c", "object_relation": "sha3-384", "Tag": [ { "name": "64-112-85-3", "colour": "#FB6562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764475, "uuid": "601cd54f-7ead-4c6e-834a-1f51eefd2466", "value": "T115463325D3CD64761B85D42E193A0CBF7429ABB5130F5E9834AE0ED763B1EEC919C02B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764475, "uuid": "faf00ce4-a28a-4cb4-87b4-c4d6e05a1c2f", "value": "98304:y8D6FrZ1dvQ4MdAtfv2Qu6GMoI97MnVRm0/0nSyv97JD9u4/Fan34MZxuxUp:R6FrlEi92HY50Vz0nDFNDhHMZxux+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764475, "uuid": "efb7ddaa-7916-40ef-9aa6-7b8547732183", "value": 5664256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764475, "uuid": "7e52e965-2df3-46d6-8799-deefbb9776a9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764475, "uuid": "ee6d8ef5-2394-4564-8105-ff99678f1f52", "value": "name1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9f3d71-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720756251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756251, "uuid": "79fc666a-bcb7-4853-a16a-ea535be84b9f", "comment": "Malware payload (Formbook)", "value": "251d4058ed16f117fc65c14e103c08a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756251, "uuid": "1cc8f4de-57bf-4e43-8413-50df396d73fa", "comment": "Malware payload (Formbook)", "value": "ca420eee99c83accda5d248b743f2c1aa1496a426879699eda3bbb33c5961c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756251, "uuid": "d69dd4cb-cf6d-4c60-9378-67eb9058402b", "comment": "Malware payload (Formbook)", "value": "c698d40e2f9dcf3dc50a7d3df135cc898ab5dc70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756251, "uuid": "0bb23661-301e-42aa-a567-e54d11aa5b4e", "comment": "Malware payload (Formbook)", "value": "aac43112785cb2b388cbd3912aec5b48d08bcf53d6d667e4ef69b0a0a6c274ab65a15a3a3f868c7fed993dda11be370a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756251, "uuid": "6b6063e2-2c76-4e90-8a69-a5f651dcd3d2", "value": "T13545AD0273D1C036FFABA2739B6AF60156BD79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756251, "uuid": "a383d15d-0c1e-450a-86de-51ae16e92864", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756251, "uuid": "28cecc3b-6d9c-4b85-80e0-e0cda3ba310a", "value": "24576:QAHnh+eWsN3skA4RV1Hom2KXMmHat7UaZWwdcMymDn5:Hh+ZkldoPK8Yat7U2WIPVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756251, "uuid": "be65b3ce-e799-4ac2-b75c-79080230cbda", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756251, "uuid": "abd4042c-e269-4036-9790-6febd8700211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756251, "uuid": "dba03ceb-d692-4027-855c-9a959248b711", "value": "09090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6053a1d-4052-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720791053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791053, "uuid": "3b5af118-ba25-4c4d-ad10-3c632874fe07", "comment": "Malware payload", "value": "16cc2a1cffa9c05c23b010cf69bcc786", "object_relation": "md5", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791053, "uuid": "47001361-5a1a-4e88-b967-48953b2afa0e", "comment": "Malware payload", "value": "ca5b9d425c1293d3250611db61fb9f9781ad72c1374f0f3ec4096b687d32c5c1", "object_relation": "sha256", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791053, "uuid": "d536438b-9a16-404d-b21c-c863c4032b1a", "comment": "Malware payload", "value": "8fd712d23aa3b49bd92ad243f736ac0d1e7b2d56", "object_relation": "sha1", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791053, "uuid": "a3c574a8-f7be-475d-b09d-c7ee8b75c622", "comment": "Malware payload", "value": "45a5a6e595b18c4d1d85025b599faafce142e0f3f4b2ea24d8dc61277eac128cd6e54e4fa835e4d1a890e09264f8e505", "object_relation": "sha3-384", "Tag": [ { "name": "45-9-74-32", "colour": "#E01156", "exportable": true, "hide_tag": false }, { "name": "strela", "colour": "#C58EDE", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791053, "uuid": "bcf78835-64ba-457e-ae7d-9948e9016314", "value": "T123C73311F08A6469E90898B1E18F5B1862EA85DC12330785DD3DDE796BFB1C19E738F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791053, "uuid": "c0b16b4c-5e6a-4caf-ac1b-fbf1f6189de0", "value": "1572864:ILHp6FDsG+MJYbQvANisQvTQ8WLqh3AaJJ6Rju6+XrWBWqVB+:IL8Fr7Jlvc8WLqhd2x5+XCBTVB+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720791053, "uuid": "0f97164d-8d49-4acb-80c6-a4590fa228be", "value": 53571180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720791053, "uuid": "7a584d54-bf52-4a54-9073-c047d31fefbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791053, "uuid": "6709e2f2-64fe-438c-8dd8-a694b18edc25", "value": "45.9.74.32 Strela DLLs 8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "223f900f-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720773517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773517, "uuid": "6ab3f4c4-d2ec-446e-a539-e5bb8c45908c", "comment": "Malware payload (Mirai)", "value": "6493eaff391dbefd456ccdd213cf6923", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773517, "uuid": "5a9e5f0e-3533-438a-9fe3-86aa311fc2d0", "comment": "Malware payload (Mirai)", "value": "ca7d7d6beed062c7ca59e24c344f04af582a5ba01bdeccdd26303465c7594d44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773517, "uuid": "00efa00a-0ae9-48e9-99db-85fb8474720c", "comment": "Malware payload (Mirai)", "value": "2a16ad9bc26d4f0ee3b2fa3aaa43b4cffac1a699", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773517, "uuid": "887f53b3-9924-4a42-a0b0-952c1b8be21a", "comment": "Malware payload (Mirai)", "value": "805343747c092ce488cbb6c39b45ba63bb3564b5550dd029614c819c6b3d224c6d3ba95dc459b4592de4a9a0b9ed0b95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773517, "uuid": "54cd313d-42b5-4f60-b2c2-97b623aaffda", "value": "T1D1330113B715FDA2DE761D3862F88C8E3044466ED0ECA83235C8A9A162C315BBBD55E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773517, "uuid": "661a631d-e451-4cda-aab6-85f73cafedaf", "value": "768:hfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfb/t2tr9q3UEL2qEK5J6OAsNTGjf2tl8m:CPtQjiZVcykHRDl9L15J6RN2tAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773517, "uuid": "cc614302-ebda-4d49-86aa-3e966a5e1dc3", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773517, "uuid": "122903e0-bf98-449e-adf6-79ae9a685dd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773517, "uuid": "20661a22-16e2-4612-8d7d-844b90e2baf3", "value": "94.156.66.188-sora.arm7-2024-07-12T11:13:31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ad9842-406b-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720801764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801764, "uuid": "6670f77a-a0ff-4417-ad24-9a49b3cf8240", "comment": "Malware payload (Mirai)", "value": "c11362928490e70c791de80d35606809", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801764, "uuid": "f86b1889-30bf-4d0c-861d-9460699a2d81", "comment": "Malware payload (Mirai)", "value": "cae10807ef9aa206d027ff4eed274842508d8932627d5e056e6d38bbcf8d8fec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801764, "uuid": "41311b6a-da49-48c4-8151-bda4775f9ac8", "comment": "Malware payload (Mirai)", "value": "a291f3ab7ca1ca8753a1e2db213f1cb298042400", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801764, "uuid": "b7821e3b-20f7-4a85-bc58-c6ea860fb9c9", "comment": "Malware payload (Mirai)", "value": "80819a90bda8001359b8ce633e5b0f3c9743738d38678120224d2ec944f54423e78fbc53486aad8364c985da5aa03679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801764, "uuid": "9ae78430-af13-4798-bbe0-36e0f88846b4", "value": "T1EC931902A32A0D57D1975DF02AEF43F1D3E6EC9026F25301A51EBF885B72BB11486F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801764, "uuid": "1e826779-3dae-4933-ab54-cfabb34b42d3", "value": "1536:RRWwlIvkvMu+5nIKy0DwfSdnzsDJg9IR749K2WL:RR9IvsMu+60D+SRn9e49s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801764, "uuid": "1dba647e-615e-461e-bf15-5c588ce931d2", "value": 89335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801764, "uuid": "0c128a24-c5aa-4d90-b368-f713b1f8478b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801764, "uuid": "cf8ee4d4-ae25-4978-bc3e-c13696974fa6", "value": "c11362928490e70c791de80d35606809", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9fd3161-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773879, "uuid": "285fa1a0-181f-44d4-b8a5-5f54a0bb36c7", "comment": "Malware payload (StrelaStealer)", "value": "e88ef9c9a889a72a0d1991228c43bd6c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773879, "uuid": "e64a64ce-25de-4c16-8a30-795463572b51", "comment": "Malware payload (StrelaStealer)", "value": "ce53d3fbe193b70ef33f259e716d4a045a895e4610f6b13151b2ea334cfb013e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773879, "uuid": "7adb6498-3ef4-424e-a3aa-4c29f0cbb7f6", "comment": "Malware payload (StrelaStealer)", "value": "8b894b3b0390f625015adb87793f88a3bcbdd953", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773879, "uuid": "affb08d6-67c0-4f11-9c51-cb6434c3555a", "comment": "Malware payload (StrelaStealer)", "value": "0ba4fb850886cc06a3d09d43cceb8b560b64fe147f44e93e97415b91f77d0fe7fdae7c862c1590dc8a79df0aaab639b9", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773879, "uuid": "f9751868-9217-40dd-bd42-d1a56b207638", "value": "T1EE41D19716492F3939A24114BA115E28C28A6D3C3787F1EED0166DB7EC27968731258B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773879, "uuid": "e6f2c74e-14a9-4ce4-8b7c-f4064e63d6f5", "value": "48:CyWgV5X9trlNlYXTtqIczbJRVg0VzF9FWVzF9iQO+:CyrrPDlvHWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773879, "uuid": "3791e356-dffb-4a4e-840e-1bdbbd8e9d9b", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773879, "uuid": "ffbd8941-71fe-4f99-95e0-da8d808bf20b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773879, "uuid": "bed09586-aace-425a-9f17-4a5985c034c9", "value": "6180134691203726307.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e633cb7-4042-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720783846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783846, "uuid": "c2c9e5d8-b1a4-40a7-ad74-c878e9a89401", "comment": "Malware payload", "value": "02614cac174f1d29b4801ed5408fcbc6", "object_relation": "md5", "Tag": [ { "name": "bsod", "colour": "#007BFD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783846, "uuid": "1b5ad808-488d-467e-a9a5-b97516605bf3", "comment": "Malware payload", "value": "cebf5840376461467a7c665eb79b47329377e57612bf6efcc11d09c6282dbbfa", "object_relation": "sha256", "Tag": [ { "name": "bsod", "colour": "#007BFD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783846, "uuid": "6069eb4e-970b-4e07-8a0d-67c8e139c11a", "comment": "Malware payload", "value": "2e921d68f0cd3ecde79350cde7e50450a8eb7a2f", "object_relation": "sha1", "Tag": [ { "name": "bsod", "colour": "#007BFD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783846, "uuid": "1a944d03-7643-45c6-9550-bb92a26d542a", "comment": "Malware payload", "value": "a053079b41fba0d553d662eb0599739c1474d6f6d021f517df21920e018afec6cfca6d1f0aa77b582556414d7c7eb07c", "object_relation": "sha3-384", "Tag": [ { "name": "bsod", "colour": "#007BFD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783846, "uuid": "cf7cbcda-681b-4812-ac9f-c0cccb3460ce", "value": "T1C1936A5B73E530F8E5728639C8A10A05E776F8361A618B6F07A40A561F273D08D3EF75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783846, "uuid": "1b16743a-b835-4c40-8a8a-2024d3ebb81a", "value": "7f4ba1488dae0b6dad0286bf9aa704a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783846, "uuid": "69c18a5e-63a9-4048-9898-2f2d53b46b62", "value": "1536:ps4PqVQip4IyzRJPpDBSc03r+QXteNqXsWed09dlxb3fM:ps4PM/KzJdNur+QsNrMjb3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720783846, "uuid": "3b0ca04e-fd98-43d4-ab8f-08f50afc18a8", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720783846, "uuid": "fafcf45b-9c48-4c50-b2c5-234ae7a6c3d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783846, "uuid": "c0957ec6-c826-4b3e-8f1a-c1c00b06a8af", "value": "mario.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5838f22a-4036-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720778762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778762, "uuid": "a4f4c6aa-ca03-468d-9e2f-5a86336b4d4d", "comment": "Malware payload (Mirai)", "value": "24454384c09849a9763034c4b4efd764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778762, "uuid": "df205ac5-c5d7-4761-9703-e9808ab5a718", "comment": "Malware payload (Mirai)", "value": "cf01f3643592772523d23de99297bb6e0f695d36c2be4bea50d2612aa4911eff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778762, "uuid": "541e6f09-2f3d-4272-ad42-34d2262a0346", "comment": "Malware payload (Mirai)", "value": "3102300491168f0b957c12de2a4c326a94e1e4e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720778762, "uuid": "a3f6ef5e-a22e-42ae-9354-9fd769d82d7f", "comment": "Malware payload (Mirai)", "value": "32d230fe74b78fffd9ec9880b7ea693d89197e249c82b2801535dd7c4d5081a0bd4e20a07fdd09d2bf9f0fb2969976a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778762, "uuid": "a45768c0-df64-41e2-8cc3-006b0dbcc751", "value": "T16CE36C525643B9BCF1B200F8E69363EA29B3182C2F5ED1F1B882A53BEB711D44579F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778762, "uuid": "d51d5321-b977-48e5-966d-643fe8d9f0c5", "value": "3072:NdarEmiijpk2I1QNo79+FzU9SonNnIb6gTVq:av+heNo70FzU9PnEHVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720778762, "uuid": "0fb158af-4c11-41ac-be70-33918f00ef60", "value": 149044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720778762, "uuid": "708891aa-74b8-4e15-bd4a-3636059c33db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720778762, "uuid": "a5ae7e1d-7be1-4f99-b619-30e35d4397eb", "value": "24454384c09849a9763034c4b4efd764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabfbd08-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789343, "uuid": "32329730-00e7-4de5-99a7-60df605f0811", "comment": "Malware payload (Mirai)", "value": "b4ad4c8fea78fc4ccac729e261bf6698", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789343, "uuid": "386f464a-0ab8-4964-9bfc-b54dc370b309", "comment": "Malware payload (Mirai)", "value": "cf4fe494238f2f4ca2c6c942c7a02dcaa8f37251b8be58167054c92f3e0cd2b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789343, "uuid": "2de1b1b5-1853-40ae-82f3-a5b4f83eb799", "comment": "Malware payload (Mirai)", "value": "c5f5ef5db348d6524b74bc45ca6767a9d6634cdf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789343, "uuid": "a194316f-e320-4502-b39c-18dc4b00484c", "comment": "Malware payload (Mirai)", "value": "9199862d66618683ae7a9d0656fd6d39ac257aa7a942e260679c01ad4a857c037fbbe04184b51524a683f36b1fbd08f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789343, "uuid": "d95ef968-1594-4879-90ae-7081eb59887b", "value": "T1C0C2E19006D8CD52D23068B2DDBDD6C2717B076CF5FA713275790E30AFC204AA9B9799", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789343, "uuid": "3207936b-1399-4133-9827-845eff967fa5", "value": "384:rhrVOGIg161jHO+tA+ScY4St6U4ANNcxZHsNSvb+rODIPrb/UISzU6YC4bxICpr5:vuvs4St6mBwvb+CEb/LN6yR/s3UozLGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789343, "uuid": "279fdc6e-340c-4578-aa1f-854326dc8ecf", "value": 27172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789343, "uuid": "4247a178-94c0-4335-982f-64a82896d9ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789343, "uuid": "7ad0947a-647f-4dc2-9211-d7d826ec9979", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a74906b-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720769424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769424, "uuid": "88345ee5-7d2f-4c43-bf03-a0ca50afa1ba", "comment": "Malware payload (AgentTesla)", "value": "6d45f82383d6da5ca15af6d8b6ddb412", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769424, "uuid": "8b62b3d5-7912-46c2-89d2-61b0736a16ad", "comment": "Malware payload (AgentTesla)", "value": "d09cae82231e8bb39eb676c09e80c9ad8ee44e2cb6dc0ed505e3a3855efeb400", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769424, "uuid": "02b2b03e-8dfa-4397-9c87-a7e452c91b7e", "comment": "Malware payload (AgentTesla)", "value": "30e3d33eca039badc0b2add6b5599199d311745b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769424, "uuid": "e61e4794-a2eb-45a9-9829-c24010c0718c", "comment": "Malware payload (AgentTesla)", "value": "17606e5b29aad5da3dfe9bf88d5d7a6a888c88edcb2676162597f98c3e4dfc39ec923246bc018103d2ebab239fed08dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769424, "uuid": "4f071485-5fb8-48c1-af25-c1bac866bf7c", "value": "T1DD846106B674A172DD04CB3984E79D1086E7EE59A7E2D50D25C8B26D1B323FE8F039C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769424, "uuid": "13c894fd-274e-49c3-b4f5-c3adc588d8af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769424, "uuid": "2b3a858e-9618-4748-9432-a12e112a252a", "value": "1536:pMhZVC0FEvOUx59vYTGP6mrql/NhuCtG9Q7qPpqOLy0uyL+fR:pMhqv9vYTGPDOx6H+Yuy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769424, "uuid": "06387481-f832-46f7-8b36-ba18c772bc01", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769424, "uuid": "64dfb5d2-d5cb-428f-bde7-d7731d3febc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769424, "uuid": "2ffaf11b-4991-4a14-abe2-1d23455cfd29", "value": "QUOTATION_JULQTRA071244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e199a8f4-4022-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720770402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770402, "uuid": "d3f220b6-21ba-46bf-9297-e062c0651391", "comment": "Malware payload", "value": "3f58da2e1652dddab53995166f24993f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770402, "uuid": "c3773a02-ef04-4965-879c-e646e83ea21e", "comment": "Malware payload", "value": "d14ee261ed6c5dddc1900587c455991defe0f49c1da1172d7f8f1e163309d3e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770402, "uuid": "a84571b3-54e8-47b7-ad62-7d4f283c29a5", "comment": "Malware payload", "value": "1721c19909c2309398d5174f9fcb2abcff51e862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770402, "uuid": "42165188-55f1-4119-85e4-7a648295f661", "comment": "Malware payload", "value": "71b45881453ea182cd3adb6d2d86d10a91e7f933fa97933df1c138179604fcb563fbc46e5a411993455a4888636c08bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770402, "uuid": "1e13d032-da7c-4331-be07-1c7dd426c921", "value": "T18B1523FEA3C9DC67D1E312700A5906750BD26E166D94883AE3933CC8B777742AB6D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770402, "uuid": "a7fd6555-4ce6-4aea-9016-1ddadd8ca5ed", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770402, "uuid": "9b867cfb-8920-4bda-a3c9-12cc16ce8daa", "value": "24576:MGxOacf/CoFPz8s43+ae4Y9hJ9HFtMr6lLwLkM0VP90ef2:XxyCoZz943+YaJNFtM+5wL3AP912", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770402, "uuid": "df210ece-9611-470c-a803-eec633f09276", "value": 898420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770402, "uuid": "28938ad7-2b4e-4414-8ad7-7e6602fa5f15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770402, "uuid": "3516fb8e-0c7b-42e3-a400-f53e0d257176", "value": "3f58da2e1652dddab53995166f24993f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e55dd0-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720756261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756261, "uuid": "4fa9ec07-1976-4089-9a05-66acb2661b72", "comment": "Malware payload (Formbook)", "value": "3956cba8df617a81effcb63a47b9c1aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756261, "uuid": "e8c2be12-1763-4a70-b78a-528068a7ab3d", "comment": "Malware payload (Formbook)", "value": "d1aa0d4fe0206708d5a3fbbff6aebb88916282319d820914383865bb00200cc4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756261, "uuid": "19f930f6-e6ae-4a81-bb1c-37f595ebb5c0", "comment": "Malware payload (Formbook)", "value": "2f17a7b33abcd97adc55a62e64306a2485af448e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756261, "uuid": "24c30901-3cc3-45cc-aafb-cd3ffd830065", "comment": "Malware payload (Formbook)", "value": "e95127b21ac63575bc966348f023722d16c6a9e1e656a1fbec3dbbbd1d5c4aeba5c7d88683adac30601c787cd6b69821", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756261, "uuid": "224bf959-347a-4590-a40a-eeda774db07e", "value": "T1F0E423F8E86250D042FA31E5CA866B8E1F38DF8E59B3A81B92D1D71F2CD5F0325D5908", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756261, "uuid": "65d2a6fc-06ba-4145-ae30-5a90d8468782", "value": "12288:c1d7UkfP6iYw9r/ypwovrYawhpXjwW66LtOUwzHAbk4qCQCt7VLLuEFYG:cr7bKqTxk8hVskBOUsAoR8t7VWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756261, "uuid": "e7f4a9a0-4740-4594-a163-84236a2b28c3", "value": 669042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756261, "uuid": "ce16e763-a548-46eb-aef3-88e822674f2e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756261, "uuid": "ea34af1c-5e5a-4a74-aea1-da92c6d8ef4e", "value": "RFQ#TLPO10-24-RFQ#TLPO12-24-RFQ#TLPO14-24.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964973b9-404d-11ef-957f-42010a9c0016", "comment": "Malware payload (Vidar)", "timestamp": 1720788744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788744, "uuid": "a38760df-0fd3-4e87-b01c-9f638e2080de", "comment": "Malware payload (Vidar)", "value": "63138dfb6f059b316cef364b01ce34e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788744, "uuid": "d8f9ce63-4e72-4206-adfd-7054eab3a63c", "comment": "Malware payload (Vidar)", "value": "d1c5dce3d438c76addcfed20a46330ddadbe829fd49452f5728414057b441923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788744, "uuid": "92a74abb-268a-4a0b-b75c-a346160d3003", "comment": "Malware payload (Vidar)", "value": "5c225a8f99eb3992a0a0ce416648fef02023244d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720788744, "uuid": "713cf43c-d42a-45e8-8811-732bd36bec41", "comment": "Malware payload (Vidar)", "value": "811fc97c1f491e3648ddd50adf39f84592fd73d75b51157e6949b0d61752957979a5de3bae6243b2c2871d5a461d7998", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788744, "uuid": "b3aac326-6ff5-4d9b-9559-3aea11cf8208", "value": "T120369D167A50DE10D06A8737C8EF846847ECFF4467A3DA2A789A335C74613BA0D4E5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788744, "uuid": "448d8c3e-6fe4-4a71-9b0f-dca26f352c8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788744, "uuid": "cf2c1ae2-9344-4f24-938d-411187c2b5f4", "value": "98304:WPaFb2DelKDuO4za6WtlXtAJMT1VqHuH3qk8Nfs9H+:fFailK6O418NtAST1eM/8Nfs9H+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720788744, "uuid": "1f13cd53-6df1-4be1-8297-13fc5d16a7e5", "value": 5226496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720788744, "uuid": "23f886a0-614c-4e08-b63f-b1243c20e727", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720788744, "uuid": "8fbd843f-5ff7-4200-ac97-116c72b14b8c", "value": "hpproduct.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffadebd1-402b-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774318, "uuid": "f0f7912d-53a9-4532-86c8-db964830753a", "comment": "Malware payload (StrelaStealer)", "value": "ef4d7d33c62479b9e02d5fd06c047427", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774318, "uuid": "c4a7a1b9-62e5-4a53-85dc-63f374821221", "comment": "Malware payload (StrelaStealer)", "value": "d23fe70aac15f19b2c8d3bf63adb5f2e44d8fd0b52cca6f339ac4048380a06d6", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774318, "uuid": "64d2a11a-7d8f-48b3-8e34-53e3513780c2", "comment": "Malware payload (StrelaStealer)", "value": "c52274048a47259856b304416748bcaa1d1e9baa", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774318, "uuid": "a3c5a934-bebc-4951-87fe-56268bd55be5", "comment": "Malware payload (StrelaStealer)", "value": "c35e3955ce2871e51934bc10ece38b353a58da785c1bb521f67b8d82efc811b46f6652d9c2e1fe0336e70353a055f0b5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774318, "uuid": "ae60992b-fcfd-4bf5-a01c-31a2c78093f5", "value": "T12441A6C7965B970B1423EED4BE1A220CE45AD93A1184A3DDC9F0718EE91180FE3A16E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774318, "uuid": "03720af3-2b7e-4678-a41c-156b1ef5276a", "value": "24:AcejawPD19cNZ3jLTnISEwBy7gOtkuJ8kjJWCyyxq3fLlIy3OHs27ZMHs28Tuh2n:Ap+n3jnI/7gaRBxqvLlZ3k3uh2Pkly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774318, "uuid": "01333a09-7462-4d00-87aa-89f6183242f0", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774318, "uuid": "75777438-fcad-4c73-bbca-b8ad16256855", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774318, "uuid": "48461a27-4922-49f9-9fbf-5798d38b2381", "value": "11336298581611614097.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae999603-4015-11ef-957f-42010a9c0016", "comment": "Malware payload (Stealc)", "timestamp": 1720764733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764733, "uuid": "0e305c82-71f3-4b90-ba8f-180ca0b82357", "comment": "Malware payload (Stealc)", "value": "08c7502b3315ce651b6b57849c1d7308", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764733, "uuid": "7a5b5a67-6b4c-4238-8300-36b65b7e9780", "comment": "Malware payload (Stealc)", "value": "d25e817eee335c0f2baaf75f39e40ac410fbbfb2089d20f604718ccf053e27d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764733, "uuid": "4b0437ca-d2bb-4c8d-9205-a258376d5dc2", "comment": "Malware payload (Stealc)", "value": "25d8366a04fca7105e7c38eac267ab787456f8c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764733, "uuid": "0c5fc0f6-ecd0-4b96-8f56-ee9cd819a3bb", "comment": "Malware payload (Stealc)", "value": "c6bcc91e82a1aac9e6c4d1e3d636412c7027c633ee406cd723d183c6e87acfd24cce2e3b2bd005ce8846630ff329ad57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764733, "uuid": "daa4c1bd-bea6-449d-af80-12463caf91b0", "value": "T126B533AB5CF5525BCB00BA740BC9075A36E2FB3A87BCF68C03D54A6E114010D6F9F5A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764733, "uuid": "73a0ef27-20d7-42d9-a5ad-8087adf56bf7", "value": "001806c33a6e9fe5fbff34bdbd79b591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764733, "uuid": "20555eab-26a9-4aa5-ba7d-1813ca16dbe1", "value": "49152:JZtQ7s/0xcupfZA9HtWtVvFqFn3rmtJMNo:J0rfZQstaFbSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764733, "uuid": "6dae2b82-54bc-4b69-ba33-f3e0d76cf020", "value": 2481664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764733, "uuid": "47e90532-60a0-41be-b9dc-37e590d62e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764733, "uuid": "a6d83c3c-4963-43a6-b22a-a75a0215f8d0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e52a915-4069-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720800569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800569, "uuid": "2499ff3f-7110-4788-85f4-ca9c3d4a2fdf", "comment": "Malware payload", "value": "a309f8839dd6e219d8cd485cc399e3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800569, "uuid": "b2ea9842-7071-453a-9b33-0529098f879e", "comment": "Malware payload", "value": "d270c8a2103434ec8902b1d192f8907c2a36389e7657fca3dec2cfd5bbeaa917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800569, "uuid": "b23571c3-6e42-4837-b3f4-b7186fab764a", "comment": "Malware payload", "value": "f77aca108b45144c7ae32d76dd1a032a6e6353fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800569, "uuid": "84b8c84d-63c4-4e5a-9235-7841823e90ed", "comment": "Malware payload", "value": "05c73b973144c2ba7d2d24e2c403694b1e370765097c06d533d2c0310cba3ee144b4ceb5001c8c8a2a12c7248447d4a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800569, "uuid": "04140abd-daee-4c08-a3e3-4e05a8f2660b", "value": "T126E42201F3E46B69D9748BF71D61302003FE612F8262E6146FC675DB142AF0297A2FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800569, "uuid": "b0f7c1ae-3bc7-4004-808f-5256fd04ebaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800569, "uuid": "6223002a-693d-4694-aac1-931335f6973a", "value": "12288:Dd2iNzBRy3VetjsTkniznIIIoiL227v1HJw8IPesy:Dd1PjNcIoo20HJw8qO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800569, "uuid": "5a4408c3-2fd9-4187-b884-36f5bc4d2626", "value": 721408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800569, "uuid": "e7938ee7-1af0-4119-a3b1-1759e9a9bd7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800569, "uuid": "302d14ea-b756-4616-bb53-b35775a16b15", "value": "IMG__12724.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99171739-4002-11ef-957f-42010a9c0016", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1720756537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756537, "uuid": "cd90b724-e425-4082-903f-b19dff040c28", "comment": "Malware payload (SnakeKeylogger)", "value": "68e0165684e6817fa57a9291a9430b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756537, "uuid": "e50e426f-6406-49a7-8eed-c04e8188a063", "comment": "Malware payload (SnakeKeylogger)", "value": "d27239b28cfcbf7da1382d13b9ca2f8967241b0b8493db3df87ae8ebcad71045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756537, "uuid": "2e10b19f-40c2-41c5-ad41-d9cf0e8eb183", "comment": "Malware payload (SnakeKeylogger)", "value": "f21bf5d7a69bdf313ba56e330319077a9909dd5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756537, "uuid": "81755e2d-7d73-45ee-8592-37323713d236", "comment": "Malware payload (SnakeKeylogger)", "value": "d9d4cb77ccddf5747bc2746cd9bc40edfd8d0ddf537b2d990702db1e73091ef351574bfec67e8d1a3aecef6f1201b926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756537, "uuid": "8d0e0bc7-9d88-4ced-bd20-1fb3cf31adcd", "value": "T15B459E0273D5C076FFAB92735B7AB649467D7D294133842F12983D79AA701B2233E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756537, "uuid": "c88f4ebc-f5e0-4c85-9876-cb1824908b3f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756537, "uuid": "81e8c742-e567-4fe8-8840-284e18747d45", "value": "24576:TAHnh+eWsN3skA4RV1Hom2KXMmHa7wMexG5:eh+ZkldoPK8Ya7HeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756537, "uuid": "bd41243f-344f-4573-9a4b-c0522f355d9f", "value": 1174016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756537, "uuid": "5ff8ee18-b298-4ca1-82e0-4b08fcc32c64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756537, "uuid": "6cfbe28b-4733-4726-af4b-54e3ff5398db", "value": "PO#76215720223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166c8186-40a4-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720825896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720825896, "uuid": "81cd71fe-c839-422e-8c24-11a9e40865a6", "comment": "Malware payload (Formbook)", "value": "3d0257f3b89012fc88087b77ceecf50f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720825896, "uuid": "a4015d1d-bdd3-41e2-a408-f41050f911a9", "comment": "Malware payload (Formbook)", "value": "d2944ccc7a3e0b9ca0ff84c52abaa3d05c00f6cfc6ff0e669cc152fbb79fd961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720825896, "uuid": "e2bf8cc3-15fb-44fa-95cd-a95e663d673e", "comment": "Malware payload (Formbook)", "value": "59118559fee4ef72669e9bdcdfb59fee3223a04a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720825896, "uuid": "3bdea6cd-7eea-4b40-8112-d79f4e68a7b7", "comment": "Malware payload (Formbook)", "value": "b6a5922c0583dc0a82488fb179590647c0ca4e8bbf41748e971a53a04e4c44b131747b6853306fc8ee779e87b1efa098", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720825896, "uuid": "c6579529-96f6-44a6-a459-7a7327a24038", "value": "T13835AD02B3D1C036FFAB92739B6AF60156BD79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720825896, "uuid": "dec4f43e-30ce-4d7b-9166-f0419595dcbf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720825896, "uuid": "b51195a3-ddd1-47db-a157-9c4e494e18ee", "value": "24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaC9NazKZrTUnQWIsrKZ5:bh+ZkldoPK8YaCOzKZrTUndIsro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720825896, "uuid": "35439f8b-d35e-44c9-b198-01b62bda6f98", "value": 1100800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720825896, "uuid": "f6df5fc8-d69c-4906-856c-1f88c76023da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720825896, "uuid": "b80a4265-c112-4730-853e-d30419a9ebe9", "value": "Ticket Receipt and Fine.