{ "Event": { "published": true, "date": "2024-04-18", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-04-18", "timestamp": 1713484982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "677cc2a5-4ba2-4f4a-a7f7-f01d65f6dd62", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd111de-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713450829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450829, "uuid": "9883b521-eefb-466a-9abd-2c5cc230300a", "comment": "Malware payload (AgentTesla)", "value": "df7ca854604bd4f2b015a33a0ffcf3ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450829, "uuid": "66c53cdf-45a0-4e75-8e6d-0b4296d20128", "comment": "Malware payload (AgentTesla)", "value": "001dc9607cd0bc84512d280d3531670ab506d343c8c95925cfceca29d8d0456e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450829, "uuid": "e2869810-c626-4083-bef6-58bfbf535870", "comment": "Malware payload (AgentTesla)", "value": "9edffd0c999381f0cb310ac71060224a46862a37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450829, "uuid": "99879a1a-28de-4ca1-9346-957879fd1fa9", "comment": "Malware payload (AgentTesla)", "value": "4868b7ae81ad200c27f56ffdd85dad61a2db1f9083d558c951f9d6726e8a035bf1f74522a0cd41f458a7f7b133155095", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450829, "uuid": "8cb97efa-24a2-40c9-ab35-ca24d07b041b", "value": "T1CBF42375FED1F5399DEC5820235A89F486FFA5D68AACB5C3F4A203342742D963B02B14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450829, "uuid": "10a92277-60ba-4a3a-a56c-6a54ebb31aab", "value": "12288:lOnWUVZtotrO2+G6U20xzW7sS8gOlL8j4JuL0bnd5BarEi/gr6oSa4XkbZXN:ovtotr//6U2wGsS8gOl8cuL0bnNPygrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450829, "uuid": "70d330b6-7a4c-4f7f-aaa2-938b77a98600", "value": 733064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450829, "uuid": "4b08459a-6b97-4064-9205-12cd2fa47b47", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450829, "uuid": "27921785-7796-4073-8cf9-f8f14cefcd3c", "value": "ScannedXfileX2.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e9ded2-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470621, "uuid": "2e009e3f-dcda-4d56-acf3-0120ab039d73", "comment": "Malware payload (Mirai)", "value": "72abe9606e12a63e70e684d3283bcb5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470621, "uuid": "183a1ca9-6c6d-4aa8-aa47-db003f0ca3de", "comment": "Malware payload (Mirai)", "value": "0042315a730caba4486f84457849a539907cd1a621ba8fbca3c49377c760d69d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470621, "uuid": "7677811a-3770-4234-9e2c-90ea3c3b20b1", "comment": "Malware payload (Mirai)", "value": "e12a9fb4e77c913d5a21470d065bf45b64e20294", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470621, "uuid": "bbcbc692-b4b6-486a-bb8e-b6b02e77005a", "comment": "Malware payload (Mirai)", "value": "eddacdf31fd5499a49e7623e41d9f341e9734b8f3a79d9ae0eeb4484246b8ebb7a8045446cca73ac20ae6008094f54bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470621, "uuid": "2bbeef3b-85b0-4a3a-8190-ccb98484c4c0", "value": "T126B3818A7F603FFFE81ECD3741909B06119C991922957FB76A78E408BA4710E59E3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470621, "uuid": "df52e582-1cfa-4838-8ae3-906c1ad73a4d", "value": "1536:As+ZpezWVoEFBnCIF+YHjfC1k6yNnkkjXS5GP8kQgZ9UbDrvq7sElE:As+2zWVhFBnCIYYHjfSkBkGXH8kHZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470621, "uuid": "37626390-b777-420d-9c32-988ec6af00d4", "value": 112312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470621, "uuid": "ae9bb624-02ae-45f2-a153-148452d91f2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470621, "uuid": "98c65441-94c4-4976-ab21-1a0100c1ae49", "value": "72abe9606e12a63e70e684d3283bcb5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71aaee42-fd1b-11ee-a120-42010a9c002e", "comment": "Malware payload (Metasploit)", "timestamp": 1713400480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400480, "uuid": "65752edc-2c1c-4e07-9c40-5499cc90401a", "comment": "Malware payload (Metasploit)", "value": "e217012532358c2ed66836108b1dbd44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400480, "uuid": "68507e5a-53db-4efa-aee1-f8bb631dea51", "comment": "Malware payload (Metasploit)", "value": "0052b0f94566b75d1456585a91ddce911c23000fd07189c8a8c6a43c84e42d4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400480, "uuid": "e899496c-945c-4ed5-9288-8add1260b93f", "comment": "Malware payload (Metasploit)", "value": "93469caf607a3b8200fde7261afbf96565da6e36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400480, "uuid": "761c529b-e491-4f6d-8bba-1ab2ed088476", "comment": "Malware payload (Metasploit)", "value": "797647a5b8c4743015fcd07aaa64407f1b02a61c44de2a1840c12d406afa4a1b1b48fac378be95794379c20980169f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400480, "uuid": "47dcb8ce-f98a-4130-aa31-aab768675cf7", "value": "T148D3DAB57B867588F91D9738A05266F3B3EBA3F30901CCA68EDFB224574847A444DCD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400480, "uuid": "5e456cd5-75c8-4711-b99d-fe2d0b66b813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400480, "uuid": "8db04698-b3b5-4a92-9c3a-08891cee91e6", "value": "1536:aAK20xwUsquvcbZNQfEYot4zDN4iKIAaEU6NW6mgGiPCIeVb8pzMQSJ7QJZ54Gdl:UXxwUsqzwEbFFaEUkTcg388n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713400480, "uuid": "aa027949-6840-4b4b-a450-e3f419cdd271", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713400480, "uuid": "d92a902f-93e8-4631-8c17-bd1fed6f5787", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400480, "uuid": "993de72d-3c3d-42e2-8bfc-718f1c8fc7de", "value": "SecuriteInfo.com.Trojan.PackedNET.2210.22049.14408", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b931dc-fd9f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713457119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457119, "uuid": "c3fc065f-e554-4d80-af6e-03d110d125ba", "comment": "Malware payload", "value": "3fd97c8116999264c370a1b7fab80ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457119, "uuid": "af89b447-48fa-4c1d-985c-4eaebc081c0f", "comment": "Malware payload", "value": "00e18b6dd077d1653a31266e11465e1a9c66362f35eff47c4403850de9370824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457119, "uuid": "6e35358a-b3eb-43aa-894c-3c8fea85e3ce", "comment": "Malware payload", "value": "24e252b05b0d1aeec39329784bbfc41a8038ad02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457119, "uuid": "8731a00d-9690-4636-a062-a18f2c670a87", "comment": "Malware payload", "value": "599a0ddbded72c80a628a9348bcd5ad46845a94a751e7a84491200c9742bc0f84485551abd561a12f3c48eeec2aca92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457119, "uuid": "d475914f-df22-47be-9f8a-5fe00c1b2653", "value": "T157759E1A7AAD24E8C1BDC0B587B74689EA71B8510761C6DB97D0DE160F2BAF03D3E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457119, "uuid": "e8aa04a2-ad9f-4426-81a2-ad07cfd546d7", "value": "c1afd4a5c38d1c84527cab10abe9e7dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457119, "uuid": "9dcc2c74-e0cf-421a-812d-3059b9323ac6", "value": "24576:ul0GQmAp9MMWuL+r0mBYnKOKCaMi5gzwUh0lhSMXlFTcXdAL7WPGCzOrS3ljH5o:d6U+AmWKO5VwZ0SwOr+F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457119, "uuid": "5555a665-7084-4cab-8f53-fb641e41337d", "value": 1658368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457119, "uuid": "5c3c2202-a862-4f3b-85aa-adce570e0355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457119, "uuid": "1e4addd4-bdf9-4bda-8e15-7c324d828b79", "value": "file.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79cdcc7-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713467196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467196, "uuid": "6e687f04-304d-4658-b401-a89bccd79f6c", "comment": "Malware payload (AsyncRAT)", "value": "fb5090ca9f961f02946ef0d3d5b8646f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467196, "uuid": "6ad82fd7-daf4-46cb-8eb3-883674029780", "comment": "Malware payload (AsyncRAT)", "value": "01f12f8f773c8b1b9aceaa069f261d2f1a768e969664e206fe8d84d06f028a27", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467196, "uuid": "72827eec-1086-4f31-8c66-74145c392898", "comment": "Malware payload (AsyncRAT)", "value": "eca31336c606d655506c7d382d882ca5edc70c79", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467196, "uuid": "95bcfb0f-5f68-4b7c-a8e9-4e321a4c38d0", "comment": "Malware payload (AsyncRAT)", "value": "41a7c0f87446b47565c9d3c75bfbf898d7e435007ba50511cf8e76977f8f669023f305229fd39523b5d6afccee51d3b7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467196, "uuid": "17a8f4bd-676c-42f4-95cd-bb3dab626b0f", "value": "T146D34D04FFAE4F1CDB04B1BC709106922BD88E668D777700A2DF6396AB332D6416275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467196, "uuid": "0dec4434-355b-40a7-b7df-d024af2e7422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467196, "uuid": "004f6985-ec16-49a0-b2a3-96da1dbd30a5", "value": "1536:keNuXrNMfAUWFMN9QrzY4M+d8iQTWd0uj9/SbSFCSsWmfqM3TT3Ru35M:keeNM5zN9gY4M5TFIcmHs3CsXUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467196, "uuid": "dec44136-bfe3-448e-9bb6-f81f3f6b4d8f", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467196, "uuid": "f533b08b-8bd2-4139-b2cf-698e92168e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467196, "uuid": "600fba82-c42c-4863-b01f-7acada082bec", "value": "hesaphareketi-01.pdf.