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f96bb9b-4008-11ef-957f-42010a9c0016", "comment": "Malware payload (QuasarRAT)", "timestamp": 1720758964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758964, "uuid": "5d31ac58-f45c-45b2-884c-08d06f18b779", "comment": "Malware payload (QuasarRAT)", "value": "2a139396635ccbef9561b2252739416c", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758964, "uuid": "64f0a6e5-9be0-4899-b71e-c544b7367ab0", "comment": "Malware payload (QuasarRAT)", "value": "d2e7dd07a011d12b618306c8e85a325ab6f399280cc3d9addf571a110da07338", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758964, "uuid": "bc6d4226-3be9-4e04-a87b-8ccb7e367f4e", "comment": "Malware payload (QuasarRAT)", "value": "4691004cbb994eddf15c88f999786f2ebccedac1", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758964, "uuid": "cbb75ef9-68c9-4cff-8de5-4153363c6b2b", "comment": "Malware payload (QuasarRAT)", "value": "b1dd70de56543cf25fefa5bbc9bbf43242dabffa836319045e16a4ab6fdaea6b6494787264d50687baf86beb8ade8ea6", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758964, "uuid": "f842ee38-7a57-43ef-abd8-bb04965365dc", "value": "T176A423AADF300974C9CCD6BF358F88DD89298B5576C9241CE23026EE931577673329B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758964, "uuid": "edb973e8-7e6a-49b1-b83e-0bcf63c9750b", "value": "d9b21ed323ff48cf23a449d7e21bb710", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758964, "uuid": "dc6c5e01-a722-4bc7-9355-1cc48b31d01b", "value": "6144:JuzANSoCaakF9V6Q9KcW5W+NdKH+NdU1U9q8FSxyD6XJahE5qlLFmtr32/yLK+Ln:JgjjER4ZgFui1U9duzYOtr38l8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720758964, "uuid": "781530c8-ffe6-4f1c-8ed2-c24c5c481389", "value": 464384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720758964, "uuid": "53d40496-3691-44ba-b310-5997a52c6dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758964, "uuid": "df5c07c4-8fa3-4fd0-ba2b-dcd0b9c15ee3", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270c842e-4055-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720791994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791994, "uuid": "04c9e6ff-d045-4066-a1bc-7d313e242273", "comment": "Malware payload", "value": "b9ee66c96b110622f4608581e77b0e4d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791994, "uuid": "a075fcab-ef23-4364-b662-bb5df53a56cc", "comment": "Malware payload", "value": "d332880175d47393d322c67eb8539c06441f11309ef19c76b59041f11a95e80c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791994, "uuid": "7d86af72-d014-4cc5-8c96-7f7cdd470251", "comment": "Malware payload", "value": "93b19c166cafca8ea6fbc1beed9ce945765d5674", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720791994, "uuid": "7b1448f5-a486-4d41-aba5-d09706dea1c8", "comment": "Malware payload", "value": "0b4d9272a56f6d4bf22be9159736d33bcb9321d9582166eabeb4faebd63356bf524288ceb498772a4a6f42d49e045ee2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Medusa", "colour": "#B225FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791994, "uuid": "d68327f4-b84f-4348-aec4-2766e8dba2fe", "value": "T105369D13F391AA36CCAE4736557A53197B31DC5A4B53474B2908B23C7CB76E4AF80AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791994, "uuid": "aed3420e-d4d8-48ba-9d24-1cdb8af3f959", "value": "49152:M6xREMofUQxEB5bwSzfr21cJDcLST8mMSBJML+97psQ/NRGxRvrrqyGrRTB2pjSK:XxRS4lzfr21XSHvpv1EhrOB2dSsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720791994, "uuid": "68158aa7-dd51-417f-8bd5-9c99aea5b973", "value": 5068048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720791994, "uuid": "8a8e4f0a-e5ec-4001-a16a-263e83fbfaf2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720791994, "uuid": "1743cdbb-2fa9-4c06-b3f6-977d8ba0400a", "value": "d332880175d47393d322c67eb8539c06441f11309ef19c76b59041f11a95e80c.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe781ea-4040-11ef-957f-42010a9c0016", "comment": "Malware payload (XenoRAT)", "timestamp": 1720783197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783197, "uuid": "2e258aa3-8c92-4ce6-b795-4ac26b6ae4a1", "comment": "Malware payload (XenoRAT)", "value": "a186adfbd28c7e573d1fe5b4f7f54cf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783197, "uuid": "85cea26e-58ea-4789-aa4e-cf4b724a0e58", "comment": "Malware payload (XenoRAT)", "value": "d5028e10a756f2df677f32ebde105d7de8df37e253c431837c8f810260f4428e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783197, "uuid": "bb8e3489-08e0-4f3f-8476-f0dfc35b600f", "comment": "Malware payload (XenoRAT)", "value": "42e384baa0b01cb680eb7a73406e47a0ea50e446", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720783197, "uuid": "e5333d32-ca27-47a3-9c8c-dc2086343a74", "comment": "Malware payload (XenoRAT)", "value": "0ea26cf4889b14b686181265a2394aa9599864ce323c6b6e505c190a968399058aee5a49a4f58eecc05019829f133afb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XenoRAT", "colour": "#CCBDCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783197, "uuid": "b3ffd0e3-ed8e-49ce-8785-1ac87878e4c4", "value": "T12D23E84C57AC8923E6AF5ABD98324253C7B3E3669532E38F08CCD4E93B933955805397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783197, "uuid": "354f1e0b-1c0c-4559-ac81-16b8ddea7d65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783197, "uuid": "a876245b-91f0-47d7-b439-ae66d7712397", "value": "768:mdhO/poiiUcjlJInNa3H9Xqk5nWEZ5SbTDatuI7CPW5G:Qw+jjgnCH9XqcnW85SbTouIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720783197, "uuid": "5bf3456c-e5bc-4a81-a512-7c32eed8a9a2", "value": 46592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720783197, "uuid": "42feec01-77e3-4ae3-ac1d-6da291887c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720783197, "uuid": "6e081d38-7c5f-48b5-babe-135b9d95a368", "value": "27e2394f7b506257a8afa48049a8fe2fef59dc87957def06bd51d1d9dc191732_payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe79f57f-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789349, "uuid": "376d8a8b-6e8c-4ff6-a568-6cbe1e0bc021", "comment": "Malware payload (Mirai)", "value": "409858663c74e0f7aa831cb6855275d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789349, "uuid": "c14a317d-0ff4-4501-aed7-fc5f8132905c", "comment": "Malware payload (Mirai)", "value": "d5305d72c3fe788f99342c340ee962c31405c16d3644605f3d8383a2e3694fe5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789349, "uuid": "1713ef68-a64b-459c-b64e-22b38a5d5def", "comment": "Malware payload (Mirai)", "value": "ff43c56f483acc1c90e410180abc65be1bddd1d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789349, "uuid": "f1c6cb54-41ea-481b-a741-bd86ad6cd711", "comment": "Malware payload (Mirai)", "value": "4c6e825574dfe8e9cdfcd2dff70372049da320973412d4054d305964327350161a0803bbbe8c7c8ea2e9114626c07d85", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789349, "uuid": "fcaab824-7c58-4bf9-9a32-c8a6c81e1d37", "value": "T186D2E1B8E1350F59C6DD6EF2ADCDD3C23F621B20BBF6C9855C408B85262A5171B744A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789349, "uuid": "cba10698-8eb3-4c36-b12e-c0ed656e0db8", "value": "384:TY9owfjsGJYHD+3dfyitgiM/65YIOwRVRDJyClD6pR4xtDsrRo+e8M4uVcqgw05h:4XzEDkt5CwRTDJyZ3sj4uVcqgw09F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789349, "uuid": "2a5c09f4-b941-4e26-8d48-f2b9c4185099", "value": 28896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789349, "uuid": "040fceea-22fe-40a0-bf05-890f519e59c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789349, "uuid": "2e327648-c481-4d43-98fe-cd0e0f02e845", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e174836-407a-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720807978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720807978, "uuid": "38fce845-a16a-40fb-9d34-ee8f569f5b3b", "comment": "Malware payload", "value": "51afaa81fa0fe86fd952e03f64da86d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720807978, "uuid": "30344e73-a491-4f2e-813c-5094dec568d3", "comment": "Malware payload", "value": "d5b5c2bfbf9d01c3ac037aa994000a61e08766474af00186b3b3676c8327dcdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720807978, "uuid": "e590e184-490d-468e-b8da-a5cf4891d9dd", "comment": "Malware payload", "value": "8a5cd176b024d0ed84c3a50eeda3c242ce60d7ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720807978, "uuid": "eec43f71-ecd2-436b-b979-51392c79a9fb", "comment": "Malware payload", "value": "402b11a1b6810a998b6ca43b4595f53cc5003b005184a523ec40b17dfc0bc0f5e1a7041b4dc0f3d1c1cb4a3bc165ad1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720807978, "uuid": "cd5350d5-b51b-4d5c-92c7-eee124ac9e14", "value": "T1FA45BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720807978, "uuid": "899e3d2b-f750-4038-bd90-f9bbd362b0db", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720807978, "uuid": "8306fa5a-bf41-4d9b-97cc-16269c6cc1e0", "value": "24576:6qDEvCTbMWu7rQYlBQcBiT6rprG8aLn2Sbly7TWEPje:6TvC/MTQYxsWR7aLn2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720807978, "uuid": "059817cc-274a-4b25-8f71-3e92224d61b1", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720807978, "uuid": "6380c126-7efe-48ca-a4b7-9c4d7212490a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720807978, "uuid": "802a270e-f231-407c-8ba3-783107b6dfbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53adae25-405b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720794646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794646, "uuid": "8189c2eb-0f3b-4cae-bed0-284f8320f3b8", "comment": "Malware payload", "value": "38865a2be49a36cc8cb3a66e2024b21c", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794646, "uuid": "83649c77-b7a8-413b-aac7-98f0ce371a53", "comment": "Malware payload", "value": "d60b10cd627f52bdd83b90c8b2a3720fb3363875554724cdb7033d9a439ff839", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794646, "uuid": "72400d98-ecee-46ed-92b0-c79f5d2c720b", "comment": "Malware payload", "value": "f99aec13d8125e238b3accfedf61a7711185638c", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794646, "uuid": "3c1b2413-b79e-448d-b8cc-7d0d5cdbc49c", "comment": "Malware payload", "value": "1bb34be9cbe8e212380e7acc13f81db6d9051ef5f8dfe91cb131dfd320f120519ec3b2b5aecc9a59772f81ab5f94f919", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794646, "uuid": "69f25c3b-174f-4468-ac0e-972a9a479e30", "value": "T175942320D9E21F3477BCDCFB73A8D2987252518B52358BFB43EA4B4E8EA3326441D641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794646, "uuid": "43cb78b3-4dcc-445a-9c0b-79aae81b47f6", "value": "6144:m1ai/ZSTbdb5KkJR23mOYENbR6nTJzloFjnBql7IxKWOM5KbQE:LH55PE39YEn0TR8bsl7Ixe6KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720794646, "uuid": "227ec95b-0f93-4320-9ced-43638ec54a47", "value": 442433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720794646, "uuid": "62a27c73-7783-4cf6-88d9-13c213c1b7cf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794646, "uuid": "4c74159f-917e-4957-85dc-b7741ccc1894", "value": "nEKTEDIR.UUE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af1e1c9a-4068-11ef-957f-42010a9c0016", "comment": "Malware payload (Gafgyt)", "timestamp": 1720800383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800383, "uuid": "821b48d6-b46d-4a1e-ace5-787378b131ad", "comment": "Malware payload (Gafgyt)", "value": "522e6c5ce7bce5b094b3a9f093087f61", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800383, "uuid": "aefb4342-e5b0-4db4-9c88-81b4cc78562c", "comment": "Malware payload (Gafgyt)", "value": "d72c7ddde7618e82abd042845b8ce250097ee62cbf80ac125ab1f9f0fd80e7cc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800383, "uuid": "ccea52f4-451a-47e7-902e-fa1e7fcfe9b1", "comment": "Malware payload (Gafgyt)", "value": "b53027d6c48f148bdc13f61d530171bb4553517c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800383, "uuid": "257ffff7-afd6-4c2e-a9a9-0986457a2e39", "comment": "Malware payload (Gafgyt)", "value": "e1501dbabc731f01d13c72b29eb503109a584d66e946ad7cd781e748df40206006665747956074bcef408b5de85f8457", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800383, "uuid": "0e1ae83e-3f80-4673-be79-ff7b4aaeebdb", "value": "T1A8E33B09F6408B53C0D32776B68F530537239BA5A3DB33169928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800383, "uuid": "36aa7402-d9e3-4963-b43b-24e170af2c25", "value": "3072:tdntU2haO5H1XacBoGmh9H5U5hDiGbycxVf9T637m5wTsL/Qpyn:ntVhaO5H1qEc9Hi5hDiGbycxVl+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800383, "uuid": "79334f40-6e14-4256-b123-a63cbf340082", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800383, "uuid": "b9956899-da7e-4049-87ee-77ee93fb276d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800383, "uuid": "02bb1cff-221f-404f-8347-d8761c11350b", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc9d51ef-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789346, "uuid": "776bfdd6-5c5c-497c-a742-6d632354ed3f", "comment": "Malware payload (Mirai)", "value": "8d24045d570edd0935dad50aac2b90fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789346, "uuid": "ea927735-60b5-4834-b755-2f3afc1b777f", "comment": "Malware payload (Mirai)", "value": "d7d2b06909bba43f36bb9b51391f707d5f97156d725c9a112932f0075df6c63d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789346, "uuid": "8f7b6038-9e69-486b-9a40-c1270a37a6b8", "comment": "Malware payload (Mirai)", "value": "22367bd530be966d59b7111f45d6287b7cc42b8d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789346, "uuid": "c1dcd6a1-1224-4a35-b620-76f386dc2dd6", "comment": "Malware payload (Mirai)", "value": "c9315a79bfdddfbff9d022b8da948ead938b7e85deb0f660ee1e18070268e03a0dff397ca47907666326ec19170e49d6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789346, "uuid": "b4183c47-b737-4644-a906-65c36aa607df", "value": "T178731ADAB0004E6CFD8BD9FA95214E0AF920321155834B53B777FD977FA21A98C43D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789346, "uuid": "31763148-c289-4006-89b3-1512849008a4", "value": "1536:IzP+ZH+jJDfCZ8FqBRXTfDK7n7pg1p2Zwv3EHvq8Q8dnsA0t8o:ILvDCeqBy7Ipv0Pns7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789346, "uuid": "88ff4c2b-bbca-45f7-ba79-7b8fc8f3a77d", "value": 74924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789346, "uuid": "99d73d7f-a99c-4b3a-9a2b-c46b3018e799", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789346, "uuid": "aadd5880-86fb-47bc-b943-e3014e684b85", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c231ad6e-4073-11ef-957f-42010a9c0016", "comment": "Malware payload (PureLogStealer)", "timestamp": 1720805139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805139, "uuid": "cc954cd8-2e08-4a76-b338-a4a2167de5d7", "comment": "Malware payload (PureLogStealer)", "value": "17f0a21c1b5f9bdf2b8a9e9df9a84a2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805139, "uuid": "b68c0e12-98e2-45c7-9f21-07e2ec7c136c", "comment": "Malware payload (PureLogStealer)", "value": "d80327695eebee6940b7a55704b4c712e22c37f5bc95f2d5d6fc83e90f87bf55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805139, "uuid": "fb9ba026-20e2-441a-92ba-63837e19468e", "comment": "Malware payload (PureLogStealer)", "value": "a6f6c20c424c83e760cc881d4689bfe19dfee983", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720805139, "uuid": "fba90a85-b678-4273-ae02-b31062796de6", "comment": "Malware payload (PureLogStealer)", "value": "46e178828c742a2907fa8f10453b069cfd7bcf2b68d7700b969f4d495f769c1a4997fdc947c1b9604c8f0ad8db27cf84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805139, "uuid": "3d4f2481-6bed-4bd8-a86a-69deda2dda03", "value": "T15EC53316D2CD2B30DBE803F88AB59480137166AFAD23CCD22DC535267626BD58367E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805139, "uuid": "10dd8407-efae-4110-b480-d5ac0515f7a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805139, "uuid": "5c998580-39fb-406e-949c-f2b445f494f9", "value": "49152:B8HJt7IakaekGdTCraWHyewqy2VdgWp1mh6MJTkbe3zEHVe8Zc:+E91CraWHy5m+TkIw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720805139, "uuid": "6a643baa-ed0e-42f6-8cf9-ca0293a8d4a8", "value": 2519040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720805139, "uuid": "1b696245-d61e-4ed2-998c-7ee9d025eae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720805139, "uuid": "b13eacb8-1b58-400b-9329-3fdc13a9414c", "value": "SecuriteInfo.com.Variant.MSILHeracles.172068.27755.23666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f1c7e90-4002-11ef-957f-42010a9c0016", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1720756547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756547, "uuid": "a165d9a9-5161-4bca-8bdb-8bb7caa7e89c", "comment": "Malware payload (SnakeKeylogger)", "value": "5afbb8a98131d92474d5b89952cacecb", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756547, "uuid": "a7e11eb5-26b6-4e3d-8cca-723304e9691a", "comment": "Malware payload (SnakeKeylogger)", "value": "d876db76aa7a9ee972c1a70338d64a25a88e4c2edf6c3d7b957516fbd850c709", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756547, "uuid": "88d043ef-c46f-4046-8501-2b8c87e9198f", "comment": "Malware payload (SnakeKeylogger)", "value": "ce160ded5fc020ee96ae4884ee5bac5ca810b730", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756547, "uuid": "49c237a3-8708-4407-bbbc-dd64d8592eb4", "comment": "Malware payload (SnakeKeylogger)", "value": "5cd1ea66d4d69d3a1a5432fff249e6e69208f6786bf58f45f63e394c004b697c5bc7b5b54bd0d1c2bde52c750d45b62a", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756547, "uuid": "ea4a8110-8222-4dda-9142-e80af42bd3ec", "value": "T144B4336F4C60680272178B1FC2EFDC4477BE1C886069909E75920ADDCBA877397FDA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756547, "uuid": "e4ecf9a8-8032-492d-843e-39b8f0ebf781", "value": "12288:KpTJqQ9FZv4YbdqguRs+N5BtH0uDauC8ZTHyj5UKFV1V:KTTd4adqguRsk0u3VSj5Ue7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756547, "uuid": "35d94dba-f20a-4df9-8e84-592b268548fb", "value": 508936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756547, "uuid": "51798ec2-eb7e-44d4-a78c-ffce68174c16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756547, "uuid": "632b7fa1-1207-42c2-b5bc-17f9d9868ac7", "value": "PO#76215720223.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "004ba279-406c-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720801807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801807, "uuid": "710a0bb0-4f85-4706-b393-9fe1aa187e99", "comment": "Malware payload", "value": "3ec253034a6efb7a0c85f46413eebaa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801807, "uuid": "39c716a2-1f1c-43cf-aec7-ddcd9227e863", "comment": "Malware payload", "value": "daed6a9bd58e94a20c74a010c878510eb3364a526b3cfb9d5ed97455c7d56813", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801807, "uuid": "f924a1fc-0836-4708-aaaa-f72e3bb9f412", "comment": "Malware payload", "value": "5e34ff4339a333b9225068483e57b4dc890808cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801807, "uuid": "812840a9-48cc-4ecd-8910-0c66550e482c", "comment": "Malware payload", "value": "870480a9ce362a61b67e9cd42eb11135ef9e16cc4af9f73356896b2d67d220555b8801083e32420c14d95e8982964adc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801807, "uuid": "812cd176-b52a-4d7b-ad38-ba90e1d2556f", "value": "T11D631AC7F410EABEF81CD73B4C6709157271F2A04D870E3667A7BB5AE92A198051AF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801807, "uuid": "c5cffc5d-99b2-4065-be35-ce4766230309", "value": "1536:1S08tgi8IqsfLQekacWVcW0JcWcBbSSoGZeC/y3OO2Q1rEVgnKt:1S7DqsLQekacWVcW0JcWcBWSoGFqeFmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801807, "uuid": "69351b73-ab79-415d-b6c3-1a553a1e4c49", "value": 71572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801807, "uuid": "8cff794a-c5ef-45a4-8499-f99eb47ad57b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801807, "uuid": "0992d95c-dd00-4efe-b66b-aac8b92536b5", "value": "3ec253034a6efb7a0c85f46413eebaa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f308fec0-4057-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720793195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793195, "uuid": "49f259f3-e3a6-40b0-8ba4-436228c48617", "comment": "Malware payload (AgentTesla)", "value": "08c7a4e2704f15c9a68c5c65b2136942", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793195, "uuid": "66f35790-d508-4c06-aa73-75504c979e4a", "comment": "Malware payload (AgentTesla)", "value": "db7810807e57bfd7787f90ee9edf62916124eb646f39a11d601b8100b528a985", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793195, "uuid": "77535d85-aa10-4f4f-aa6f-fbdb68d12540", "comment": "Malware payload (AgentTesla)", "value": "3e9b4039af5b4641263fbb79a8b96526444c407e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720793195, "uuid": "561502ca-af0d-418a-bc66-e678afc013e3", "comment": "Malware payload (AgentTesla)", "value": "145abcddabf49acefbff78f37d59aa6be2a925696155b8632ebb1acc13bd0905d9cf5374e69f80c130d154a2911658a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793195, "uuid": "c4cbd57b-b95a-43b9-8ade-2291d37dafab", "value": "T18EE4120663F85B6AD1B947F33A61620503FE1A1FA460CB190FC878C615B6F059792FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793195, "uuid": "633a30be-91b2-4721-8a6b-7eb6cf919dbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793195, "uuid": "3c13a092-e9f2-4079-a58a-388a1b6a8bd9", "value": "12288:h02iNmWIKe/NncaWkuctsli7J5ZM3EVYV5XGjy/6sHO9gZf3tYLp8tiZJ/plIPe:h01TE9AliLZkXGeStgZftO8tGBPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720793195, "uuid": "328c1ef2-dfea-490b-987b-6e61b1a4d5d6", "value": 688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720793195, "uuid": "fd183b5b-93ae-4952-8905-c3cccc06a746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720793195, "uuid": "3fb57fbd-ade8-42fd-92ee-04fc01200204", "value": "z1X3Z1ohoefF078ij.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f548550-3ffa-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720752950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752950, "uuid": "2e34ad4b-72f1-4186-81fa-8da7fd73c392", "comment": "Malware payload", "value": "37f0d7fac582e7e1592b3306f79143f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752950, "uuid": "6d779c48-61cd-4a74-9a1b-ba63b1d67123", "comment": "Malware payload", "value": "dd8ed064fdd43873a7ece063734ef85a27549c4f2a90e05aeccf859c8c53ffbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752950, "uuid": "6d1e67d1-09ca-45f4-a59b-44aca55d5656", "comment": "Malware payload", "value": "fe09db964b98769ebf71d780de5655958a4b9dbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720752950, "uuid": "88f95056-ec0e-4b4a-a13e-9c8263da3101", "comment": "Malware payload", "value": "b765e777c4a6484558d33c524d0485cd4ba73f5d7a53febd2386420ea433a68d4d2c25483963908c33032ca6627c59a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752950, "uuid": "622f5967-bd97-4e33-9bcf-69d4f7ef284f", "value": "T13645BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752950, "uuid": "c4ee0fdf-7545-46ca-9626-f1a2134bb0d3", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752950, "uuid": "d43eb150-f655-4d63-af84-7786f712d7bf", "value": "24576:WqDEvCTbMWu7rQYlBQcBiT6rprG8aLi2Sbly7TWEPje:WTvC/MTQYxsWR7aLi2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720752950, "uuid": "b63c01ba-e5af-4a35-9393-4297e63ddc10", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720752950, "uuid": "56219e12-c13d-4fc7-aea5-7f1a4eed4749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720752950, "uuid": "f4cd216f-6987-4e2d-8656-a1eac3284311", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8dfa93-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720769404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769404, "uuid": "817f21b9-438a-461a-adea-7a015593a9ad", "comment": "Malware payload (AgentTesla)", "value": "cebdb3ab9bebdd5e76b39393289d41f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769404, "uuid": "435bc65c-63b0-41e5-8c14-7395cc60db72", "comment": "Malware payload (AgentTesla)", "value": "de3e2c58d6f5e209f72de88b245e651d425746195eefe8994e74f1439a3f2f46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769404, "uuid": "e301448e-cdf9-488d-bc77-552180705774", "comment": "Malware payload (AgentTesla)", "value": "dbe6425eff4072bcd6375cb511074996f8dba115", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769404, "uuid": "9dde0bd1-9ef6-444a-a501-20b76dfdcc08", "comment": "Malware payload (AgentTesla)", "value": "b17b8caf8f56690d5d1e3175ca61f2783dabf98ee21c3fe23ced84a9b0611721f43ba284e1dd334d1273caf625198b96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769404, "uuid": "6b1ffcaf-f0ca-450e-a5dc-a8a166ad094b", "value": "T14D846F07767491B2DD04CB3586E69E1482E7EE596BE2C50934C8B76D1B323BE8F039C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769404, "uuid": "40d43818-3444-4b8a-8ab0-a444e460e801", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769404, "uuid": "8f2a4748-779a-4390-9c6a-7dfe97147142", "value": "1536:npkCX4nLhlkCRigb6VUbLgtHHE2Lut+NhuCtGgQ7qPpqOLy0uyL+fL:nby/1c9eH8HHE2n6HHYuyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769404, "uuid": "2a451ee5-0094-4d07-ac76-a295b480df9c", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769404, "uuid": "ffb828cc-2b67-4931-88f1-d21db12ce323", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769404, "uuid": "a70cb12b-ad69-4964-97ae-26575e909c6b", "value": "QUOTATION_JULQTRA071244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "385008c5-408e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720816504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720816504, "uuid": "dc27792f-508a-42af-ab00-e60d1b4c21d2", "comment": "Malware payload", "value": "bbef7a54ceea26127c9c8e1c22a1d78c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720816504, "uuid": "8400923e-0417-4e59-b6c8-405261144788", "comment": "Malware payload", "value": "df15d65ee29b8cb7ec8ede2a41b85f77cf1d35c8b0bf62aaaa67a74329f81f91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720816504, "uuid": "60814f88-3ab6-4151-a2cc-bcece19864b4", "comment": "Malware payload", "value": "ac4995b3e033a76630ea04fff2a00b2c0ad610f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720816504, "uuid": "448b60c3-a525-4b2b-8844-4743a7ae7e86", "comment": "Malware payload", "value": "ad4120fb3dde5dcc4ab9b8ddc79e4dde2653db55e41c8a8ce9ac074d4bf58196fa457e90e87e1c889a45181aad75d5d1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720816504, "uuid": "3e41f4f6-c6be-48f7-b363-c544c82c94ce", "value": "T11594BE107886C032C4AE11715978EBBA5A3CB9700FAC58EBE7D81D7F6F605C1A73664B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720816504, "uuid": "f155c1af-ab9d-4ab1-81a9-ddb0901a15ed", "value": "08fa762037ac798c0d1b9aaf798534ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720816504, "uuid": "ed1c568f-a4b3-4d12-af7e-83a84479a148", "value": "6144:KtL2zY1O3P3Q4qJzXLCQSN6j7CmBnmErY+32+Ny/ITLkPzQVrPoRPFK/AOfwPN:KtLQfQ4CiDN6PCmBnmq2+Ny3zYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720816504, "uuid": "287bf829-19f9-4c9e-a97e-80021085f1db", "value": 421376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720816504, "uuid": "8207c307-8f1f-4b59-a3d4-d06ec3f92f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720816504, "uuid": "2d793064-2829-4a4d-8fb9-04cba26978da", "value": "SecuriteInfo.com.BScope.Downloader.Agent.23878.22210", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d50a07b-400f-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720762074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762074, "uuid": "a19d0757-3b42-4f62-8911-f1d5af80979c", "comment": "Malware payload", "value": "9d97d3844d4c0bb06a73257aab6c02b8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762074, "uuid": "7a8b3f95-59b2-40ba-831e-bff42f2f5bd3", "comment": "Malware payload", "value": "e024fe959022d2720c1c3303f811082651aef7ed85e49c3a3113fd74f229513c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762074, "uuid": "d3d4182d-aef2-4373-ad29-8d4f97a2aaba", "comment": "Malware payload", "value": "be72b1328454159f8781b6d9007009ab26cb9ba5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720762074, "uuid": "b308df91-f6eb-49c2-bcfd-dfd992cf028c", "comment": "Malware payload", "value": "5f8a267a748f660e343555c8ada50e6c99ab0a7393610a4a86a9d8bb11c1654c2a4f852dae0d996986b709377a89b415", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "meeting-equitaligaiustizia-it", "colour": "#90F777", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762074, "uuid": "8825c629-6ba4-485b-8c14-1dd3e9608b49", "value": "T138B633179DC3C478D97B89F360C386965C2B82A67D0FA5BF079059C85FA0C475B23BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762074, "uuid": "927a5c7f-7804-43c5-8f08-4a3447313c05", "value": "196608:edZxaMklV7oDftELUqniiJRRiwrFlijMLmY8dqWHZi9L8r5Gmy9tIZjkaPA9iDUA:ed+7kqLUqniKRRFr+j658dqWmu5GmyDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720762074, "uuid": "98ca09d0-328f-425d-99e6-afd693c4662c", "value": 10767935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720762074, "uuid": "527868db-8a96-42a4-8404-467ba07b4c71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720762074, "uuid": "e988bf11-0712-43d6-9b57-4cce79fc814c", "value": "vcruntime.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b936560-406b-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720801585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801585, "uuid": "bba7f0cc-2ebf-4ec7-ac02-db80a862167e", "comment": "Malware payload", "value": "1df9f2feb7ec6209c542018646673dfc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801585, "uuid": "21a568e4-8789-40ee-8704-0730fce12d5b", "comment": "Malware payload", "value": "e0fb9aee7ea771dbfb417e17dd42ac0b2728b28f599efc659d3a0ebd81d6ab14", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801585, "uuid": "c5209799-c032-4e94-91b7-2ab247f08e4c", "comment": "Malware payload", "value": "df6305b886d4af42cb83247ba7a6e5c5a4cd3518", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801585, "uuid": "0c0435e1-6a34-4f4d-bdb7-9fe19e7a25a4", "comment": "Malware payload", "value": "a786416dfe328a6c407afe95dfaa38cfe263c410a73aeeb218a1f233f68cfbed4cb7c02a075df3251c4f8199fdef6067", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801585, "uuid": "c7659104-710e-4f5c-932e-2b88adaa240e", "value": "T14FC02BAB2B034C090C3038A92C80A3088086240094416B32B4800013331125D8C8368C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801585, "uuid": "1da87b0c-cfe7-4cbc-a12e-64f1b648d009", "value": "3:qVoB3tvLvolEmNAPAv+U70GXIMwchtsyovmMwWKBcWWGb:q43tjvaAw0VMwchtMwWXfGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801585, "uuid": "cfaa6c50-f910-4ce7-a0f0-4d912c7246a2", "value": 132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801585, "uuid": "67ae568e-68c8-4671-aa8a-b9e5ca837202", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801585, "uuid": "359aa871-b083-4f5e-a16b-c8ba80b3a742", "value": "file.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a949f0ce-4060-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720796937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796937, "uuid": "54afdc45-8cda-40f1-be26-1a785041b035", "comment": "Malware payload", "value": "c3e7755c6eaaa4998ac2bc4824468abe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796937, "uuid": "c518db28-0c46-41d0-b46e-8f2d302259a6", "comment": "Malware payload", "value": "e1048b808dcd66b9461a04a82a84e40ddbd328bf01fd6967c63859f6d26ccddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796937, "uuid": "c54c4eed-2445-4601-b6db-a03d0f6dc4c3", "comment": "Malware payload", "value": "6f39bb5150bd993da49fafe1700b798e3d8b05bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720796937, "uuid": "8b1fb4d6-e4fb-44ea-940b-d6919688ecba", "comment": "Malware payload", "value": "b4fb9812e907fe9c61c2d20fb06aa7d38bb302c057118c742b374487fa2fb4467bac28076a3ce1e58ddb51e1595079b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796937, "uuid": "98bc6759-8706-4888-baca-2a67e83205b0", "value": "T1D645BF0273D1D022FFAB92334B5BF6515ABC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796937, "uuid": "4b25d67f-d488-4330-889f-5deca8e66533", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796937, "uuid": "0de5fdfe-e7a8-4d3d-8895-d64491b0d887", "value": "24576:YqDEvCTbMWu7rQYlBQcBiT6rprG8aLm2Sbly7TWEPje:YTvC/MTQYxsWR7aLm2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720796937, "uuid": "3f638484-5b52-4ccf-bc4f-281238481c9d", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720796937, "uuid": "e549c173-7a40-47ae-adf5-9d40d4c2d636", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720796937, "uuid": "d2a40f99-b3ee-4106-a955-27577e757a2e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f18efd-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789326, "uuid": "7e966ad3-e5ad-4af6-9417-f2a3e67737ec", "comment": "Malware payload (Mirai)", "value": "3acf3b2081b357cca82b3d5bd2225044", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789326, "uuid": "fbbdd4c9-7aa3-421c-b861-84db7d3e18e1", "comment": "Malware payload (Mirai)", "value": "e10c177f70389c12a998bc85858e7b3d432e663d49d5b19fd2a97c15bf105281", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789326, "uuid": "e608168d-4b86-478d-8e15-6489c011f603", "comment": "Malware payload (Mirai)", "value": "8de21be570cee965504edd7dadcaac339b2ddf81", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789326, "uuid": "6abfd9ca-8a8b-43f8-9d88-6fd054a99554", "comment": "Malware payload (Mirai)", "value": "58605d22ec6ed23cb879f7eab1bf8c58d4a5e72dcbf6260bba23c16c1da36bc089bcd627ce7a61cf8defa3b5671306c4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789326, "uuid": "ae5f7e01-98db-45b4-9150-6a346d9d7c1b", "value": "T139B34A0273290A57D49B8AB429EF5BF043F6EC9025F17649E91EBF940773BB21085F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789326, "uuid": "e1eef03b-0d11-41f7-a419-9301abab2f21", "value": "1536:m3LbOq89I/LhBBX5R11RaqwvyB7/2TKEV8w2g8GzBhb03OruFh98rGstcNTtP2Qu:m7jLL9r11R+IjcwjBGzBhbiDImPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789326, "uuid": "86628a3f-3297-4606-b8a1-87c4f30dd6be", "value": 113467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789326, "uuid": "ad0ef15f-4bbd-4790-a8f1-632d01715572", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789326, "uuid": "2893d6f1-b0a8-4f6d-9015-90c9ec14f61b", "value": "jade.