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b23b59a-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713457485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457485, "uuid": "8eba07a8-8e7a-46aa-b9d2-fdaf49140093", "comment": "Malware payload (AgentTesla)", "value": "295a404300819daf0bdd42420d47d2fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457485, "uuid": "0ede38a5-a01b-4d20-80df-31afdab87a88", "comment": "Malware payload (AgentTesla)", "value": "01f962964317bfb1acb76ff5ed32d6e11df9f8459df92d6179b4f55a0222198a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457485, "uuid": "51ae8c85-8810-4d03-988c-16c444b7d397", "comment": "Malware payload (AgentTesla)", "value": "6bca96c1b6a7b15f544fbc92b96a11a8d9a39fca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457485, "uuid": "29200273-0bf5-41b2-9580-467eedf9d7e7", "comment": "Malware payload (AgentTesla)", "value": "7ffa76a73bb2de2c38e7ec393b061083f8de19ecbe1017e87a8648ad86835e6703daedf012d52fc131e0af8073217dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457485, "uuid": "fa284876-555f-4434-8f8f-1c58d4f97ccb", "value": "T183E4235A8BBBCB38B26C33D32139F946528A1707ECC92F3C06182704E965D5F5A767B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457485, "uuid": "125beba2-76d9-4839-990b-bd8bbe998c11", "value": "12288:G2quqWl77godZdya8WzUCklrK81xZPhtS95eFOTOU16sNEX:Fqk7DdZdzoCklr91jfSjeQaU1Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457485, "uuid": "ba018eef-ae4f-4d2d-b8f5-a0f7d1041d0f", "value": 667441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457485, "uuid": "1fb79ad4-8271-476b-82b7-e3553120220e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457485, "uuid": "6ffb0d5c-afa9-40b4-a9be-94a8b4d74b4d", "value": "Payment Advice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008d5e20-fd51-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713423483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423483, "uuid": "eb4bd0c3-4601-47d7-b678-eceef97a42c2", "comment": "Malware payload (AgentTesla)", "value": "7815fd6ba55681cf07f0bacde3279328", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423483, "uuid": "ec5b6208-1739-4b45-8b9d-4c295ed0e59c", "comment": "Malware payload (AgentTesla)", "value": "031e6c732ff72265f331584fc4cb4e0a212fb5974642f6af35f3aef75e227d08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423483, "uuid": "4ee46884-7133-46cf-a052-c07ccefbf01f", "comment": "Malware payload (AgentTesla)", "value": "16d179d0d9c46f6a304d4a70d0740e8f5457041c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423483, "uuid": "e4c95537-20dc-43d0-bf47-e3d5ed835308", "comment": "Malware payload (AgentTesla)", "value": "ce27426d1879b693df7925acfb2dbe2e8e8d033cbf4248f584fa32e790fa64e2960af247640f1e7d4424509f3f09a765", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423483, "uuid": "adcc513b-8c27-411c-8c0c-bcc320d1a19c", "value": "T12BF423E8A1134CEB16A29334E0F34C6C859A44629D39F46DFE6FC1B5CD16F680E9C46B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423483, "uuid": "a39a15de-e252-44dd-966b-48b5b671bf88", "value": "12288:kj1uz0C2NtFKeY7onp/OaK+T/aJ8gStaXH5KPLqL2Ys94tbaNpmDLEgiGbWj0sh+:kjKiNtUeYGOaKg/eX8Lq21UIpmDLEgiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423483, "uuid": "ad0ebf90-10b2-42b2-a983-c1f47b0900fb", "value": 737593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423483, "uuid": "12d6d738-64d2-4c58-a6a7-7c15cd13ccdb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423483, "uuid": "8ab15a0b-db4b-4166-87d8-13a766f07889", "value": "I-IN-6757165752-DEL983527_20240416074318.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71880e05-fd56-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425820, "uuid": "556d2cb0-576f-4086-9a53-39006206ceff", "comment": "Malware payload (Mirai)", "value": "d5cffec8b95a0bb5b2e88e71ebbf6e64", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425820, "uuid": "34ce6530-f161-47e8-8bd1-3fc92ecb7ab9", "comment": "Malware payload (Mirai)", "value": "0447946cd5232378c9f31be399f8bdb9aea13743cb12973484bfcc04d74c0fa6", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425820, "uuid": "48844e94-5a9d-4116-a59f-41e40c15fef0", "comment": "Malware payload (Mirai)", "value": "e81dc79de33af42ee6e9e489ae1305165649ef28", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425820, "uuid": "46657438-09a2-4c8e-b2a2-7e3def7e453a", "comment": "Malware payload (Mirai)", "value": "7f5aaca39837a756b272438ad3726f9b51343292b50531378a258b78ef6433b2ac34678c2572bf8868087656cc1eb2a2", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425820, "uuid": "7f3773cd-738b-4399-840c-f7bb04e6399e", "value": "T11253022F927ADAB4F06272B1163CC0D07CB56C7DB0EA9B5E291F12BDD47A59C2427231", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425820, "uuid": "620a005b-5453-4215-88ac-61d931ac9568", "value": "1536:Bvnp8O5QgjtfAGj06jzME2aZq6aDH5IHbiYIsHCI6zWVWAht4cT:B35QgjySn92c5kH5uV1Vthmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425820, "uuid": "6770b615-7ce2-45cb-a346-8c27202926c1", "value": 62164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425820, "uuid": "206a307a-65f1-453a-8b37-a99b4a424fe2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425820, "uuid": "5b640501-1efb-4dc7-bb21-f4ff1be94607", "value": "d5cffec8b95a0bb5b2e88e71ebbf6e64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04524a5-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713471023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471023, "uuid": "d1c22105-890f-4db7-b3b7-e83bf6341bfa", "comment": "Malware payload", "value": "94e81011ad6706d23d37a28e731e7e41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471023, "uuid": "37ce386d-df02-4550-9567-0c9fb494b888", "comment": "Malware payload", "value": "044993f15101e6bf7c4838a47655fbd9b829f55c73640376c0749284da336f26", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471023, "uuid": "3fc9d52e-5088-4cf8-8efa-c5f71b49bc3f", "comment": "Malware payload", "value": "cab5504de418a217370de13c5ae9a5eb27ffecc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471023, "uuid": "ebbdc5c5-f8bc-4414-99b7-2149ef781e18", "comment": "Malware payload", "value": "aed580cb3e248978082a67ce03cc77f9afeba63add469c3a2fddda887ab336ce8b5321f9447882019ae5d011f2c2185d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471023, "uuid": "b9a77b09-83e8-4633-8176-f34d358ed21b", "value": "T149B31B93F511D5B6F44AE73308D38B247270FAA14F53152263177BAAAE362D4386BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471023, "uuid": "1f0366fe-bac0-4c20-b7b5-25085dbfa0a8", "value": "3072:4wQeqacWucW0JcWcBeNX2WfKIwMI278ORF/qnFC3mzmmHqzTQKHKtW:4wQeqacWucW0JcWcBYmVM978Oao8mmHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713471023, "uuid": "8eafb2d8-03e4-4b65-ab37-fe36cdda0949", "value": 109567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713471023, "uuid": "7ebf6a12-48f8-4c79-8b31-9f9919de8bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471023, "uuid": "134c2f51-760d-4687-971b-96f0637b0cd8", "value": "94e81011ad6706d23d37a28e731e7e41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a08073b3-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713470996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470996, "uuid": "acc55fdf-0247-498e-9dcb-ffd9da93ee0a", "comment": "Malware payload (Gafgyt)", "value": "8781d1a7b47456b33a5293516eb58d28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470996, "uuid": "21c018b5-3247-4e92-9979-e8c7606ae75a", "comment": "Malware payload (Gafgyt)", "value": "046577e9c8a73fb45b09a886125b30937db7735830b548122d32a84affff0948", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470996, "uuid": "e0291319-6a48-413e-aa51-b2249ffa9726", "comment": "Malware payload (Gafgyt)", "value": "88aa2d13c6ff2b249352060308d179f307771d44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470996, "uuid": "ef84ef28-ea5f-4e28-8668-b3415ae951b6", "comment": "Malware payload (Gafgyt)", "value": "95ea1e042922ac67722b764c0099cbedab76b7947953e22c89efeff9aab4df82c29c1847fcdf3e2515f00b2bdd69e424", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470996, "uuid": "8456f0be-df6e-49cd-92d8-2aae6d87750a", "value": "T1E8831A46D3A2C5B3C4831BB605E7D72B0231F9164B2A9F0AE36DAEF47B12584719A317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470996, "uuid": "8a0bd2db-9060-4a73-ab1e-89146523ccfc", "value": "1536:L3oLQ5TCzSVYERb1aGy8gwi5vLMbBZzp6+m5CsNFPVYLf0:D8Q5Tv+U5aH8VkTMfp7mwsN1VYLf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470996, "uuid": "171c214d-5ad7-4625-8c47-f9f124d7a6e7", "value": 87461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470996, "uuid": "c6f2116f-cb76-4406-989a-99fb30c67e17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470996, "uuid": "9ed58267-d603-4316-936f-5cad2b7cb110", "value": "8781d1a7b47456b33a5293516eb58d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8116927c-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713424987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424987, "uuid": "06b253c3-d72e-4add-b308-04ab1f057f2c", "comment": "Malware payload (Mirai)", "value": "d86964c009edb530937030040a90e802", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424987, "uuid": "a3e4adfb-94d4-440e-9466-b7bdc9e74408", "comment": "Malware payload (Mirai)", "value": "04c64cbe02cf93fa9b81f9d3c9129dfe2bb702bf9ecc9b541c854ba933aa4bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424987, "uuid": "295ddf0e-d44b-479c-995b-60d0e5c7f641", "comment": "Malware payload (Mirai)", "value": "2c04e16b9ae160d72652ba9e2ee45cc27e590029", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424987, "uuid": "61523962-69e7-479d-b76d-f7b17eef791d", "comment": "Malware payload (Mirai)", "value": "1ad10d7d7c12cc4e422f33238636bbda8312afedbe0856fbbaf845966ae2c299fbca516969456b8afbdfdb05f5092c08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424987, "uuid": "1b72abcf-550d-41b8-bf7f-155210a4da91", "value": "T16863C81E6E168FECF79AD73547B7CB25964837862AA2C5C1E05DDA011E7024E340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424987, "uuid": "01fea9bf-f546-45d1-b6e6-1775b134b105", "value": "768:YGOe6SGZITX7DmBfpz/1CaFvwulyitTkdtTIl/xvGXDCPP7CTVVm6z4UaqAbH5CS:ifpzVFvw0ylUvzCTVVv675CS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424987, "uuid": "beec63e9-160d-40ea-b38c-9472ee59e448", "value": 68908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424987, "uuid": "8089458a-4f63-4613-a115-5a3f414d04e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424987, "uuid": "a25b70c2-16b5-495d-8401-893c822ed3e4", "value": "d86964c009edb530937030040a90e802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac19fae7-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713467150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467150, "uuid": "3468ed3d-9f28-4e39-92d2-a45cc0152807", "comment": "Malware payload (RemcosRAT)", "value": "301cae9576ee15a2f86fb974a8683d57", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467150, "uuid": "c8f45836-73fe-491c-997b-ca15cd723754", "comment": "Malware payload (RemcosRAT)", "value": "04e2b3bc57598265f2410a36ae3bea12b4b649bf9723db064ce2c297f2cff693", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467150, "uuid": "f55e5ae7-d9e9-4803-956d-4655e60f917c", "comment": "Malware payload (RemcosRAT)", "value": "a397ff4172a2fa6ccd1b11b2d4a07c74a5543310", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467150, "uuid": "eff759da-0eab-404b-b307-c7f53d9eb0d1", "comment": "Malware payload (RemcosRAT)", "value": "b5c15fc9c1badb7489acfd25dd5423048639c0e0876d0392f5a3ea9a92ac5e96df486d9e9136e7ee344fff54c4e3bb32", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467150, "uuid": "8b77c6d4-b6c5-486a-858e-9c55989ce65b", "value": "T150B3AB5267FA1208F5F7BB48A97611340B37BD9AA97DC64C05CC290D1FF3A848825BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467150, "uuid": "a5d9d963-3193-4bb7-94f4-75c5fd39e7fb", "value": "1536:cG2ctiU1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:cG2BU1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467150, "uuid": "0f4a4486-da5b-4063-b0db-03f2006b7b97", "value": 114380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467150, "uuid": "fa1ae332-6d2b-4d5a-b0f4-e7ff2fddb8f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467150, "uuid": "00de0d42-00e8-4500-a643-bbb6105f15a6", "value": "F723838674.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99180470-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713467118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467118, "uuid": "0413664c-9e66-4413-a67a-36e1b978a071", "comment": "Malware payload (Formbook)", "value": "9e049f3029a5a6df1ab5d77d1a934ce3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467118, "uuid": "c348440e-dfc0-4187-a33b-7396a02c99a4", "comment": "Malware payload (Formbook)", "value": "0831fee0915f056e6ca78e9a83a2fe75260a197c0d64e7a200ab8ebfc3479536", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467118, "uuid": "668e4e99-6681-4b8b-85d9-fd01439d2482", "comment": "Malware payload (Formbook)", "value": "a31e0f94e0ee4dba78bc8adc291e1035d48561bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467118, "uuid": "4cfcf69f-8121-45b4-8588-573baf349698", "comment": "Malware payload (Formbook)", "value": "dda6573561ff4aae9a448c026a502594c79903882e5fbba4973b30f39bf110bc8a675145afd10cf866369bda37be55e2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467118, "uuid": "d54e293b-1584-4850-8d8b-ad5c98e5e4d7", "value": "T1AEB3BB5267FA1208F5F7AB48A97611340B37BDA9AD7DC64C05CC290D0FF3A848865BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467118, "uuid": "fa84d554-3753-478d-818d-5fc8ff48bcd0", "value": "1536:Hxhb3QosU1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:HjQNU1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467118, "uuid": "5458e8b1-ccd8-44bf-97ac-d3e4b3e62b5c", "value": 114700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467118, "uuid": "7d01bb40-24d3-48c8-80bb-76caff6c2f4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467118, "uuid": "db866c9f-5e80-48c8-b1e3-3d5e0071755c", "value": "Signed Proforma Invoice 3645479_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3daf31-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713433680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433680, "uuid": "a49dea99-51ea-4d7f-9a52-84a6895ac432", "comment": "Malware payload (AgentTesla)", "value": "060b3cc850e2dfb5a5c92c944812afdb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433680, "uuid": "a18f8160-0fd7-4a7b-a4a1-163246b5b4e2", "comment": "Malware payload (AgentTesla)", "value": "0941f142c41d6ab0ff3f099848a94d56cb5291cb4f3c19dfdf010cd1aaeaf84e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433680, "uuid": "e1a53874-ed13-4520-b022-408d6e1c3430", "comment": "Malware payload (AgentTesla)", "value": "2822220784ca56bb5a4e5b14a4e9d35fd41897d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433680, "uuid": "03fdf774-ae3c-4f61-924a-eaf8ab8ed460", "comment": "Malware payload (AgentTesla)", "value": "cb955d531022e8f009927e2ae5a8e3a54f6e8fe5e69297f23dfda45b830bf22714fd7139da8d20074ba19f850d550cf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433680, "uuid": "6064cf12-9592-43f3-84a1-2b3dcfe07c82", "value": "T1E8B3AA0267FA1208F5F77B88A97611340B37BDA9A97DC64C05CC294D1FF3A848865BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433680, "uuid": "81030fe3-541c-44af-9aa4-4b03bd55e2cb", "value": "1536:rsJ+JsU1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:raU1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433680, "uuid": "78657684-a0dd-4d17-a51c-430566efc10c", "value": 111250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433680, "uuid": "3e11401a-b287-499d-94be-773d54eb1e18", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433680, "uuid": "000665a6-935e-41e1-9557-7c7f2507bd90", "value": "Price Quotation_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652debbc-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713433960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433960, "uuid": "f8dc7629-e5e9-4aa1-a058-e4054f9afdb9", "comment": "Malware payload", "value": "8371e780c2173fc24e446e2e7fd67b71", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433960, "uuid": "6d00d00f-9836-4fed-8ab2-97241dcc883d", "comment": "Malware payload", "value": "0a099402e509da1be34a4f0890c7d0c94f54f6c83df796f6966eff6d37edc7a7", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433960, "uuid": "35060826-398f-4eb5-8bda-7db8e1a77238", "comment": "Malware payload", "value": "4c93e5cc516740b71636403b91445e6fe7dc33fc", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433960, "uuid": "1cfc5162-4c96-498c-8eff-855794ca3487", "comment": "Malware