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89a1e49-4045-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720785366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785366, "uuid": "e0631d91-cf0d-4110-96b3-053fab11606f", "comment": "Malware payload", "value": "70c487d1dfaf054e24fbdd5d3e4f3671", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785366, "uuid": "57aaafc2-9e58-4595-8bc4-394b6b4a0a65", "comment": "Malware payload", "value": "e2899370407f68730665307b67a0b7e45a0fc42ed6d6825a2df6a5c00b777b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785366, "uuid": "61590332-0cad-4752-b09e-42b12f660594", "comment": "Malware payload", "value": "2607abf772aaacdd8d0d3608e5c8e98e242e9783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720785366, "uuid": "7ab2135f-7dea-4cbe-bb4e-984bdfb3c4a7", "comment": "Malware payload", "value": "c4173c73d68984aebcb619e33531eb238a052dc3e3006e09276191514a507f5d299525df8adaa10f34d625aea24eb2c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785366, "uuid": "f3ba05f9-8b85-4bd7-a11b-2a3ab87e00af", "value": "T183D55C13B289643FD07B1A3A49779654D93F7B213916CC8B27E4094C8F369427E2FA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785366, "uuid": "24565f19-b7c5-4ff9-912a-7294fce4fbec", "value": "d3916f4080c6c4161fee13cab333de44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785366, "uuid": "b39acd8b-9126-409a-b08a-ac5d2eb4aa1f", "value": "49152:PowFTputwqRcScF0hsG85LcmHU1TRwN5u:g6TpP9GscmHii5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720785366, "uuid": "3edc41ab-f07c-4f93-a264-0105ca6d2d24", "value": 2985096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720785366, "uuid": "92c4c0ea-1254-4009-9068-1592e49f3e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720785366, "uuid": "1b9860d5-a39e-49a8-b240-49859dbd933f", "value": "SecuriteInfo.com.TScope.Trojan.Delf.4490.30873", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a9953e-4098-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720820947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "4aae4896-f5a5-44ad-a7dd-a6fdf588c99b", "comment": "Malware payload (RemcosRAT)", "value": "0233b4ec1bb0b86ce25e1101620b5b90", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "99743773-7a0d-4f51-98ad-486b6ec63d31", "comment": "Malware payload (RemcosRAT)", "value": "e35f290abe0cb23deff221cb58026c8e27e0594361507df9ed095aee48c99480", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "cd84d9e5-b51d-4d40-b21d-7b77ce991416", "comment": "Malware payload (RemcosRAT)", "value": "9be1a169d206400bbecad6a90517b58d0bfdeeaf", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "0545e626-ebd4-4f99-a209-383d1ebb6589", "comment": "Malware payload (RemcosRAT)", "value": "98e87812ade937cc99e3b019004e626defe3a99e60bf821f5a8a075f52b12b014f1f7473ce0b8e80d9ada807e723407e", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "ef4ae906-d05b-4a4b-a65b-0454f712e8ec", "value": "T1A9B48D11AA91C031E8F71E300E2AEE72FEBABC5015214D6B77DD0C7ABD715407A25EE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "c392900d-287d-4251-bd58-8dc6c6b6ecdc", "value": "6144:X7BJulkWSG6QdqI2DBQ/l0/U6fsjLw84xToJs5iAuMcNDje104ZC7XUcyKTdc:XVJuKWd21Ea/U4sj084x8qVxZC1Zc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820947, "uuid": "436432ff-01d4-48ad-8a96-0bd14e7fcdab", "value": 525435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820947, "uuid": "713180b5-e61a-494c-ac68-b7b8a48f918e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "968f9d4c-3249-4340-9ff9-757f64b5c094", "value": "1720820945b98a33634332b5b04d2d5eefc45211062a00fb2a41a5d44d2d51e9cf8e375a78335.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b43d68-4099-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720821484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821484, "uuid": "caa50dfe-1f4f-4d8e-b4d6-96316eaa733c", "comment": "Malware payload", "value": "e5fb57e8214483fd395bd431cb3d1c4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821484, "uuid": "87a9e8b3-35fc-4f7e-a01d-e5619f1652b3", "comment": "Malware payload", "value": "e389fc5782f754918a10b020adcd8faa11c25658b8d6f8cbc49f9ac3a7637684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821484, "uuid": "aa2854c4-845f-423b-840b-7882e9d2003d", "comment": "Malware payload", "value": "60e22fc9e0068c8156462f003760efdcac82766b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821484, "uuid": "1357fd03-288e-425e-94c0-8da40f8a68a0", "comment": "Malware payload", "value": "baee664f44fbf170932671e718ae0447d92a30fc970aca7c854cdb20cfc58ea90b2292be2565ab14929169817ad634f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821484, "uuid": "c9af5510-a83a-45c2-81d7-03d48bf37842", "value": "T18FB43949E85301F9EE3101B130FA97F0BD2995143E2A2E37618CE55CDB584E4B9B26FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821484, "uuid": "273b794f-845c-4870-8d0a-f2701f2f182f", "value": "2cc68961dd8a09287e908343d46b30d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821484, "uuid": "2b9d495f-306e-45ee-8527-33acdb6f95ae", "value": "12288:zrUQw+2uPHL2hWsL94HPkH+oG7kSKT5T:wVuPr2hWsL94y+oG1K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720821484, "uuid": "99eb6b03-e403-4c54-87dd-a871692c3395", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720821484, "uuid": "ca21f94a-e934-4723-b09f-a7a29c85d887", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821484, "uuid": "cf370757-e280-48be-8d3c-81bf12e5aae1", "value": "build.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd346293-406b-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720801802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801802, "uuid": "43fe11f4-1780-40d0-829d-9d495025f31d", "comment": "Malware payload (Mirai)", "value": "2bb3328207c7641a83887aba3f3ce33f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801802, "uuid": "8e01410b-4b41-474b-86cc-b7c9385318cc", "comment": "Malware payload (Mirai)", "value": "e49efb1207f69778fbd11b7f5dc52aafb478d559c459f8cdf50850f9b967e9bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801802, "uuid": "ecf09466-dacc-473e-b7b0-f914dfaeac07", "comment": "Malware payload (Mirai)", "value": "1418198bc949c5760e18783a60ebe45d2d80e3a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801802, "uuid": "ca13838c-5da4-41ed-b4c7-5c6fd716d025", "comment": "Malware payload (Mirai)", "value": "ab4efdae761b0d665c4363a18b9c4e72a98621ad5ecb205dba001d8dda787b54ab399127a34e1ef357bbfbfb26d18ac3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801802, "uuid": "ece6685e-06ba-47c2-9022-f42e8db7eacf", "value": "T136934B32377A4A23C4E6643881E78737B3F79B851D30421B7A946F887F5AAD031937A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801802, "uuid": "bb66a183-86a2-499b-b9c1-8365bbfa96cb", "value": "1536:TMtmq5+UhAgowrSUt2Vz9o4OZBu1/AIt1D5NqeQCT5jSr:TTmow2UtmzC4b/AYNqzYYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801802, "uuid": "ead47c93-ceef-4a63-83af-be21fff3eb63", "value": 97254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801802, "uuid": "ba5d7ec6-12df-48f1-b03a-1fcaeaa948f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801802, "uuid": "9a01d593-7eb6-4ade-9a89-5952e49daccc", "value": "2bb3328207c7641a83887aba3f3ce33f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d9e806-406b-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720801790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801790, "uuid": "dbd9a5ec-0d7d-4e42-af0d-b259ac67311d", "comment": "Malware payload (Mirai)", "value": "0c9182b29ee29fa5ed67cfbffa46f5ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801790, "uuid": "df8f2b1a-d8a9-4a0b-bd24-8dfe4cd11f45", "comment": "Malware payload (Mirai)", "value": "e5bdb88a3ce55c20a6cba2b6c3c4516af183dc3cfcf7892614d8d4593011ff35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801790, "uuid": "479fa16b-de65-46dd-ac1e-1d50d8c431b3", "comment": "Malware payload (Mirai)", "value": "291f7fcff7623343a247d185154824e193babe41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720801790, "uuid": "ccd5473d-b6de-45f3-b8d4-73ba1b92fe61", "comment": "Malware payload (Mirai)", "value": "285b48e576fdbd0f71ec5fa094d7bd5c1111764ab3648711a773532f126aaf066a6d9dfe2c74b89f70e3ded36c15ee96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801790, "uuid": "7c02daf1-efed-4ef0-a511-bcd667d61a8d", "value": "T1B9833B0386715FA3C0426FB912FB8B794723AC714B461E34652A9BF80B43DCDBC997A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801790, "uuid": "32cf0df3-576b-44db-a436-a2f07611bd2b", "value": "1536:z+cWw6Y2m9QQRu/JMDIoNNPeZN5Ti0ugvp8lRR9/Psb4w:acWw6Y2mZMMD3TyNo0uz1w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720801790, "uuid": "c2c0828f-1890-4fd3-97b1-349bb7d9184f", "value": 81620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720801790, "uuid": "270ddf2e-cba3-4b14-a396-a018e081b219", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720801790, "uuid": "138febce-726c-480b-8e07-cd86182ffcd9", "value": "0c9182b29ee29fa5ed67cfbffa46f5ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982afd7f-409b-11ef-957f-42010a9c0016", "comment": "Malware payload (Formbook)", "timestamp": 1720822248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822248, "uuid": "ecb74ce1-2208-46ef-9216-6ae2b0362f87", "comment": "Malware payload (Formbook)", "value": "2f58ed4bfb0a59c7e32001861697886c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822248, "uuid": "850b3dcb-616f-4d60-bb2d-ab7d721f7c0d", "comment": "Malware payload (Formbook)", "value": "e8167dae28a414969cbe3535e3f37f496f44a94d41e3c0ca507a31091422b91b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822248, "uuid": "70e1c174-f6fc-40bb-b2da-cf225791f013", "comment": "Malware payload (Formbook)", "value": "8810970847a7a3b60b36cf1544be7cc4792ac39e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720822248, "uuid": "2627a611-c015-48cf-8e1e-5fbffcf9feb4", "comment": "Malware payload (Formbook)", "value": "20241bd7a1b5a316554b935843528760ae92815d4fe9b2bd59b3e53783c7b831cbc29333c9c953e6fc3542a1661154e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822248, "uuid": "2f0d31ac-72af-4265-b7d1-0788d7199bc8", "value": "T113050209719E4F01F9B10ABDE452DC405F71E457E9FBDBAEA5DE08CA2CC2745880A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822248, "uuid": "1c59fd06-bb31-4c0d-9361-12fa9d54bc4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822248, "uuid": "765e8152-73a4-421f-b81b-5ddfbe5607c4", "value": "12288:7C7sFwV7UUhYYQsYgAwZ6HB+J8uji8MiPsyYyAcNfDqcPHzTehM8h3:Od7hEsPLY+J8HTej1Nfx/mhMC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720822248, "uuid": "5b0593fb-25fd-486c-ba29-dc643e647236", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720822248, "uuid": "ef091916-1e3a-438b-aa02-bfd48dea0451", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720822248, "uuid": "1fab31dc-17a4-40ee-81c8-da5c684145c0", "value": "Inquiry Files QjbUlWXxzMnwc5Ik.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c69e1d42-401f-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769069, "uuid": "a6cc446c-8b26-4a2d-9d37-ebc6dcc0da4e", "comment": "Malware payload", "value": "21e09064406cbfd2b5375d3657ff7716", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769069, "uuid": "bd9a60e2-1547-49a7-b625-ee008ed3971b", "comment": "Malware payload", "value": "e99732e5237d7b5bcb003d8a3803b3b303389e1cad3770af468a7cb08f0ac723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769069, "uuid": "6c702a2c-b5d4-4e8d-b44a-1ae2eb8aac5d", "comment": "Malware payload", "value": "a90b400372e26c8774a710d8824a0c45ffefd6b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769069, "uuid": "ac149910-4871-44a7-be15-9c3425d827d5", "comment": "Malware payload", "value": "3fffbd8121219293a88392993eb160c876a5b462550d34fa317f4ee71fc672db2533c3823c28a2f8a41a51c074957f03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769069, "uuid": "f94909a2-8d9c-4e5d-a1fd-b625578b769b", "value": "T1A8C2A61DA64D0B6AE164D238C1990E1AF9753513D622EF4F42CBCB9B0F26252BC68F5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769069, "uuid": "a15942eb-ea43-49a2-977a-fdcdefb26e39", "value": "dd541279e16cdc39e194533eebfeea69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769069, "uuid": "45164cb4-2f4b-4294-92f7-4d688b26f7cf", "value": "768:hd2rdqHeiiA/RN0AVU0LxiPGeSkc0l0XHsG1XGMzSrMPr:hMiil0dkcUGHsGNGBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769069, "uuid": "e5b63ef6-7731-43b3-933b-a46a1cc0c967", "value": 27648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769069, "uuid": "6a2dfebf-39cc-4918-a51d-9ccf7dc44f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769069, "uuid": "be67c25c-db11-44e5-88b5-5fc10b743924", "value": "SecuriteInfo.com.Trojan.Win64.Meterpreter.15680.14001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27e7cd1-4022-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720770297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770297, "uuid": "e5d37ac9-f1f2-49da-8c3b-c26c75eb586f", "comment": "Malware payload (RemcosRAT)", "value": "957d64e4f6f9fd73176ea4a218026624", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770297, "uuid": "e2f75fd6-ce7d-4e3d-b84f-1caa30072629", "comment": "Malware payload (RemcosRAT)", "value": "ebab8d1c2d8ea94b1c9a4025ef1fca0f23e957ac68575f085731c7459d9bd16f", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770297, "uuid": "65d8306e-102a-443f-9962-6b345ef1b3bb", "comment": "Malware payload (RemcosRAT)", "value": "2a53d35c9eec815702514fe59b80ad762dc52a9d", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770297, "uuid": "ef964578-5f8a-4ba0-91e1-48134ba3bae7", "comment": "Malware payload (RemcosRAT)", "value": "b6af574ee47e14022771fb483fe35d0e93e2d159d38a1ca73571486cb9f06db1ac5c02fc758840307cffbc2837a5dca1", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770297, "uuid": "7ef91de0-7205-46d4-815a-f7ce80b8fe69", "value": "T1CCF24F7AB93D911A0945CFDA7EC5849CD71D02E260FA3EAEF489A1BC770264C9474C2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770297, "uuid": "54eda0cc-f746-46cc-b476-f72db6c3a082", "value": "768:bhzMKHJtZV0FakVhrbDA617P0yPyPUtHw6bOjy310Y0T9ZOfXq:b+KYhrzYyPgEgZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770297, "uuid": "79dcec16-172b-4599-ac94-65602ec63e51", "value": 35237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770297, "uuid": "9a9358b6-1d54-4dbd-9dc9-700ec46d1761", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770297, "uuid": "1d63c901-9484-4f1e-9f35-c36a88928618", "value": "I-MY-5323785035-D03395124_20240711081006.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26578857-4094-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720819051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819051, "uuid": "8bfd8452-e8bf-42cc-b53a-2a726ff5109b", "comment": "Malware payload", "value": "62bb0c12c38ed88d6de4e6fc5d769ba3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819051, "uuid": "f6bd7951-c0e1-44e0-80c1-709e5975d539", "comment": "Malware payload", "value": "ec6878c05196b2bd85796a9b69dd4d76e36f91b9220696a5a4a6f1633412accf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819051, "uuid": "1651117a-6949-437c-843e-723d927fabd6", "comment": "Malware payload", "value": "73282ff435b02089e9c776dd4bedd0d67a0582f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720819051, "uuid": "5e55219e-55a4-434e-b017-7e2983c362bf", "comment": "Malware payload", "value": "b1cb670f4d44feb99e19f878c658815c5ea7af141b3500930183056067155e696724d920925f9a300297ccfef9dd494f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819051, "uuid": "cf5f340c-5009-46af-b403-c29a2465b50b", "value": "T12945BF0273D1D022FFAB92334B5AF6515BBC69260123E62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819051, "uuid": "fc47c247-e428-4e85-aab2-119afbbdaf3f", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819051, "uuid": "c31a85c5-5053-41e2-82f6-b18ec67bf258", "value": "24576:kqDEvCTbMWu7rQYlBQcBiT6rprG8aXT2Sbly7TWEPje:kTvC/MTQYxsWR7aXT2dW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720819051, "uuid": "d12de989-7b46-4fea-9174-56a77971e522", "value": 1209856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720819051, "uuid": "29f5f8bb-f709-4311-87b7-3e06ca416738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720819051, "uuid": "71b8b230-ade6-4b61-a2e4-3827bc870382", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c387d25-400e-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720761589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761589, "uuid": "eef8acfc-5667-4710-be35-5cf239f96925", "comment": "Malware payload", "value": "6ba851cc03e6f322a451fb1f1a956e89", "object_relation": "md5", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761589, "uuid": "f8ff244d-2b08-4595-a79e-6a70ef5d1e44", "comment": "Malware payload", "value": "ecff0acf459c4bb96f466020e05b801f9f61bb86bde210bd384b15c6649895ad", "object_relation": "sha256", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761589, "uuid": "eeb48917-76f1-4d05-b8f5-8c27eb1cd4b0", "comment": "Malware payload", "value": "a4e3de3d2736a8763d1e566615ed781c7797a941", "object_relation": "sha1", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720761589, "uuid": "6eb1b21b-08df-4a3c-b7f7-dc47c0f39a7e", "comment": "Malware payload", "value": "970b721aa44658a86bb0abccff73b97f8a4fef0d09b4e8615944c2124f620b9ee7553ced1c2bffb9c514d11bc2d4309c", "object_relation": "sha3-384", "Tag": [ { "name": "teleservice-hifi-it", "colour": "#1CCF11", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761589, "uuid": "22e986f9-2341-4ac1-a3c8-150b39900068", "value": "T1C1A4687B51606DAE4A5C59B2ECE966B82E3077474D18C0CCAF5CE5090687D703BFE2CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761589, "uuid": "d52e665f-991d-4e6b-ab76-0f8dbf01f87c", "value": "12288:tN9H4yfcMepmhgtSjDKytApdYBZmhbbSbDYLwXWKvU:tNNdcMrhAGAdYWhybDq17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720761589, "uuid": "34308e81-e725-4e22-890c-6ff49e2e8105", "value": 485956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720761589, "uuid": "47e88309-73e2-4865-9886-61e35a1d9cb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720761589, "uuid": "95ed9628-250d-4878-986c-292b84e3aea9", "value": "Slvholdige.Bed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1b4f0a3-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789327, "uuid": "e5be4528-983b-438a-bf24-0eb1274321df", "comment": "Malware payload (Mirai)", "value": "0381a713819b580404ac7b80c1edf783", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789327, "uuid": "d66018b3-3a82-4131-a29e-ccd1cc496264", "comment": "Malware payload (Mirai)", "value": "ed19f235c464aa7750833ed8b3c1354754f198add233f4b63591e2d3b2edf079", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789327, "uuid": "c58f9a82-1ea7-444c-8b67-3f0769e6685d", "comment": "Malware payload (Mirai)", "value": "be82e59ed5ea9b79254c43b92fd3d277e7a0e4d3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789327, "uuid": "9d5ef3b1-1f8c-46f2-983c-c627330d1bb2", "comment": "Malware payload (Mirai)", "value": "3bb548b825a97437c792f9db93f71840e1b79c3371b2ef31b6948cc5413d58028d3d30b301728f6af1b2048422c520e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789327, "uuid": "77619d77-9e58-4915-b6d4-ad3face983c7", "value": "T183C35B3266792B22C1E5A53900F75B36B3F26BC92AA1820F7E710E8C7F156E030577B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789327, "uuid": "1e3c74fc-19cb-43b7-bbc3-1b3ea80f90a0", "value": "1536:E0b6mZfyZfJZ1fZ7BZ1ZTpwYt8mZRBW7VN6auZXYceowbHXqmDMgXBD4u4jxFrMF:+dxrZH2NFuZ2owjX/YABujxl3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789327, "uuid": "5663b8d0-f69b-460e-8ff5-96ebd581ca8c", "value": 123216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789327, "uuid": "3cc82f6f-290f-4cb6-84d7-583a3dbaa7c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789327, "uuid": "8f8cbe01-7bb1-40e2-87e9-3bd0749304fb", "value": "jade.