payload", "value": "e609a0df75d650a802f506a4fb60bf15dabc4ef905d50888c42bc58184bb43276e42cbd776bbf03fc6e04cf25d4547cc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433960, "uuid": "9f51ed34-af8e-4ee7-9d94-2f44e17dbc57", "value": "T118946C60EE68066A0E4B279EFC911A92C5BCC219462710B6FEDD074E61075ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433960, "uuid": "b717c9d5-bdf7-4e42-902b-241468b9bc8c", "value": "6144:ltrc0iH9QXg0IE+oU8FyWtBVkmAti5ifCUpm8FD3hGnBXMVU:lFidQ0l4zS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433960, "uuid": "494461ba-08f9-4922-87e1-8c0c9ec3868f", "value": 413033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433960, "uuid": "0a039b00-cfc1-45f6-830d-b3cac3540a8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433960, "uuid": "65071238-de55-4c92-8280-3ed4b04313ed", "value": "SHIPPING_INVOICE_docx000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "084c04e4-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713430798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430798, "uuid": "1d9331b9-a74a-433d-8e40-0f5b30fb3d85", "comment": "Malware payload (Mirai)", "value": "11c90af56316343756efae37c61ae83c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430798, "uuid": "e9ec10b9-dfac-4d41-96d2-9cde8d357144", "comment": "Malware payload (Mirai)", "value": "0a90a30d17806caca645ec1655f0232f75c66999b0475c87bc7d698d9cd7da6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430798, "uuid": "fc100d05-a96e-42c8-a90d-7f4cfe477188", "comment": "Malware payload (Mirai)", "value": "30dab5242e7799ae2cc5864ebaeb1c6e2a02fdfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430798, "uuid": "83fa907e-c56b-4e10-bae5-89c8ff280b73", "comment": "Malware payload (Mirai)", "value": "c0b305ef234786244de698c3e4d571bd52bf456b6ff3b09a6b62bcd6bbb72c137697b03b93f91b850601922325705e7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430798, "uuid": "13b7a3a3-c8b3-42b5-9c0f-050a41c81d9c", "value": "T16643F172B41C85308CC30D79F82E6643F3529EF5D4AEA24616135A725FA36DFDBA8843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430798, "uuid": "9d04b297-b064-43ec-b048-912cd5008a99", "value": "1536:DfVPcxTjoptM6P7eEfgd716NYigTkDEc3kMTv:DfVECphTjId5kY7c3Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430798, "uuid": "7cbccaa7-5922-436a-a3ad-68865d4bec7d", "value": 57940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430798, "uuid": "bdc2d984-b4d4-444a-84d4-684d952a15d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430798, "uuid": "6055d7db-e884-486a-a0ba-01bbb543544b", "value": "11c90af56316343756efae37c61ae83c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acae28e0-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713471017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471017, "uuid": "d1f295bd-971d-489a-8506-8fd74b9aeb93", "comment": "Malware payload (Mirai)", "value": "9634adfcbf936c181b582eee76513eea", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471017, "uuid": "904a4155-3afa-4581-b473-0fa7dbeefef2", "comment": "Malware payload (Mirai)", "value": "0bf90fde92e3e91cddd522164a046848c4b7904c872d10e1bc1dede11cf28c86", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471017, "uuid": "f80e11de-c844-43e0-ac96-b1d9aa85daf8", "comment": "Malware payload (Mirai)", "value": "4be5ab4aba5f6f1900eb2110d8dd900e4fa7f0a5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471017, "uuid": "2f4b94c1-f52e-43ad-8326-40cc4e30845f", "comment": "Malware payload (Mirai)", "value": "18e09bb5552f0efc8d2081cffedba5914c681a6920f073b838523b265122852eabb5ebc293139759bfb349c01b6febe3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471017, "uuid": "99192c5d-0d8a-4e57-844d-642842a081fe", "value": "T183333B03A94140FDD485C1709B7FE533E935F8BD22397A4F27987E512E32E21165EACA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471017, "uuid": "1d64cf00-2573-4bd1-b05e-89fcacd5a333", "value": "768:XDm+JO9NDkdATbkd6bgiWsvvvtfGdCY7Mfk7PoHh5U4GkxEu+3hWROu3su:zEFZwrsPtfGd3L85lOZ+ONu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713471017, "uuid": "6413845d-b22b-4ee6-9356-84d235960c84", "value": 53912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713471017, "uuid": "64ff7ea1-dc05-4894-9f3a-6c76125a3292", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471017, "uuid": "f46a8cc8-cb85-4d0c-b9ed-032dc8be691e", "value": "9634adfcbf936c181b582eee76513eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531a16e3-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713434789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434789, "uuid": "69db59b8-80e6-461a-8f0e-f2dc02b7728c", "comment": "Malware payload", "value": "093cea37ce7081e85e587af5341a476d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434789, "uuid": "3f29fc2d-aae6-42e5-9af0-28794bcff2da", "comment": "Malware payload", "value": "0c445a88a2ae89f725c80d65a2c50f66a35619467b0a6b6182e543c7e504b9ff", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434789, "uuid": "9c7f6a1d-0c8c-486a-b3ae-2e5fc9c0bf69", "comment": "Malware payload", "value": "5295a6c48c4fba443b9d01ebec579eb8b8b3cccd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434789, "uuid": "24fdf2fe-71db-44b2-88e2-f7e6ca943edf", "comment": "Malware payload", "value": "ccc8d8e2246f9798a85bea106be4c1e1a0af19552a48ee374d194cb318f7ce932acb9e04658a2c50fd750570de94ad71", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434789, "uuid": "1ba6b4f4-2151-47db-b74c-eacc0effea50", "value": "T17E13DF33CE268452D64322FAB3031E0EDF37EAADA0917A593C4BB6D14D120BD0959E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434789, "uuid": "3f7763be-e9c6-4459-946c-a0bca453100b", "value": "768:LTG/l814gsxkX3bmsu/v2iZwatuNokSZDsYg4zcnGg8sfeDtOP8:LOlW4pobmRuiWYuNokkDsYg4zyasfO48", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434789, "uuid": "01ab52ce-64d5-4fe9-b21c-8e31125fad13", "value": 43714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434789, "uuid": "390c0a4e-27f6-438f-90aa-637f75f989e5", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434789, "uuid": "b65b5509-e3c1-4b72-bd82-fda4539b4bc7", "value": "\u5458\u5de5\u8865\u52a9\u6d41\u7a0b.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4e99ca-fd6e-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713436224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436224, "uuid": "6b0f9562-967f-4f4a-ad2e-ce29767d64d3", "comment": "Malware payload (Formbook)", "value": "406fcfbeda62270f779c023c4a22dbc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436224, "uuid": "336129a7-c673-4165-8672-78174a81e826", "comment": "Malware payload (Formbook)", "value": "0dbab91308f11720f979f402adf1d6c4e2d575a9fa5e0f4d30f550e7010f35ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436224, "uuid": "e7e7bdcb-e2cf-417f-aff0-54407333fd97", "comment": "Malware payload (Formbook)", "value": "c46ef48b5594779cc30878586b84080e32edb10b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436224, "uuid": "3a6b1f08-532d-411d-adfa-399906f03811", "comment": "Malware payload (Formbook)", "value": "a909a4d84b6ce36841fa9dfb2816fb6004246c0512d82fdfded17a60a1096fd3723ee55c3a82f638a025a0f39d75c7e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436224, "uuid": "d880d841-0614-44e7-bd34-fc708ae950d4", "value": "T1F3F423E92784EB55D1796FF51075A0406BF07A236070F34DADDA70CE19E2B82C32AA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436224, "uuid": "c31ae609-b907-4202-907f-8c9337ac93fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436224, "uuid": "e4292cfd-a5a6-44c3-a82c-b5b4da48bad4", "value": "12288:uLtK/pbM+RwwAFCXxP3u2x0xNGIQE6Vi6qrlgBOl1T3h8c3WbTDcuzortVeuD0No:mtiM+gCBP/2gI7ziO3ic34nxctVeuQNo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713436224, "uuid": "37a807ec-3bb6-4a54-9b8a-ee82afa3ed20", "value": 779784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713436224, "uuid": "dcc1e000-eeb2-426e-bf0b-c65a4675c04b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436224, "uuid": "640218e7-05db-421e-a00f-75c80c3e0c85", "value": "406fcfbeda62270f779c023c4a22dbc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff398f6-fd70-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713437065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437065, "uuid": "830c0bf6-e340-4f51-b774-053a0780249b", "comment": "Malware payload (Mirai)", "value": "abaa4f37da0b26277301b123b35beaf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437065, "uuid": "405d5217-e5db-4a5e-962e-4184f0326324", "comment": "Malware payload (Mirai)", "value": "0ee8daadbf174ac1826751c22228e36f20b058b9695ad8b99fa801c55203f1a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437065, "uuid": "ad241d04-19ef-4226-a83e-3e530af7ec9a", "comment": "Malware payload (Mirai)", "value": "1c29bc386346f1371369a6412321dfa10a48cc5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437065, "uuid": "05afb927-6ccd-4375-b069-1aa4ff85186a", "comment": "Malware payload (Mirai)", "value": "e15d372d71139643770f79dc4f71ab0f53e4f470b40f772aa15231b3706705652385f9f8967fbcffa27d64e95b766474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437065, "uuid": "3fb530f7-0552-4408-aa8c-ec69b43c0370", "value": "T16AF31A46F8819B15D5D211BEFE0E528E33131B78E3EE72039D246F747B8A86B0E7A505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437065, "uuid": "8620263c-bc2a-4656-9a5f-ec08f65c4a68", "value": "3072:jpalALWYTtZU+MJOZflAWdGYa1UU3KVS7YaSDmpHHop/:1oAqmZRZf2WNa15sSM3mpH6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713437065, "uuid": "6b564117-bdcd-4059-a3c4-68cebf288591", "value": 164860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713437065, "uuid": "7b9a07fd-5d4e-4232-9998-ee89b3f36cea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437065, "uuid": "677c6c2e-47a3-4663-b77d-d7b6890e064e", "value": "SecuriteInfo.com.ELF.Mirai-CFS.4575.1789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebf5aad-fd4d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713421816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421816, "uuid": "1991e1ef-aed7-4770-8a10-57e2b951e0d5", "comment": "Malware payload (AgentTesla)", "value": "2c62e05278b182250a15329ed6bbeaaa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421816, "uuid": "d9de2472-677d-4930-a6df-5f1a1cb43761", "comment": "Malware payload (AgentTesla)", "value": "0f2cec6e4a20f7017cbfb9144028fc3c865da826c7e40173128bd51ce91ac579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421816, "uuid": "3f0b1620-f1ca-4cff-9a3d-750e1bd18729", "comment": "Malware payload (AgentTesla)", "value": "e3f805348c387b55d68b9016fe3a1783e06bd75e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421816, "uuid": "e69019c7-7749-41a6-a7ac-e228f534d150", "comment": "Malware payload (AgentTesla)", "value": "76b6accb27e30aee16c4c7f8aad324edf41d7b73de362b5b0c81262eebd7670874bed32475e7ec278c052c6a6351b23b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421816, "uuid": "3d8940ab-e9f0-4b0a-b7cd-35e7538a92ff", "value": "T125E42326F9D6393D5C871702BD6470E0C8C2C87459E8296635D52FE96C3768F283E3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421816, "uuid": "5670406f-e875-4f6c-bcef-f96344868e84", "value": "12288:wK9eJ5i7Bz7Dr8ARWBXk/zEfDKtF3thxdWD6XnT3XU6rP:noJ+DgPByzJHLnLXU6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713421816, "uuid": "770d3160-7aff-41d4-9507-d5a67e06d7fc", "value": 669598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713421816, "uuid": "4db1ea53-5733-4a23-b2c4-372ccc9be025", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421816, "uuid": "d8015d5d-69db-41e1-bf15-02fe82232f0b", "value": "Order MJIMP 008.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b45dced-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713467095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467095, "uuid": "2556229c-3e21-4bd7-b75d-a242b3c21cdd", "comment": "Malware payload (AgentTesla)", "value": "dc5169142199ef547b0974b1f6914d23", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467095, "uuid": "176abe3a-e7fb-4d82-8977-5f817f8ea59e", "comment": "Malware payload (AgentTesla)", "value": "0fcdcaa33c4b5080270c25111312ed1e47304a895790e34c49d6702dcc636fad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467095, "uuid": "621da468-951e-45d7-8811-35b5d81d6329", "comment": "Malware payload (AgentTesla)", "value": "6b86d89a726a766278c77f4f79804277120409c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467095, "uuid": "ec948c42-0a97-433d-b719-2e29b0264188", "comment": "Malware payload (AgentTesla)", "value": "2c105d2280c8cc2d3ab80669e2e546c6fece85220f0e68ba4d252bde8c07618182101cbfb4bf7a882f8fbb94e9878871", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467095, "uuid": "82e7cc50-2162-426c-aad7-bf30e5301490", "value": "T17774362ED34E0269CB920273AA1B1E95A6FDBB3EB39051B1341C433533DDC6D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467095, "uuid": "dc5ab5d5-b5ee-4f3b-87ee-540a0703f255", "value": "3072:lsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEdCy/aZhKW:aKMeKMeKMeKMeKMeKMt3ZcW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467095, "uuid": "2e2ab195-fef4-4ca2-b86c-7ffdd5409caa", "value": 353136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467095, "uuid": "a8126afa-7003-4541-8cbc-8ba77e16830e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467095, "uuid": "7871ca90-b146-41d8-9d9f-c72f7dfaf889", "value": "CTM REQUEST BIRTHSHIP.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eb3c6b0-fd4e-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713422272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422272, "uuid": "482da991-3cf3-4a4d-ae23-aee7b7fb6c87", "comment": "Malware payload (Gafgyt)", "value": "f909283c98a062cab7a211bef08d2df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422272, "uuid": "9a42c6ae-c5d2-47fc-9a0e-ef76196fcafb", "comment": "Malware payload (Gafgyt)", "value": "0fe6907d659759592c770943084400476bf36cb8e838a721fbaf102855e08e86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422272, "uuid": "b212900b-3c87-4201-80c6-c16dd19d5676", "comment": "Malware payload (Gafgyt)", "value": "6e98c550e8492f477c273a62e4516be1a988c557", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422272, "uuid": "093be882-cd52-463e-a63b-d0204cfe1ee0", "comment": "Malware payload (Gafgyt)", "value": "8b04a02b52452d34a723b378e45347af4a9001cb904ebe9b4666a9305b44afd36540598b0f2f0a2be31c8e15e65ab967", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422272, "uuid": "4daa0cf9-31be-45f9-a536-9292815bba9f", "value": "T12114961E6E228F7DF268C73447F74A20A76923D623E1D685E2ACD2145F2035E541FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422272, "uuid": "deaa1ba8-d94a-4495-b4d9-934b06a67807", "value": "3072:2lX+erkC65A5K8iycU9WghkiBzkQjNloaWDGxej:2lXfIC65ABR9/z+QjYaWCxq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422272, "uuid": "1fd8b569-a96c-4f0b-9b5f-83c105bc109d", "value": 203652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422272, "uuid": "1939d9e9-689a-4eec-8427-3301391ce4d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422272, "uuid": "9a13c338-5d69-4252-a260-45d7ce232364", "value": "f909283c98a062cab7a211bef08d2df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594c4b4b-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433940, "uuid": "44d3a521-6a96-4ec8-9cdb-aae4a96f5168", "comment": "Malware payload (GuLoader)", "value": "f9058f637328281da4a04d7985dab712", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433940, "uuid": "ad947b72-6d6c-45a5-bad1-4737931dc2fe", "comment": "Malware payload (GuLoader)", "value": "106a7719438c51ae7357048b9f1261174440083b13c3f03e6cb1d4da8fd7b5e4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433940, "uuid": "cbdbc0b3-6911-4955-84e9-70aec5b6346a", "comment": "Malware payload (GuLoader)", "value": "abb9c005642afd789836ccbfdb917d8288685c92", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433940, "uuid": "d10be352-f5e8-47f5-92a0-a4b785af3225", "comment": "Malware payload (GuLoader)", "value": "e9621fdfe17a928ff37a5b260f485b4638338526dfe0d743d7fc9a39c8f97cb998d36df453e2547ee38a513f45190d8b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433940, "uuid": "b3c036af-c104-45a5-9611-523254fd132f", "value": "T1CA2408F08F0B36199F5B3EDAAC6449924AF84195051638B5AAD807EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433940, "uuid": "5c87d7b9-f796-441e-97b0-7c9697e6ba7a", "value": "6144:TYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfqqsf:Q2dOii2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433940, "uuid": "5520deda-0216-4324-9145-d93a432e37e3", "value": 210980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433940, "uuid": "3d6885e9-82b4-4a09-a36d-647bd8969dfb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433940, "uuid": "4ad47cfd-c4ed-49f8-b804-a96f88c45944", "value": "SOLICITUD DE PRECIO 04241502.