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cda8f49b-4062-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720797857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797857, "uuid": "5f782f6f-28d0-45ee-a868-d85d0a162945", "comment": "Malware payload", "value": "17cb5e7840d485e866c74ab60ac5ee71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797857, "uuid": "a7697d99-54b0-4a47-89ad-fbd81f563d6c", "comment": "Malware payload", "value": "ed2631445a1136128d4317f9d635ec306bfb107c98306a3f4f10c3de378e6794", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797857, "uuid": "dffa0ee2-6933-441d-8f2e-c4e63f1da4ad", "comment": "Malware payload", "value": "551b0d0e0533b0c37b9f6399e9a6d26018540606", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720797857, "uuid": "5069df23-5c2f-4e4d-a432-7daa233810be", "comment": "Malware payload", "value": "198c65102f0183d2170a92814e076c65a5c152bf4946422d01104be2e2074e7a1ae9e9cd313bf0c706593cbfd4dbb3b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797857, "uuid": "f182efa1-42eb-4ade-b7a1-f2cf852236e1", "value": "T19C65B04A63E801BDD0BBD178C5576213E672784913308BEF13E086692F63BE16B7BB51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797857, "uuid": "a31cda7c-14dd-4408-8c1f-e7c2c45d3613", "value": "e7264a134a3d98488a9f33ba80c72bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797857, "uuid": "a93d4347-6a55-476a-b222-3060f63577d7", "value": "24576:Ma6HJkdFSGcjP19ECJs5W5gMUsmtWHDzzGC0thbiYNbzFkrRFIWSVnw6s4cz4Tjh:M+FSGMHlJs5wUiDzSthbiY6anw3TEHIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720797857, "uuid": "417d2693-2448-4e81-b947-44499ba83c68", "value": 1452544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720797857, "uuid": "bd48ec82-7b73-4dc2-bf92-ed5c96de19b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720797857, "uuid": "7a0ed68f-f9d0-43e1-8773-a8f99c95f296", "value": "SecuriteInfo.com.Variant.Lazy.457655.17268.24130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d32759-4008-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720758966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758966, "uuid": "d49952a3-9eea-469f-a446-474d9a1e0ab7", "comment": "Malware payload", "value": "78ae7185f18e2b1b736c6ddf3e18d002", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758966, "uuid": "d4bdeb8a-cb36-43ee-9087-92496957e277", "comment": "Malware payload", "value": "ed9cd3b2bb41b8f753e7679af0fa93b03589024670653d190393dce40a3d434b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758966, "uuid": "27fa70be-136b-48bb-9bef-d7cef42b9656", "comment": "Malware payload", "value": "87222e1c2f4557a1eef15854b455a54c240f8a00", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758966, "uuid": "62813576-7361-4923-ba58-5ac8e314c813", "comment": "Malware payload", "value": "2e5ee0e3fcac27a2eef82e52be4091b7ac332ea2c83fc0b0ef43d3b9f1dc17c75e2d3113cbabccec65a75ebf48dd0815", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758966, "uuid": "94eae6df-f3d0-40d8-89db-12fe8ac987c2", "value": "T190836B40B6E1C071D5BE1A315874EAA25F3DB911DED09D6B2B9A072E4F306C0DB31D6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758966, "uuid": "cfc1193f-cec4-4ebf-88fe-ae54bae9e9a6", "value": "3a6f75bdedca6f44f84ceb37433a6b6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758966, "uuid": "54a1b1fe-45b9-4920-8370-238d541ccffc", "value": "1536:Ran3zll3UIiCbVwmDnoojixrNd9VKAu+2SVdJssWdcd7dWvLN+ue:snhGzQVwmDVurAwJJ7dWvB+ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720758966, "uuid": "58603849-5081-47d2-a4ee-06fc0f9ac14d", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720758966, "uuid": "ad950e99-234f-4cfe-8acc-f73878bddfbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758966, "uuid": "04505cd4-da14-4a89-94a9-e60009029f5c", "value": "test.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17326a7a-402c-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720774358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774358, "uuid": "5673e0c2-589f-494c-ad97-08b82828995a", "comment": "Malware payload (StrelaStealer)", "value": "6ad16c4ee1a074a996722db3b867c205", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774358, "uuid": "d882735d-de47-4924-b0ec-8de5c4bd068e", "comment": "Malware payload (StrelaStealer)", "value": "ee568c46f6b4fc6aee4ee743939dd23d059a204f8724f8672c623827dd083949", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774358, "uuid": "1435440e-794c-4623-9267-977659f7c9ea", "comment": "Malware payload (StrelaStealer)", "value": "06c79289d9383d3b8f51c33a3c8b571e53315dc5", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720774358, "uuid": "e3206971-6ba6-423d-a6ab-814d7a430e18", "comment": "Malware payload (StrelaStealer)", "value": "15355ee8094bcb471b27e5d7aa4df5961523b166701d644bbd449d68bf8669c071e45185c1d83ebf432307f564e937b4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774358, "uuid": "e96dd3c5-0398-4139-be6c-048be91a774a", "value": "T13E412AC5B90E0F4B10A5D86136F5E2F260C9D6B2DC19D62A2F548C08DF7A96C158F52F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774358, "uuid": "bc754b4a-8724-4e34-aa47-f11370f8b869", "value": "48:wj5n2BfTyN7vxeVajrkxdYxIx3X66sxUd4xV0X66sxUd/HxO:U22IQjQ4Wq/nVwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720774358, "uuid": "540d71d7-18d4-48cf-8bc4-8eb547672f5d", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720774358, "uuid": "38fe90d4-818a-4790-b60b-a948fe9a2ebd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720774358, "uuid": "6b7669a9-369e-4c66-9a9e-4b95a321eb37", "value": "16181221881755428275.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f66e67e4-4022-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720770437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770437, "uuid": "a91a1ff4-e6ea-405c-95f2-53ecc4d8b076", "comment": "Malware payload", "value": "b9155f889c05c14680a465559a6a0533", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770437, "uuid": "3d0822d2-dd3c-4d44-bc78-aa1a6a7c8361", "comment": "Malware payload", "value": "ee747c55b99189f857eff129e990340ca49426b0a13ddc9cb42763561cbb403e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770437, "uuid": "cb44df41-a080-4def-a7d6-24ccb359d84e", "comment": "Malware payload", "value": "2cfb9826ee8697ada26686182c0cc17ec753bc28", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770437, "uuid": "f4ffd98c-62d9-42f5-88e7-68d23106ab67", "comment": "Malware payload", "value": "75d87d6e50827d21ddfcd298f35cc70f7983019947c9a2f817e5d78a9312d3ed5679c594625301c65238b5a56015c6fd", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770437, "uuid": "7955a9fb-0689-41d7-b853-942a8565e3c9", "value": "T1C64412267A42CA27C156A83D0EC8CF9BD715FC824C46C35B7984B70F88B78E756BB116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770437, "uuid": "0ceafe1f-a345-4f3e-9135-73939175b403", "value": "6144:ecUfDYWrWwUU3bvf7z3TkeIYxoxpaHMLhfg8mVA/p6TPt4/RYFpmY+:e7YWZT7LTrxoxEML9gvVAxdpUpmY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770437, "uuid": "73a018de-26ee-4de5-8485-3db6696af2b4", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770437, "uuid": "ee3d2130-a6bd-46b3-a410-a89c73bd81fd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770437, "uuid": "b15a5786-a428-44ab-afc1-301029c0abe4", "value": "PO63972.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94de9a4c-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769415, "uuid": "911b32e6-603e-4d6d-83a2-4eb559551bba", "comment": "Malware payload", "value": "12bc9464031f9ceca64d97b4ca200457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769415, "uuid": "ce567421-accc-48d8-8731-3acde4c41753", "comment": "Malware payload", "value": "ef635958b140f4bc9a7c7e70efd8d9462dc82107ad15d793d64ca37dd5f7fb97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769415, "uuid": "cdc7d083-ce85-4a4f-bfc3-2c727d754fe5", "comment": "Malware payload", "value": "68854f11dac5baa965e35a36f4f48b97de0f81e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769415, "uuid": "a5c2cce3-f565-4ee7-8a44-3111886632d8", "comment": "Malware payload", "value": "34721e822220b63483908e9b73512bd54cb8671e174d57dd56e252e28365e3bc6895f0965d9b8ad908683b75f7a65460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769415, "uuid": "b7d40926-92ae-4462-978d-c604a6774b75", "value": "T1F5A5A203B6A785F3D24D5B37D5E7441403BBED816653D60E3C8AB3AA28737BA8D21607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769415, "uuid": "d30d68d1-f2c0-4a4b-a9ad-d7a0b65e71d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769415, "uuid": "57aedc8d-38a8-4930-a4b8-7c8d1a04cc62", "value": "24576:/kjaodvp7niJrDHQCePGNiwpJgfDHvlwS69FQG9Telg51EykVl3a+V:+aodvpniJ3qH9S9Telg51EykVl3a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769415, "uuid": "cd0e22db-aaa8-407a-9419-3db89b000abe", "value": 2132992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769415, "uuid": "486da454-14ea-4eb2-983e-268db69ff525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769415, "uuid": "5523fbef-f9c4-49f0-9f5c-1251fdfba564", "value": "Purchase Order -JJ023639\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a137e500-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769435, "uuid": "6a43dee4-a892-4ce4-b675-95342e28c3bd", "comment": "Malware payload", "value": "7895fdc2c22724ff23972b8b94d6e234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769435, "uuid": "963620b7-86c0-410d-9a7d-258a1732ef58", "comment": "Malware payload", "value": "ef88e8601c42ff4f92154dd07ce31cb85941a04ff38319b128b5bd7d4408e216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769435, "uuid": "796ef2b7-b49e-4ae2-83dc-c0ab3b20b9b2", "comment": "Malware payload", "value": "6f6d9c97bf4fe3c37cfc58bbadfc178e4332979b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769435, "uuid": "9904c5d4-7173-45ff-aa57-44edd7dbd879", "comment": "Malware payload", "value": "e270d070490f84a5907f9c46083a49edda36ef554a334275d867c3ddf38df36d0d74cc8f8c5b672f8b3e6e7eedb7b4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769435, "uuid": "4814bd7b-c985-48b8-8245-b58ec9311b0d", "value": "T1F884A55976745532DD08CA3414F69E10C2EBEE6D2BE1921A25C8F67D0B326FE8F076C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769435, "uuid": "825ca7e2-288d-4778-b4c6-9824f5bf4c20", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769435, "uuid": "fd606619-e554-4f53-9156-551c272f9c1a", "value": "1536:OnAvDbdPTbRsFFL/59sph5sAa4jxX1PyjzvXeQDnKpq6Ly0uyr+fW:O69Tb+FFiFFX1PgbNiuyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769435, "uuid": "52fc8c46-ddf8-45cc-8f3c-881542fe1f89", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769435, "uuid": "5cb589b1-6393-4687-a6b0-db058ceb6615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769435, "uuid": "dbe1b736-8f86-448a-b7c9-bc38e7d6dd4a", "value": "Purchase Order No.JP67691\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea05e7b-4022-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720770397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770397, "uuid": "eab2e2d1-c8ef-44a6-8acf-984bd6954078", "comment": "Malware payload", "value": "ad3a57927668a9560b5f01d7ff54c881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770397, "uuid": "e1c69a5b-6b6a-41b2-b944-e5dc875a14eb", "comment": "Malware payload", "value": "efc2d3750186e0038a9bfb4e292298f92bce9f80d2af0a992a3e5fe0c9f29ecf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770397, "uuid": "4ab9aaf0-6ad6-4a46-932f-281b80fd08ff", "comment": "Malware payload", "value": "d0c66b9b5e5f58baff91f23f91a67fd3e8359662", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770397, "uuid": "e52d09b0-0be1-4334-a323-7605bd3e012c", "comment": "Malware payload", "value": "52a2a6020e2d4cce8b4fed5336f84388029e5bbfc9b7f9295b1551d64b184c29cb24ce23d2083fd52c5a95858ac0a663", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770397, "uuid": "d3809c4d-14df-4c95-9726-dca75e9bdb17", "value": "T1761523BEA3C9D877E1E312700B5905750BD25E166D98893AE7933CC8B737702AB6D306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770397, "uuid": "fbe2d2f0-adfa-44fa-8137-4043a55e0d45", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770397, "uuid": "037dfe9c-78d4-4282-a909-fbd7e1dbb3fe", "value": "24576:MGxOmgcf/CoFPz8s43+ae4Y9hJ9HFtMr6lLwLkM0VP90esL:Xx/zCoZz943+YaJNFtM+5wL3AP9KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770397, "uuid": "d867addd-70a6-4e71-b23d-7192e950974b", "value": 902871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770397, "uuid": "6d23846f-37f7-4600-8e2e-0be542276e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770397, "uuid": "565836ae-41cb-4766-8e62-db7f0edd377c", "value": "ad3a57927668a9560b5f01d7ff54c881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f47e98-403d-11ef-957f-42010a9c0016", "comment": "Malware payload (Stealc)", "timestamp": 1720781738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720781738, "uuid": "99f0422c-8205-47d1-98a5-5bed12515161", "comment": "Malware payload (Stealc)", "value": "f320a471da179c2cdb8f920a58d5a49e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720781738, "uuid": "7e13cbeb-b8a7-4780-9761-a242f5a1d298", "comment": "Malware payload (Stealc)", "value": "f085c6c04bb96f24fdbf974025a25ca0baaf01093996d5b8be8f4b03045892c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720781738, "uuid": "b77a8377-db5f-433c-b52a-d6a3e9d34f73", "comment": "Malware payload (Stealc)", "value": "c0587747ea1f01591f56df772436487759a56cb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720781738, "uuid": "d080653e-9036-45f7-9ead-2ae1236cff30", "comment": "Malware payload (Stealc)", "value": "95a29580b3e2bf521ccd9f64991aaaac46e7f689a4994c2e9be87f1349ffea0ea5d4f0a03c66e9d3859de1f4f951b076", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720781738, "uuid": "b07e2434-2a8c-429a-bd4f-71df08e6f0ae", "value": "T104C533AB2E87DC23FC5C16771FEB890428E8D1F6D057ECAC852F9083540AE5B9C99875", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720781738, "uuid": "05656ad1-2e91-4a9a-a8ea-157e78a4b2d2", "value": "001806c33a6e9fe5fbff34bdbd79b591", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720781738, "uuid": "9cf4cd7a-7393-41a7-858a-e9dcc5ab0970", "value": "49152:ua+frLou6hg9lGyMJt6ygLSfhJCddlHBf2RwrLfKIlN:efr8hclGS+JkdlHMwnf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720781738, "uuid": "8b229683-f0d2-42d7-88f2-05f473d57a89", "value": 