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8044dc42-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433576, "uuid": "7a98183a-38d7-43ef-b030-054f3047312c", "comment": "Malware payload (Formbook)", "value": "defb451e344fceb19c3fa5ddd73a5ff1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433576, "uuid": "2b33672c-97af-4e61-8359-bdb8c13e2e63", "comment": "Malware payload (Formbook)", "value": "10b621b4a11e67967758d3213f254183bfc26abca4c6512473b23da4b0f50984", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433576, "uuid": "f02850f7-8232-4d1a-b2f4-512eea86dc91", "comment": "Malware payload (Formbook)", "value": "cd97753ee27426c3aaf6b62036f83c69a3f4e904", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433576, "uuid": "3f90ff01-1c4c-4a61-9584-602f0dfc87d3", "comment": "Malware payload (Formbook)", "value": "31d45e28c48097cb2487777757cb9e6f4028e7b11875af4061621c6957a81a6c1488ba8695c2f1116fb6d9a96afee1a4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433576, "uuid": "eee0d811-f6b6-42d8-87eb-1c3b622717fd", "value": "T1D42408F09F0B36199F4B3EDAAC6445824AF88195051638B5AAD807EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433576, "uuid": "4d97c1bd-7a82-499e-a266-df7cdbb055f2", "value": "6144:zYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf9qAn:w2dOxAd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433576, "uuid": "89fd3881-cf2e-4928-953c-1c06cd37da15", "value": 211239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433576, "uuid": "b5fcc10f-aecf-460d-adbe-0833f932d587", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433576, "uuid": "a306af71-85a8-4702-aeeb-d91a300aa5af", "value": "RFQ122.494001.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ed616e-fd53-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713424479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424479, "uuid": "bcdadc84-661c-4e6a-bf15-e89a77022b85", "comment": "Malware payload (AgentTesla)", "value": "d662626b1d361355212671b2ab5ccf87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424479, "uuid": "280ddaa2-daf9-48ff-ae02-fce0e4d82c70", "comment": "Malware payload (AgentTesla)", "value": "122438ba2e869e1413300117dece72a299981617a81fe8bf4e42cd833f06a888", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424479, "uuid": "ae001f3b-9e69-45c6-875d-53c2643ce002", "comment": "Malware payload (AgentTesla)", "value": "c367a995f90fc58731397c2698333a981784591e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424479, "uuid": "552ada92-ade4-4e7c-aa65-e4a394e5d97c", "comment": "Malware payload (AgentTesla)", "value": "2ecc18102696143e9fd654c9337072c066b4d2d98a8c1cdfaae9d492727c400e35d3abc69be9f457616aca6d4e7efab4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424479, "uuid": "7d81154b-bc3a-42e8-b2c1-3ec4bfcb9528", "value": "T1B035E23D1CBD1A3B9175C2AACFE98567F480D07B3A12AD2A98D383954346E9375C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424479, "uuid": "26337944-0b62-4e1a-8666-35a66772420c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424479, "uuid": "b7122c3f-9cc5-42ff-a7a9-8c3ba000f04c", "value": "24576:FYY3cLCgebzWOaOPWTyLncAw4xZtpPMTosCrIncW9saE:RMLCgeKOIXABDPN0x9JE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424479, "uuid": "f4870f2a-665a-4690-88c5-03c349b646b6", "value": 1060352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424479, "uuid": "c6b9b90e-09e3-4d0b-b6e9-edde0bdac499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424479, "uuid": "e5ba965b-d60b-408d-a95e-0fa748d7bab2", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5531befe-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433933, "uuid": "e1e5d238-05af-44e3-9062-e5a6f7e980a5", "comment": "Malware payload (Formbook)", "value": "09306e3d4884937ef15a686ee4aa1412", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433933, "uuid": "e9d4e80a-9fb3-4b65-972b-4235a063371d", "comment": "Malware payload (Formbook)", "value": "126e8204b6044a3bdb1d885cc462376377a3165d2c572de086baaa715f49ae9e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433933, "uuid": "a9ca0fbf-3202-40a4-ae18-46ac4437f1ee", "comment": "Malware payload (Formbook)", "value": "dbdd7b1b1829232b4ff385fa5b98b5c3d7553fe2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433933, "uuid": "5260a811-5b60-4460-ad5b-e30a13117f3e", "comment": "Malware payload (Formbook)", "value": "a79bd823956f9fdcc6c8b8bb74fb5eaddd2b791f1b5cefc1a61d5c0eb5f9bcb8d6acce0cfb5e94421b5e8142057d60d3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433933, "uuid": "3e7bef60-9cf0-43af-9d84-6995bcfb6654", "value": "T13EB33AE0CF4622252F071FE6AC1804664AB84696002195B7A6DF77F8F0D7E5C93FCDA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433933, "uuid": "0952ebfc-0280-427c-b1f4-b4d1635773c1", "value": "3072:C7UtxD30yAV1bePHvAVXJLlkGYmp47L+7OpkPWa2Ot:C7Utl0yAvbePHvAtJLlbJp47LSABa2Ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433933, "uuid": "7a1f57c3-4baf-4094-8c7a-2368fa2beddd", "value": 108398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433933, "uuid": "1e581d63-fb48-4bb0-b543-2b48ab03422d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433933, "uuid": "dfd87214-ef30-4732-a341-25afdd28cf61", "value": "Purchase.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94bcf8f-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450852, "uuid": "ef296cc2-ae8c-4621-9123-0310bab58c46", "comment": "Malware payload (Mirai)", "value": "4060d4b7321a31242757a9e10a5ca477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450852, "uuid": "735c9574-83c3-49ec-9e14-218563d261de", "comment": "Malware payload (Mirai)", "value": "136415a68341ba2706982ecd53af6531d5fe2bead73f5f6c42cd66f08a28327a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450852, "uuid": "c7952d2a-ca80-48e3-acdb-8a9178240769", "comment": "Malware payload (Mirai)", "value": "a7c6b9af470151804da1f84b3ac4fc401928e03c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450852, "uuid": "6adafafc-a8bd-45fa-8b74-0e743f4db08a", "comment": "Malware payload (Mirai)", "value": "1fe3deb36cc8410f7fcfb63e67bf9243691b44788358ea98aefa425e77855d77a2a0fa97872d6f088a364ae28a9e1b8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450852, "uuid": "a758bb60-3dc4-4a6a-a4d2-7f06609e1608", "value": "T18D04E81AAB550FBBDCAFDD3706E90B1139CC954B22A83B363674D528F50E50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450852, "uuid": "8e819673-dde5-45da-bf6c-682b4a9e1ede", "value": "3072:OeEksFM+wXnVaVB8H3NaMsTD+4pBU9k+r9KH/T:OeEnO+wXgVGdaMKDFpSi+8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450852, "uuid": "ff7dabf4-fb19-400e-9b68-6b71e10ef304", "value": 177860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450852, "uuid": "e94cb9d8-b9a3-4ef6-85a4-b221554afc7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450852, "uuid": "c9dc3a13-ff0e-4b81-a8c7-640a4637974d", "value": "4060d4b7321a31242757a9e10a5ca477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdfba19-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713467157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467157, "uuid": "b2dae24d-113b-4a79-a188-936e1e3ff8ca", "comment": "Malware payload", "value": "2a39b940d418af904e06668d69549235", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467157, "uuid": "d96bf3f6-02e3-41d9-aa54-106dc3349423", "comment": "Malware payload", "value": "14e40d63622fc055209c690ee208b2fb194b7310e51eb07c7c46d8ab2d85f8fb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467157, "uuid": "442e70f2-141c-482e-964e-037adebe199b", "comment": "Malware payload", "value": "92c9a2fe3e33ec0a354b6bbef94f39f2dedd8661", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467157, "uuid": "b54d9af8-cc84-40ee-a863-c645594f6640", "comment": "Malware payload", "value": "e833282a420ecf84fcabd7aeed33744bf3aecc962f5c5adb18e38d850db00fc7a27ba736730dfaca934bdf8272a8712c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467157, "uuid": "24d20ce9-965d-4cee-9ae2-3a99393883fc", "value": "T1B9B3AC0267FA1208F5F7AB88A97611350B37BD99A97DC64C05CC290D1FF3A848865BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467157, "uuid": "b94a6d55-3023-4bb5-a8e4-a5f2634828c2", "value": "1536:7/7PU+yhlU1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:7/Y1hlU1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467157, "uuid": "cd2eb5f7-4a91-47d9-97c0-8799df6e6368", "value": 114450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467157, "uuid": "69b5941d-de66-4f85-bf7f-2407cdffa997", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467157, "uuid": "6b4a24ef-b3ac-4922-bf72-f09b32f5d68b", "value": "Remittance slip.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32097d97-fd64-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713431727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431727, "uuid": "384b2b43-6c45-4b91-912d-ec1e59d2d7a2", "comment": "Malware payload", "value": "61728329516b48e684e53bf8c05c213d", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431727, "uuid": "ac68eb7e-2efa-4f29-8f30-7c842aa166c9", "comment": "Malware payload", "value": "15dc91b3d82d1cdfc355e3e43d6cb4bb163d9cb4aa7cbfb0eb6eb081d56fdc63", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431727, "uuid": "71ca36bc-8cc3-438e-aec0-7f632d5522a9", "comment": "Malware payload", "value": "5b1b9ef4cb22cae4e6ed7b8078049230e656796c", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431727, "uuid": "540f0a51-0426-4797-b2c7-17a40af5b796", "comment": "Malware payload", "value": "ff8ef10f7cfe5f0669a120d587355e11b163fb0b3915f1cdb75c14105fce6141f8c267cd63a029a4db666cc4add974e3", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431727, "uuid": "963ac0f3-d899-4207-8afe-7c0245ea5dd6", "value": "T16025223A2BA3BDC12B3F1B0571961E1E1C747E7F43A9529DA6D00C822464A64DF57CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431727, "uuid": "bcccb2bf-c3ea-40ac-a10d-2099cf13c1fb", "value": "24576:+v5KfSjcJKuGkfXQx/dl9p2VPqieAQ7jomNQr1CoD:FfcyXQH2PlyEMQr1P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431727, "uuid": "2711dafa-8150-46bb-90bc-bd342c1af0a0", "value": 1034319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431727, "uuid": "04299457-7819-4f60-a3bf-e21b2d41a521", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431727, "uuid": "0ae32fcd-fc7f-4427-a5e9-93289255dd75", "value": "product1122.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "795b138c-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425404, "uuid": "d04a71ce-d169-4c80-a39f-1d454118d547", "comment": "Malware payload (Gafgyt)", "value": "2a058e5fc8ee01c6e75397ed620ddef7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425404, "uuid": "0919909b-f1ed-4fc3-a3c2-71c267d68c1f", "comment": "Malware payload (Gafgyt)", "value": "15ee5beb802f1c06325b78bdc552d69fc869f8fcf3d7035e3fbd0b329ea55818", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425404, "uuid": "96fe7689-fd38-490b-8522-d8ebe3c848b7", "comment": "Malware payload (Gafgyt)", "value": "ca3694fbf8fed168f6fc859e7db9f102aa4e6960", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425404, "uuid": "b6cd41ad-481e-4325-bdf5-58957adaae40", "comment": "Malware payload (Gafgyt)", "value": "fad81342bb81ee4d5b024a7459a6eb089fd412d145fbce18625eb6332a628e62648ba0bec2722e0ed63a5fd0f61920b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425404, "uuid": "1c250523-5efc-4466-afce-0938e1f34933", "value": "T151F31824F5408267C2D327FAA69E838D3F3557E223D733145A389FB02FC2B952D66964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425404, "uuid": "45b497c8-66c8-4231-9faa-8b26f7ecf51b", "value": "3072:Bdy8WoZkeDGOvvlIAFZ3U5c0xkuQn3w5h1X7cKUmSQnNbGUBn:bZv9KBxkuQ3w5h1X7xUmSQnNbGUBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425404, "uuid": "c3cdc05c-2e0f-4162-ab7a-8bf512f52429", "value": 171215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425404, "uuid": "fc19d703-5bfa-4556-bac0-12b8d828966e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425404, "uuid": "52176355-7d0b-4a37-a7ed-d824970fa029", "value": "2a058e5fc8ee01c6e75397ed620ddef7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17349500-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472484, "uuid": "4dae39c4-7530-45c1-86a5-a066951c6614", "comment": "Malware payload (AgentTesla)", "value": "88e1a2d19bd93d64e6a3675c404bf424", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472484, "uuid": "5e8316db-0e4a-4e25-91bd-4c95897900be", "comment": "Malware payload (AgentTesla)", "value": "16b790ad37c38e92e2f7b102d2d622dd6a1e51f9614c72f404272536e4785be1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472484, "uuid": "ad7a5d40-3621-4fb3-b9c9-c9ec2657f2ef", "comment": "Malware payload (AgentTesla)", "value": "4199075cc9c375b7a1dd85ab701e5fab010136eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472484, "uuid": "0b6df8b9-0c94-40e5-8456-1d0572beef99", "comment": "Malware payload (AgentTesla)", "value": "e959b461ee0156bc2881c1ff665358ecbb8231046da4b1229141f007436532654983c4c63c5b97edce0301e60f710451", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472484, "uuid": "9eb36ebd-92dd-43d6-a1d8-b06d89dfefc2", "value": "T15E45AD0273D1C036FFAB92739B6AF24596BD79250133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472484, "uuid": "5f255b9e-1672-45cd-a9de-b9f9f7f19218", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472484, "uuid": "46b36dfd-3993-4ffd-8339-863ae653a919", "value": "24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaKBb6Nk8QWbVLjgT7gx5:ph+ZkldoPK8YaKJykiJLj+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472484, "uuid": "61867030-8fa8-4e32-b6de-de0bce538905", "value": 1186304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472484, "uuid": "5ba11f3e-83ac-4f35-89fc-4e707baebb3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472484, "uuid": "d88b84e4-cd3d-4b19-86bc-89dbe7eb535b", "value": "Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26686002-fdc4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713472939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472939, "uuid": "47b31894-df43-45d2-bc80-ae1e20a56731", "comment": "Malware payload", "value": "bb81a76867cdeb0ea988acd8b4253394", "object_relation": "md5", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472939, "uuid": "b8f0bbec-5a6f-4c86-969a-d4266d4fcdff", "comment": "Malware payload", "value": "16bc219a61e07e9ef91370950515a857290c0770ac2b3354a902f65824894316", "object_relation": "sha256", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472939, "uuid": "46d4e616-245d-48e9-8a0c-a56eea81b289", "comment": "Malware payload", "value": "26ae6a9e1f80f5f9a0f205c2e58fa15b53570481", "object_relation": "sha1", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472939, "uuid": "f665ef2c-27fc-4838-85b1-6a9cd151af7c", "comment": "Malware payload", "value": "60af25b886e11b2a8a9eb3f8efb7e221fb44b240b16a5a9e6b96322134e200dae67317a0c252fb1977b8bdfbd0424caa", "object_relation": "sha3-384", "Tag": [ { "name": "64bit", "colour": "#91D6E8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472939, "uuid": "b37eb947-cacb-4384-9720-17bf50d9a820", "value": "T1938592B2710CE398CC15EE30CB5A9A2E57D32C6F0750559B99B4BFA53E3A5A43217B30", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472939, "uuid": "fa80e8a6-7cf8-4918-b001-62abe8f3ad46", "value": "fde5069783a744f97063c1afd7b8a158", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472939, "uuid": "852cfeaf-6d8e-461a-9103-97e2d7379c75", "value": "49152:67aO+797979797979797979797979797979797979797:9Om1111111111111111111", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472939, "uuid": "b8db7154-c651-42da-84a7-914199e8ea69", "value": 1728000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472939, "uuid": "1ccd0837-409f-449f-8720-48305a23eff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472939, "uuid": "1f532a6d-8d5b-4568-a0e1-ec8091913389", "value": "derp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de280c5a-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713425144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425144, "uuid": "e8c3b064-9de8-4342-8573-08bc62c7bbd3", "comment": "Malware payload", "value": "24feda19d69151240374d56f2c1b18f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425144, "uuid": "e0ef7a40-7c53-4853-8b91-717f3e12d263", "comment": "Malware payload", "value": "1955d0dfb10928998c67d38b43fdd6da5c6660d9c43ffd58cda6d7a000c33824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425144, "uuid": "770bbc27-0d77-441f-b87a-5b084baefd30", "comment": "Malware payload", "value": "767cc78fd7cb6191695c69c8194b11339300bf8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425144, "uuid": "0a7e0a60-b5b9-4913-8797-8a23d38b9277", "comment": "Malware payload", "value": "da4a36a495ff45c28128ac250925790dc1e9f68030712e03e3d3660b15988e6050a8d3892c9492816366cb600e6b42ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425144, "uuid": "76c1ba89-0054-44d2-9645-22e6ad5d4dbd", "value": "T14214C303AADC7CE2C0755B3033BB97E0CB2DED6455A1C55F52D002A9DA7C1537A22BEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425144, "uuid": "5bfa3e57-f9b9-46e7-9db0-375d74371bd1", "value": "199cc4b7e51670cdce313b61b2b50d90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425144, "uuid": "67799137-a642-4271-8bc6-0629101030ba", "value": "3072:CWIDNbGER1YD0rHWeLmrzLHxzv0rQyTdQcuOo3CTqxvy5:zIhbdgD0ieItpctoZRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425144, "uuid": "c1893694-1789-49f5-81a2-2b3de0b82eea", "value": 205432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425144, "uuid": "19e79bea-300a-48d3-82f7-04e6d950d7da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425144, "uuid": "a5710f24-7ef7-4441-bc88-d7cc560628b3", "value": "SecuriteInfo.com.Trojan.DownLoader45.60142.11742.23845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d4a03f-fd6f-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713436407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436407, "uuid": "02660173-df78-4d3c-a935-06760707e4c5", "comment": "Malware payload (RedLineStealer)", "value": "258c56e9dd2ca5acffa10307c0dda380", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436407, "uuid": "9c06856c-5fb6-4c3b-994f-0459032923b4", "comment": "Malware payload (RedLineStealer)", "value": "1a64abdb1421c33d86351fe70b99f6caf3a6352ac9fb7b7f00cdd80d52bf59c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436407, "uuid": "2ac2a083-6fad-4c44-82b4-33779c6df9f4", "comment": "Malware payload (RedLineStealer)", "value": "57aaf5dfba84b0d92377bcbaf95f62c5e124242a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436407, "uuid": "4feef8ed-46d3-45fa-a4ad-917b64e40c15", "comment": "Malware payload (RedLineStealer)", "value": "196a5452df59310d8fcefa8079bb08777815ada94f4c9f0c5c51a717f86920ca599e97ba070c894a14bc82ea39338ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436407, "uuid": "aecc1248-17c7-4372-a451-be799e36455c", "value": "T10C45AD3263918326FFAB9D73DB5DB20D56BC6D250123852FD29C2F78A9F01B1122D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436407, "uuid": "062a4091-368f-4d11-a3af-f69af51ef173", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436407, "uuid": "b7f6e9b7-2912-41fb-91a4-3395e9318efb", "value": "24576:CAHnh+eWsN3skA4RV1Hom2KXMmHaKh/i+KXF95:Fh+ZkldoPK8YaKh/UR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713436407, "uuid": "d0dd2608-815c-4b2d-9f8a-a40c66e6155b", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713436407, "uuid": "26f784ec-c3c2-466e-9a73-3b7672722d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436407, "uuid": "a9b946a6-f079-4153-ac46-2a825b144c48", "value": "WZM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea3d0cf-fd70-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713437063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437063, "uuid": "bafaa99a-7384-411c-b1b7-4427f9251451", "comment": "Malware payload", "value": "269a3d770289d6442ad0b01e03276a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437063, "uuid": "bf68f074-0c6d-4348-8d3e-d656a4ab2bc2", "comment": "Malware payload", "value": "1b0a15ce9c6a24c1d420956e45110f25170fd2bb8c2fe1269f36aa43c40b59aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437063, "uuid": "afdd60a2-c888-4be4-9c6a-0c8280168ee7", "comment": "Malware payload", "value": "f17b37bbd0e328f1187af8c962d46aca5fc2b021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437063, "uuid": "55ae8011-25bf-42f3-91ee-f843f1f29ee4", "comment": "Malware payload", "value": "ddda5e60b75368c45f0861d7adb06450d39f21d9e64e1ca4f8b8da1a3b8df56456b831ea2f21eff64b01db6010e06475", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437063, "uuid": "89d6a747-a4dc-452b-ba21-cd2bbf98bb08", "value": "T1A9F47C02BF834CF5F6986430155A6736993AEE210AD58B83935CDE3D18335A1ADF633E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437063, "uuid": "5543d7e2-e2cc-4044-8be3-ab1606987d0e", "value": "4ed9366b5a0bbd2ec353460afdd55ba6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437063, "uuid": "d3df7ea1-5fb9-442d-b1df-78dc9734740b", "value": "12288:K4AzttgbhCMCtTSb1uuH8fu2l6heoBPQED6lsKnsXLW:K7jgbhjCxShjHqLl6ZPmsKsXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713437063, "uuid": "080052b7-498a-4e3a-8731-a136df7d3a02", "value": 760224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713437063, "uuid": "89102d1e-3f52-4d27-ab2a-6977749173d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437063, "uuid": "bac0bee3-8734-436b-abd0-4c2771122ebf", "value": "SecuriteInfo.com.Win32.Evo-gen.28931.17898", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d743487-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472494, "uuid": "f5e757a0-b29a-4e91-96dd-4afa3407c382", "comment": "Malware payload (AgentTesla)", "value": "fc072ad878c457cc3573eed1ac7f42d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472494, "uuid": "12db7999-a0dc-4214-a5c4-47ce0ef21557", "comment": "Malware payload (AgentTesla)", "value": "1cc876f7fdf48e3d4eef30530881b55d8a6e97e2e66d6d7a289932e458d22709", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472494, "uuid": "6c93ba56-e00c-46a2-b299-5b500a84cc43", "comment": "Malware payload (AgentTesla)", "value": "1864db4a9791b7d8fc40693d208785a5e34a9a6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472494, "uuid": "976a2fd2-3732-416c-a399-8c2467bdd06e", "comment": "Malware payload (AgentTesla)", "value": "c28775f4e7f751e8a2478d5f2b6fa0c4d3e1b00b86b59b9f7fb277a1600df19192d81f8e01af360701fe26710fb600a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472494, "uuid": "19d1f133-bf5a-4157-a1f9-707a0a5ff6c1", "value": "T1F0E423D280F67CB0ECDCC42F84C696ADBB193D96850F3A879C7A6673D2D118F9952B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472494, "uuid": "f8f903b5-a02c-4826-9c2a-a0e651392907", "value": "12288:05voq8GuxhkY15McquqS+kGwrHDQUUmxHcraOnXuEioy:Kf8GI1qS+bwr7UmFcrzXzioy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472494, "uuid": "ae792a45-800a-480e-be36-a4389b44c4fe", "value": 662979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472494, "uuid": "b8e84ea5-7690-4c65-bbc0-68251519579c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472494, "uuid": "6b6fff4f-974b-42f3-82d3-2ec5d606a6b0", "value": "Quotation A-L1939 Master group_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34c8014-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450842, "uuid": "804ca490-92b7-44b4-8a3a-eb586d6b2a47", "comment": "Malware payload (Mirai)", "value": "cda551500e5101453d334f4daf3897c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450842, "uuid": "a4c86663-0401-4ca2-b524-21a5aafa4a83", "comment": "Malware payload (Mirai)", "value": "20763f800034ce169e21e79d3cf9d11f61e86905ad8b0c516b354f9a3a2ac97f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450842, "uuid": "fecf42dc-3225-4a0b-93b3-db6117c10d50", "comment": "Malware payload (Mirai)", "value": "523150722816ab01596bfae79fe99bae7e393602", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450842, "uuid": "f7f22150-a7ce-4b97-93df-dc3db2cd58ba", "comment": "Malware payload (Mirai)", "value": "c4adda7c5af079d5f197e5467663579d197a3c2fa7d9e43d24d35f5884c29a92ab38bda31c04a2f7448f610fa869c2ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450842, "uuid": "6ec5bdae-f15c-4aa8-9b02-3f5702e75275", "value": "T1F9D3F845FC405F23C6C612B7FB5E428D3B2A17E8D3EE720399256F61378A95B0D36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450842, "uuid": "9c0356bf-b043-4fd3-b849-754bf52780fe", "value": "3072:gHZ+Hko5xFOV48wlPRfYRXaPu0ccKOA9LT8iH4:gHZrSAV48MPRffU938iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450842, "uuid": "9dc1a88c-91f1-418e-8403-c9fd6b59cced", "value": 133888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450842, "uuid": "926c4a3b-ef6a-494c-b56e-4495c4e5a78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450842, "uuid": "83f23115-31c3-4363-8301-4398c795829f", "value": "cda551500e5101453d334f4daf3897c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9661e6-fd9d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713456546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456546, "uuid": "b4ffca8f-2a0e-4ee7-ad1d-1132df540cbe", "comment": "Malware payload", "value": "63b1480d095ac1f3c72d8042b353003b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456546, "uuid": "02db177b-df8f-4d74-aec5-7c8de80959bc", "comment": "Malware payload", "value": "20eb6598deab754084917a5237db453af904a5dd6f445934e98d9ebead0f9287", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456546, "uuid": "a6fda608-9e27-426e-ac30-513a53533ab0", "comment": "Malware payload", "value": "da8945b6395ef221a17561b991d5faf7d9b4d20d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456546, "uuid": "daeb6d8a-5e6a-4889-9b60-1b8addde5ef2", "comment": "Malware payload", "value": "8ad828e6bfda4c399ebab5e63c162e1e5f45b7ff2080dc6191ed0c246845669af7d5793666d466a25e361410e7a4252c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456546, "uuid": "239b09cb-a479-431b-8128-be2dd0356590", "value": "T1FB21D40507EA2731C2B3853A24BE9722DE757905DDA7AF5D029513946805641FC64F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456546, "uuid": "79343148-1ce8-40e0-913d-67e7237039c3", "value": "24:8LaEkDmgih41Av94zcuhJBkr+/4wp+8Pxud/aW28mT84abtl868z7m:8LadDmCC9AJN7gd/Rn4a46q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713456546, "uuid": "71764e99-424b-41b3-9e23-dd127feef130", "value": 1123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713456546, "uuid": "1a5d7a12-6a38-4d42-adbd-e3b9f870c3f1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456546, "uuid": "579f829e-3512-4f2e-804a-e6399d70533c", "value": "file.pdf.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3b7250-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425006, "uuid": "b1ded3d2-893a-4e57-ba5b-a40b6151a7e5", "comment": "Malware payload (Mirai)", "value": "229b4a213a638dd9ce2cfaeeca16351b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425006, "uuid": "e5de25a6-648a-4e92-953b-90000c784625", "comment": "Malware payload (Mirai)", "value": "216891f