2526720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720781738, "uuid": "5a421dce-1f62-417a-b7fe-415b392b7473", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720781738, "uuid": "357682d4-4fc2-493c-b326-23c7b9eabc42", "value": "f320a471da179c2cdb8f920a58d5a49e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c1d9fe-4028-11ef-957f-42010a9c0016", "comment": "Malware payload (CoinMiner)", "timestamp": 1720772611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720772611, "uuid": "eecbdb7e-4c40-494f-adf2-e09a70b5e441", "comment": "Malware payload (CoinMiner)", "value": "1f275afcba77ff0cdf1f005372b9d5a2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720772611, "uuid": "f68e564d-c6fb-422e-81f8-96349126a636", "comment": "Malware payload (CoinMiner)", "value": "f1fb53d5cb4ac03c4d5308c9ffa97b1c6515576d748fdf7de53dda95431da563", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720772611, "uuid": "823199aa-4bc6-4c1a-ae65-e20b6ebc60d7", "comment": "Malware payload (CoinMiner)", "value": "8744ca1b8fb95ac409f390a5d5446e6136b78e84", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720772611, "uuid": "6809f44f-c7b2-4cbd-a41f-bf0920fa7f31", "comment": "Malware payload (CoinMiner)", "value": "24ca57a9b97a4698e78793aedeeb593062c5dd77ee7ac142a487ce942ddf8ffb58025ce751bdea94d7747578490e1f03", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720772611, "uuid": "ece67416-ccd2-40f0-a882-e67dc92c65b9", "value": "T13AA40117B2B531F4E577813188E2190DE7B2B43106259FAF9394422F1F63AE15E7AFA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720772611, "uuid": "73eebf0a-0df9-43ed-8716-3de69577905a", "value": "53db49d2fb46e82ed5ab99b9e01fc563", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720772611, "uuid": "73811e7b-44a1-4bd5-a394-e37eb3986ced", "value": "6144:MVdR8JLyr+/YpneDiTCvJpgaB6iNJP5uUi1tycM1OIvbRYvccym9UYTXiZuYCAkx:mWJJ/r/vJfJgR1sfRYvcBZ5Py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720772611, "uuid": "87d77e07-c265-4b1d-ba4a-dee5fb8a62d1", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720772611, "uuid": "6b5d05cc-1ccc-444f-851f-35c00ab32ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720772611, "uuid": "6bef4109-0e6e-4e09-a39e-73fa0aa78b0d", "value": "SecuriteInfo.com.Win64.Evo-gen.9946.32114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906b6dc1-4098-11ef-957f-42010a9c0016", "comment": "Malware payload (QuasarRAT)", "timestamp": 1720820947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "ec6886d2-2b43-4b37-94c5-87572607f67a", "comment": "Malware payload (QuasarRAT)", "value": "d6f1f912dacaa6b532dd61717d56968f", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "a44b2af3-5045-4764-9ed8-ca288cf2f2f1", "comment": "Malware payload (QuasarRAT)", "value": "f29367c5aaa8559654d7f59088a109c836bed0433057675cb0f6233ffb4203fa", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "ccf1664d-b85e-4d5b-af82-2302c128fd28", "comment": "Malware payload (QuasarRAT)", "value": "3d85f4404b3db233ad4a919f569d21058e16d013", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720820947, "uuid": "5ae486da-16e0-4adf-b9a0-bb691a2fe25c", "comment": "Malware payload (QuasarRAT)", "value": "e845ada7a292706691c16c24ba7f6c1150b88b1c0bf9d470bbab62918b78b03af4795fd6615b95c7c8d47c0722202c8c", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "f06bb138-658a-4596-8417-49adecc8d5ef", "value": "T1CD847B2333A8E53BD2FE8735E03646149BB5D846B616F39B5A1C51F82C333869E543A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "4df5d931-3be8-43b6-b631-765fd78b963e", "value": "6144:wxlMJmfKcRnL+9+KxIUbCm9vUMNepbHTSSon11St16e:SkmxLM+Ju98wepiSo11Stwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720820947, "uuid": "13807bdb-d209-45ec-b2b1-cbda679996aa", "value": 371055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720820947, "uuid": "cf464c73-18e0-4cb0-ac4d-10fc5d80426d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720820947, "uuid": "af0de646-4736-4e59-944f-c22e204b7c48", "value": "1720820945b54245e2125588faf9e1894c8fa4502028d34a38be01a6e668b2eb6e01162603167.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d06a39-4037-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720779078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779078, "uuid": "0c62f729-8522-46c0-9089-e2afc212332d", "comment": "Malware payload (Mirai)", "value": "18ccd90d8e9c706ecfa5cf8300a31efc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779078, "uuid": "2439a714-8745-4e19-a970-634d5c5e7849", "comment": "Malware payload (Mirai)", "value": "f32986115b950edc74612c34c831b20fb38e36e9b890204e9fc95773d24c3b01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779078, "uuid": "495f630b-6291-4af3-b98b-ec00d3f50058", "comment": "Malware payload (Mirai)", "value": "b7ed952c3d3a838c465437e81f1e39260df13c33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779078, "uuid": "6aa661ac-7272-4473-a881-e9dd3252ad5b", "comment": "Malware payload (Mirai)", "value": "57976ac009189914b20b73f283c0b24c42c87c44e5e53700d211a14c5c377a5296c2a7995601ce3f5a93d6bc0e3ed469", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779078, "uuid": "a81db652-9606-43e6-841a-96bf99a58de5", "value": "T121635B45E743D5F1D80348716067A77A9B35EA338124EF6BEBC83D66AD32B12841B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779078, "uuid": "c6a8970e-cd22-4017-930c-9ffdf910f512", "value": "1536:DyFlXgkM9KYhon91zgf2gxKJ+Dy3yBuUm5PV7Uh31kV3/er:DKXgfKGon9pgugxKAGIFoEuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720779078, "uuid": "69758321-c8c4-4d0d-aa1b-9fb7f80ffe59", "value": 67612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720779078, "uuid": "684cf6b7-9e73-495e-80c2-d22c2c458658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779078, "uuid": "d14b70ee-074f-4960-a840-abe234a077b6", "value": "18ccd90d8e9c706ecfa5cf8300a31efc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597f416c-4015-11ef-957f-42010a9c0016", "comment": "Malware payload (Vidar)", "timestamp": 1720764591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764591, "uuid": "b44e7eec-7a59-44f8-9b78-535cd1742dbc", "comment": "Malware payload (Vidar)", "value": "51c75077bca69383b83b1c94c2406e05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764591, "uuid": "46632060-e858-4ea7-8812-7a6e90f9da0f", "comment": "Malware payload (Vidar)", "value": "f3f2ee666e572cea6eb5bcfd31fbfbc3b0edc9f99db528bb0a640751fb223033", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764591, "uuid": "8d171788-6a60-4b80-9fde-56886622cecc", "comment": "Malware payload (Vidar)", "value": "efc8d7ef37661dadc02171817ff344c84790683f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720764591, "uuid": "52133a2e-b7bc-4f9e-a56c-3a7b17d5fe4b", "comment": "Malware payload (Vidar)", "value": "ac560f25fcb85dcf40ce9f1afefe89fbc42490ee63cc9c66cbb0cf5a87e81e39398ab6b3a2cb02409f1f782bdf9860f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764591, "uuid": "f7cb4b7b-ec2a-4caa-a37a-b1f3662a7d27", "value": "T1C694F11175C18472DA73263608E8D77A9A7DB8700FB64D9F27AC4B7E0F70282973166B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764591, "uuid": "87a65a13-0a63-45e4-b243-0a4197aae208", "value": "54a5cf5c66bf4d0985703442865d04af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764591, "uuid": "4c053d35-770b-4173-86e6-4e401fd9c679", "value": "6144:LwcfOnB0WvTtMMR0Q+uGQ8n97bfrd1NFqGOGOwqGz5n3eU7FhdSs4ztWTH8S8EO:CnTvT729zd3RObwqGz5n3VFLqS8EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720764591, "uuid": "e9209ddc-e58a-4298-97e1-8ae0f6e6efa8", "value": 441384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720764591, "uuid": "ad242b4b-db99-446c-b066-fd2b2ac71a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720764591, "uuid": "8a6ca317-3826-4c9a-ad90-708db679a4ee", "value": "51c75077bca69383b83b1c94c2406e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb42ae0-4099-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720821347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821347, "uuid": "ab25ad40-1d06-491d-805c-38850f74a9a0", "comment": "Malware payload (AgentTesla)", "value": "d7795dff6fa856c81c43a23f2551a32b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821347, "uuid": "279eaf18-a6e5-4de1-a33d-e3b65cb18ae1", "comment": "Malware payload (AgentTesla)", "value": "f41147a2ce56a2c2013d366acd3561e17f0a84ca9c2c7ec866549a57282be7be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821347, "uuid": "380892df-8e30-4ebd-a381-5da78d0274ca", "comment": "Malware payload (AgentTesla)", "value": "4b103201bde4965e437e1d3ab5a53fbaf2569eb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720821347, "uuid": "f65679eb-0cff-4644-8689-6dc907cdeb86", "comment": "Malware payload (AgentTesla)", "value": "ffbe93cdacc2b5296f94572ee429f4ba064364f8d6cb7e2a71201444cf249b3016e5f8441537f18612f4790f2f445f3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821347, "uuid": "9905e534-9613-433c-9289-002b079aa7e2", "value": "T16435AD0273D2C036FFABA2739B6AF24556BC79254123852F13981D79BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821347, "uuid": "27a94f8b-eed1-4b05-a9c2-30f46aaac7fa", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821347, "uuid": "6c626c89-e728-4403-9cad-5e5e6bf11c5b", "value": "24576:1AHnh+eWsN3skA4RV1Hom2KXMmHaQGg6hG/tZ+j5:kh+ZkldoPK8YaQf6hG/tZK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720821347, "uuid": "c27ada0a-9296-4cfd-8b1c-6ec98cff8f31", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720821347, "uuid": "a914e0d9-7fe3-4074-9c87-d8493f7b198e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720821347, "uuid": "0ab0d0f0-7e2e-480e-b0bf-6e481eeff6d4", "value": "ARRIVAL NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b52b4fc-4037-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720779062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779062, "uuid": "4afab867-dc7d-4cff-b044-b3cae285d328", "comment": "Malware payload (Mirai)", "value": "587b7b67df79fb8b6d24f457fbd6bd1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779062, "uuid": "f239e3ff-7a66-45d6-82ea-fe6bbb2f2398", "comment": "Malware payload (Mirai)", "value": "f43062faa86bc7b203ecd922c9ce1b6ce5e1186b31b227fff163d2ed1b5ec978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779062, "uuid": "d9f3694e-68a4-44ea-8c18-6c23917b657b", "comment": "Malware payload (Mirai)", "value": "3b4e3a8b4b26f218709f6cb8be820e1fe333058b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720779062, "uuid": "ac041201-b5a9-4d36-9b6a-40bf91f07f4e", "comment": "Malware payload (Mirai)", "value": "e2d12bd458b5360463a789837bc265cb107336dba77bf72fdab1b15aae27dc6aa9a86de0a03165b12abccba3c8ed67b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779062, "uuid": "db07b7c6-ae2c-46ac-8a1f-47e5f288463a", "value": "T1B3634C45E742D5F0D80348B06467B73A9A35ED338164EE6EEBD83E36ED22B12951732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779062, "uuid": "55b8b2bd-f87f-4c63-a0a4-d21a7976905f", "value": "1536:PzLAEb6R1fXacGeExFx6Pj+5Uc27fp7Uh31kF3+Bs6ra:LLAG6R1vabeExFx6b+i7Euc7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720779062, "uuid": "caa9592b-e933-4fd7-baff-94583e547748", "value": 67612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720779062, "uuid": "ec92e986-27d8-4a2a-9d30-e96bcd336170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720779062, "uuid": "4f0bf4a5-3319-489a-a0ba-0a17c4ef3372", "value": "587b7b67df79fb8b6d24f457fbd6bd1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348d6516-405b-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720794593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794593, "uuid": "1e7cd62a-383e-480a-8d34-40b00298c6e2", "comment": "Malware payload (AgentTesla)", "value": "b0311e8b008a534cbdd26beed988f2cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794593, "uuid": "9ffd5e81-ec83-4a5e-bc6f-24f8acbb7257", "comment": "Malware payload (AgentTesla)", "value": "f46bd2742e3e04bdef45224ba44ddaad2d53a96e27dbdf042106ade0c91c4810", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794593, "uuid": "f873774f-f674-4ab0-9559-91748816a188", "comment": "Malware payload (AgentTesla)", "value": "32e9e1aef7406bdc37068b038e23d72d800921d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720794593, "uuid": "1800900d-4500-408a-a459-c68256cf2467", "comment": "Malware payload (AgentTesla)", "value": "3e2c126f0ed41e8d9f099af4d10ebd993c861542259926a2ef76257b323c4283fba99c8d46ee0beb41df41d960814528", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794593, "uuid": "abfb6d52-a507-4dca-abcc-b60b856200e7", "value": "T126F51268356B1D13FD83A439C6F032FA22FDADAB39F1890FDF910C9618455BD862A171", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794593, "uuid": "abb7ce6b-4adc-4da3-87e1-cf6a8b7ec8ec", "value": "12288:7kT9kiEwCmI5M0tpu8ZSmcPCDR0iOTtOZB4P+9mSp4ysMqBh:op1CnF7u0gpOYPM4yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720794593, "uuid": "49004b02-e973-414e-8fcd-ce9e28755265", "value": 3602466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720794593, "uuid": "4cfc301b-4b1e-4e15-89ad-d5717b54ce6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720794593, "uuid": "e52f6d1b-b64e-47c4-aedd-3e68e64ee2a6", "value": "rQuotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e5e194-4001-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720756176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756176, "uuid": "43c5e74f-3d2f-4150-aac5-983da0cea523", "comment": "Malware payload (AgentTesla)", "value": "a4ea8865bd6dd79b043ecb17fb1d1a64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756176, "uuid": "ecd588af-c81e-4a92-96c4-c8be7d2e8114", "comment": "Malware payload (AgentTesla)", "value": "f59e38b11dd3fe8892f365d290641c9198c4e86e13e4768f88f9cffa79d23d92", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756176, "uuid": "7716b921-c67a-426c-9590-a9313fb3108f", "comment": "Malware payload (AgentTesla)", "value": "e119480689a74fa32ea5c3bfba091b052595e6c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720756176, "uuid": "6f92e315-b6fd-4c3a-bba7-1b63f94944a5", "comment": "Malware payload (AgentTesla)", "value": "b5ebc476466714753a20401e56e413ca23ca16f93961c571d0a7cc516ec962f2b9c3db546d7da10f527bde8d7ddf43ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756176, "uuid": "f5214bd0-b8e7-4b2a-8570-828d7381b4a2", "value": "T16C359D02739180E5FFAA91735B55B20156FD693431338D2F12982DB8BDFF1A12E2DE62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756176, "uuid": "edc253ea-20d0-427b-819f-f846fd1ebf65", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756176, "uuid": "25cadccb-5e21-44c4-85dc-6a3cae8ad100", "value": "24576:0AHnh+eWsN3skA4RV1Hom2KXMmHaAB+8XL+YKsFdsg5:Dh+ZkldoPK8YaAB+87+YB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720756176, "uuid": "3fe84456-007c-47c7-a052-8501ec77d7f0", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720756176, "uuid": "0c9dcb9c-7fc4-469a-81f7-29de25f7782f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720756176, "uuid": "03545604-2aa2-446d-8d64-b4eaff345961", "value": "04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920e7407-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720769410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769410, "uuid": "0fb8f904-4c64-417f-92f9-1022bf7704cd", "comment": "Malware payload (AgentTesla)", "value": "64be6f04e7f7e8d42d679d956f67bad0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769410, "uuid": "79c6227a-9386-41c7-aab0-158746af2ab4", "comment": "Malware payload (AgentTesla)", "value": "f63ae4f827d5ea7078246a8ccdc7d547d0b275b611324a3354f0542a5e53974a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769410, "uuid": "e26fb033-37b3-4572-88c2-b1350c8a792f", "comment": "Malware payload (AgentTesla)", "value": "359dacbc078e8f62c62e94d02b60eabcedf8a33c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769410, "uuid": "8ead9432-5625-4c6e-87d7-5e5699d916b7", "comment": "Malware payload (AgentTesla)", "value": "a50f536a1952e9e9516e0878f1325e5dc86ad2495cff42d73dacef49af0ee99c8fd97c7e47a5b7b916f9c45536a1b499", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769410, "uuid": "75c4b73b-e329-483d-99ce-a5f949978897", "value": "T17E95120532B8A133DD14D63411FA9E5586E3EE1DA3E1E10D15C4BAAD1B322FE8F1B5C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769410, "uuid": "4e59a496-7e2d-4d95-b420-8db9c43b4151", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769410, "uuid": "4ef88054-141d-4da7-a484-38ee7ffc16c1", "value": "49152:62KBg75dlaAV57NhcMo7uD2aAdDXqlPy9c:Ug7F75hcnaAdDXey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769410, "uuid": "a34b27cc-fd4b-4e84-883b-528a561d4c6e", "value": 2054656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769410, "uuid": "5d30edf4-5a28-4724-9f05-9096a1995578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769410, "uuid": "bcd0cecc-1034-421e-98d0-399f8dc36c09", "value": "Vdwrlyyzu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fafcaa-4008-11ef-957f-42010a9c0016", "comment": "Malware payload (QuasarRAT)", "timestamp": 1720758998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758998, "uuid": "575af77c-1f2e-447d-9ada-a82d1b9c6146", "comment": "Malware payload (QuasarRAT)", "value": "367819f043e3d5e1eb40765ec4922e92", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758998, "uuid": "18b7a3f1-b116-46cb-b1da-b78f76d14116", "comment": "Malware payload (QuasarRAT)", "value": "f6bb7d923de66f079f048cd7455897a15ee8453735e448df71fbb62b5412f281", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758998, "uuid": "77797434-a2ab-4bbd-84cf-c2e02d024e8c", "comment": "Malware payload (QuasarRAT)", "value": "d0ffefa9a54d9b153aa48e237838753b4e7fe088", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720758998, "uuid": "3c6bb453-a4f8-46c6-865c-0ac04153c2f1", "comment": "Malware payload (QuasarRAT)", "value": "ee54861e65060795620c802dbbec577d2840598e28c569277cf5c2ba8834ec25f3a5b1c746f80da39c38a1dbb3d10d1d", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758998, "uuid": "2eec807c-dd4e-4cc1-9343-79533b9e87b5", "value": "T195B6338915DE40F5F9D02A28862B26DF33F156AA4D41CC2CA5C8BCC7BA76F757032993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758998, "uuid": "6974a415-4f44-4365-bbc0-cf726765b8c6", "value": "2ee54da00610fe9fdcafe491e9f44282", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758998, "uuid": "5a1e5710-477b-43bd-ade7-f6bc2b95c1a1", "value": "196608:4UH9mu33fuf3qotjCiO9H+wLeQtv45KLknob8OSLWBQ1VRWqlRrlKv0:33WvqotGX9tC1+knoSCQ1Lbi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720758998, "uuid": "dd182ec0-9d2c-4c14-94da-f1ef57927c4f", "value": 11414016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720758998, "uuid": "7749c6cf-f460-40cc-85cf-46822d730c72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720758998, "uuid": "74fc4c76-cfc6-48e8-ad90-4c81a045c3da", "value": "test_2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5bebad-40a8-11ef-957f-42010a9c0016", "comment": "Malware payload (RemcosRAT)", "timestamp": 1720827869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720827869, "uuid": "845e1329-4050-4e26-b6ee-32401c17b9b9", "comment": "Malware payload (RemcosRAT)", "value": "04a0409b44c06cd15f68cef8bdfc9b17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720827869, "uuid": "196c3fba-5d59-4806-8278-1c532640bd64", "comment": "Malware payload (RemcosRAT)", "value": "f6bf4471924e9dba31be59f8b96df06d02c69416c4c0518148507ff5b8f7cd48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720827869, "uuid": "ee253194-9de4-41b0-86a3-8cae62bdf65a", "comment": "Malware payload (RemcosRAT)", "value": "ec17ab0fb9a01fa208da02445056b68f30232520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720827869, "uuid": "058e3955-6082-403a-93f7-71352c532f26", "comment": "Malware payload (RemcosRAT)", "value": "205c1a4cd22b020ea12edf6f129819e46e1f97920ceb0114468da34dfc0b7bb57f4198e4edeba9fa379eb52bb6952c39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720827869, "uuid": "6693819c-aa3f-48a6-a8bd-c89be2a23a06", "value": "T1B625F09422EC2F42E0F94BF95675850087B7752A6A71E31E0EDD20CF1B7BF419A52B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720827869, "uuid": "8b31fcd5-216c-4ac8-8812-04f091296156", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720827869, "uuid": "0625b75c-3774-43c1-abea-4972262de034", "value": "24576:iLl1+oR/hMvKHTnJkRvxAMAvu2lHu6wRudqGlXSo:AZqVxAzvuOKqfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720827869, "uuid": "6f595f54-c01a-42b6-8a19-8a9c3f563420", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720827869, "uuid": "ac888aef-9a20-428e-9507-0366e537c9f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720827869, "uuid": "512d6bc2-9131-40f8-9d66-0c4559f3b8ee", "value": "PO 11072024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a8650b-404e-11ef-957f-42010a9c0016", "comment": "Malware payload (Mirai)", "timestamp": 1720789331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789331, "uuid": "4a0041f0-c7b2-47c5-8916-9a883ca7fcd4", "comment": "Malware payload (Mirai)", "value": "85aebab74882b0d2d2d72ab8d8206642", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789331, "uuid": "be6b60f2-4828-437b-a16e-7c0a00759175", "comment": "Malware payload (Mirai)", "value": "f7ca39b5c9f58cce9537a2731f4d57c8627d733c52ebe96d97fc09484a93d585", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789331, "uuid": "ae01ca71-3706-4585-8131-a5a8ef17373e", "comment": "Malware payload (Mirai)", "value": "ec86f9c3b51d1ce5927ef37243629d95716d468b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720789331, "uuid": "a7d839df-32bb-4468-b49b-848194157251", "comment": "Malware payload (Mirai)", "value": "953a64d2acdf9b195c32bba61f80c24500e945300e54645a944653371075b4d413e93e46b63f3245bc49101d59217749", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789331, "uuid": "acbb8bf7-7bd2-490d-8c23-66d6be123f5f", "value": "T1F323E6917DC2892ACAD423BBBA7E01CD332063A9D1DF7357C9115B147ACA52F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789331, "uuid": "103c9056-16ea-4eee-be22-b04586de3120", "value": "768:w5nu19xZL3IU4Q1ve43vBs9YrM3TYtvhIh3z+4V1SBxeG2aAzVDqNpqk0KK6Vg1/:w5nmDZLSWe4merMr3ZVmxPWzdqNpq2gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720789331, "uuid": "d347ff0c-4666-4035-83c3-1e0b8d24c795", "value": 47144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720789331, "uuid": "281d3dc8-fc0b-40fe-9767-7caad7eb9167", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720789331, "uuid": "d56001ea-cbf3-4d86-958f-942261de9ee7", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45852a6-4022-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720770434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770434, "uuid": "16d3e3bc-da60-449b-911d-f8513ac25668", "comment": "Malware payload", "value": "1afc535222c2830c2d2a5c89f32f912b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770434, "uuid": "4fafe017-ca95-4a03-8cba-59c1be72dcdb", "comment": "Malware payload", "value": "fb560b7437a93de76376b62e7f644306d76e3330737861bbfcc0e0c7b57d8a51", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770434, "uuid": "9c73294d-ca1f-4ffb-a012-0677c5186e76", "comment": "Malware payload", "value": "6b32e4dabfca480be9b83ca9eb496760a4277728", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720770434, "uuid": "9c596f05-2c9f-4374-a3bc-a95771986e93", "comment": "Malware payload", "value": "40f3e21048adf087a6da476a5108c800773d1e028e6ed8970118f17c483762805a826e1ca427f5341f49fd12ecb17fcb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770434, "uuid": "9d0a4b5e-593e-4d4b-ace0-1fbbfe635aba", "value": "T1ADF40142ED55CA57F25942355782DCD103EABE612F018C0BF6DCB79E2BB36708FA2225", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770434, "uuid": "8d280a80-fd47-4ae0-8dcc-845f8b10d86a", "value": "12288:c6Y+xn6YuERfsqucgGZuNaVLcqFzu4L0e8aunBS4XiAeMaIDmZntjI89GimRT8M:dtYgsqLfuNaVJzu4L0e8auINiRIntpDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720770434, "uuid": "2b7be310-2cfe-46ce-b781-809bf9625aac", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720770434, "uuid": "72be15d2-1693-48ea-84bb-9078ddbfc193", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720770434, "uuid": "99a80591-32dd-4df9-b68d-a7d8842efe37", "value": "MV ENISHI V.53Y.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dec5681-4020-11ef-957f-42010a9c0016", "comment": "Malware payload", "timestamp": 1720769430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769430, "uuid": "309ae35f-ead2-4582-ad3d-521d8a800093", "comment": "Malware payload", "value": "edea5cc4b28d85269d00c20ea2ab7e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769430, "uuid": "b70018c8-f878-48b4-83fd-bb2ac4738802", "comment": "Malware payload", "value": "fbb6c29a6b7df9a2b9b11451e325e85891a3371284cd9449af948de63fd0905a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769430, "uuid": "2c500d52-6ba9-4186-87c5-5ddfc07b3a74", "comment": "Malware payload", "value": "8e74afc38709798778f6ad08faaf933880e76676", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769430, "uuid": "e1f76bc2-189c-403a-8956-76c490bf351a", "comment": "Malware payload", "value": "c45cda912cd2fa51640e8416c9f71e1bbe3531c8273f907b6ea290de3d0825102e293d45b7de176a29b1010fb916eaae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769430, "uuid": "8bcaec36-f78d-45b8-ad1e-6705a09d9fd5", "value": "T10E74CA5A7674A132ED00CA3419F69E11D2DBEE6C2BF0951924D8F66D1B326FE8F039C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769430, "uuid": "311ca47b-7771-4594-8380-eb3cc99d1984", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769430, "uuid": "e683ba53-cfe5-4030-acd9-0d673fee7886", "value": "768:Fjx52Q720zEjss2Hcg1Ijcn0sspAlpq8WLyg1uMN0+dzsR8+eE0:FV52QLUWpqZLy0uyL+f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769430, "uuid": "24d141aa-8991-45e9-95ae-bad7df5147e6", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769430, "uuid": "533ed934-16bd-47e3-ab65-e7551dd3032d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769430, "uuid": "8abb8a9a-491d-44ff-b614-87531fd6417b", "value": "QUOTATION_MAYQTRA031244\u00faPDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b60dc16d-4020-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720769470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769470, "uuid": "f0cb5b51-40fe-49d0-89c4-6183b5f218be", "comment": "Malware payload (AgentTesla)", "value": "b0581bf805c96bfd96c3759eac648c50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769470, "uuid": "29f6433a-d0ab-4b22-a8a5-d9265fa671b6", "comment": "Malware payload (AgentTesla)", "value": "fc00b5da2a4a5297df5247d78b116052d7a984bf595c9f8f1423a6439c7670a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769470, "uuid": "6621f5d8-7770-4a99-ac44-a9d3702dd6a1", "comment": "Malware payload (AgentTesla)", "value": "fc533e48d7a61c304c4a7bd5143c2e92e12f7045", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720769470, "uuid": "3104c64b-77f7-4aa4-bab6-a6738d938efd", "comment": "Malware payload (AgentTesla)", "value": "749a26ff9e2e1a0a38e150dc4d9260d88c1c515b0cd91ba9d1a8d222b325855e954d2518e060ac392761ff48efcbe8f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769470, "uuid": "21db50bb-c645-4294-babc-6f849623f0a8", "value": "T16FA4E101B6C0C072D56325330DA8D6B99E7EFD700A729A9F67841B6FDF30282A731666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769470, "uuid": "1f13b288-e8ae-44bd-98cf-e1f982ecbc71", "value": "5909a34b719865b3b868121c17c6587a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769470, "uuid": "c4124171-86cd-4a58-979a-0abbd18f4930", "value": "12288:z2n3YQHQjwq2ArYyt01uc8TlAxlIF+zEpcUGLkBzEO:zQ3YQw7n01ubOAF+xoht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720769470, "uuid": "41f708fa-2985-4d6f-b01d-92a2a20f35d2", "value": 491560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720769470, "uuid": "2d6214fd-bed2-4565-bdbd-a70540e0779c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720769470, "uuid": "89ebc39b-460f-4ca6-9a21-adad90ef6c7b", "value": "signed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a64ef7-4008-11ef-957f-42010a9c0016", "comment": "Malware payload (AgentTesla)", "timestamp": 1720759046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759046, "uuid": "bdff1de5-41ed-4a6a-ac08-7d54439bffef", "comment": "Malware payload (AgentTesla)", "value": "9d10b8a649fd115c297d41f1f7a4b226", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759046, "uuid": "c107b012-88b7-46e6-a75d-9025799644a0", "comment": "Malware payload (AgentTesla)", "value": "fc4c4a671af565561ec3049912d3d278cb2f64f2c96332b4ea18a24abc3f4102", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759046, "uuid": "11e1295a-9b9e-4417-b25a-b5363198dc54", "comment": "Malware payload (AgentTesla)", "value": "3462a4ce08abe9a965903a8fbf0b7135328a008d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720759046, "uuid": "e052f23a-39c7-4cc9-8dd1-56a088070219", "comment": "Malware payload (AgentTesla)", "value": "9b784020d177e0f7efc5422fba2e4c71a8a9a0ee17b051d0edbcd38e7648347a187683a41845a42fd21b5f2943e9bfcc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759046, "uuid": "9c47cebc-6b01-4842-99e0-9545d2295801", "value": "T1C735AD0273D1C036FFAB92739B6AF20556BD79254133852F13982DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759046, "uuid": "e99408a5-28a0-40ce-8109-4fecbb9e87f2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759046, "uuid": "b9158f49-96e5-43d6-bde6-e92ec5575616", "value": "24576:MAHnh+eWsN3skA4RV1Hom2KXMmHaGLlg6C8vC7mVGcaA5:rh+ZkldoPK8YaGLlvCCL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720759046, "uuid": "a16a0d77-c44b-4332-ae59-3f0086f8ee26", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720759046, "uuid": "9d5d5df2-e45b-4ee9-bf03-d3e11dac7fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720759046, "uuid": "0e897360-47c4-4d51-acc5-478ecddbb9ad", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0da8a84-4068-11ef-957f-42010a9c0016", "comment": "Malware payload (Gafgyt)", "timestamp": 1720800412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800412, "uuid": "4309fe11-db4b-41b4-ae11-d9ec9d9f4b52", "comment": "Malware payload (Gafgyt)", "value": "b78c31b220aa950d6424952a161ea51b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800412, "uuid": "8e8d0e76-3939-4f73-a7d1-f12206480148", "comment": "Malware payload (Gafgyt)", "value": "fc75972048a6fd3c2446190d8a7e172e2480ba64322197172b1ffbcbce862b5d", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800412, "uuid": "9b404e85-0632-4411-9c37-e92fbff9875b", "comment": "Malware payload (Gafgyt)", "value": "f736b0e0542fbf4f4be3823628326daaa592a5e2", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720800412, "uuid": "5b5970b8-c429-4275-bd9d-0b97c5b32a30", "comment": "Malware payload (Gafgyt)", "value": "90c67b699a31017400f364515a19ccc39ad32a19971128074327ee7cdc6d86796a0032e96662b1dc8bb0816530ae5c31", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800412, "uuid": "27f0c9ec-a8f9-43e4-a1aa-7122e5f5dc1a", "value": "T115E3FA2B7921ABBAD05DC33107F7AF60D2A525E227E09245F19CDB185E3034E6C5FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800412, "uuid": "486fa38e-3944-47a1-ac20-726a0abf1416", "value": "1536:RfHzdMyCS+jLSuWMWvSHTGhPDLI149xGE+K+DsV4O9TKCn1YAOUlv5h20PF84mjG:1Vsj1eGpxsVhKC1nv5h2kmQ/5ApYDDn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720800412, "uuid": "9ceed1f0-93a5-40f1-9c0e-3e4787bd05ff", "value": 144562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720800412, "uuid": "15fc70e4-ff87-4db0-9708-7072fe7966cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720800412, "uuid": "25b25ab2-975a-4cc2-95d0-6cd34e0c7234", "value": "fuckjewishpeople.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cdc09b-402a-11ef-957f-42010a9c0016", "comment": "Malware payload (StrelaStealer)", "timestamp": 1720773542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773542, "uuid": "0614d6ee-3ee7-4ac5-88ba-a0c81e245e18", "comment": "Malware payload (StrelaStealer)", "value": "ba1fee914528c6a5fe382d45b5ad9e84", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773542, "uuid": "1f5d144a-7447-4194-a18c-10fe8cef33d5", "comment": "Malware payload (StrelaStealer)", "value": "fe058b4127427e79d6eef9dcb97fd2d0aae0964e033bcfac43b67a51ddd4a0c9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773542, "uuid": "e12ee291-c9e3-4a62-b2b7-4a6f426b4062", "comment": "Malware payload (StrelaStealer)", "value": "b27aa2ce3bf2dcea79ca1a01d55cf05d58c09068", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1720773542, "uuid": "37671eb3-334f-4b36-8173-d1569e9828fc", "comment": "Malware payload (StrelaStealer)", "value": "2e24d8bdf1a19f02627900193f72c0620fe4dd2c9ac392606a85c426e3c0758995751d6f9157cc43c770da6bdf5a6436", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773542, "uuid": "4b2e7c65-3f99-4fb8-8d3e-56e674b935ae", "value": "T1D74118D2D6EE64DF112925A837D474E5FFDC4479916087BE76E008CC839922929CBC12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773542, "uuid": "c4862f3e-3697-45bb-ad0f-2d370beca9bd", "value": "48:xuk33Qv7Z5K11Ip6L7N6xQCKrQZQ9S2809ISrJXQpQN3SpWWWJh2kSWWWJhPVQUs:xZ3385K11IpqNwYriASx09ISrJXSY3Sv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1720773542, "uuid": "9afdd263-8b93-4530-961b-85efbbec8f0c", "value": 2150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1720773542, "uuid": "3e22cbd7-f4f6-42d3-a7a9-772102ca533f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1720773542, "uuid": "01b47b9e-4358-4355-a0e9-68286f67acaa", "value": "fe058b4127427e79d6eef9dcb97fd2d0aae0964e033bcfac43b67a51ddd4a0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }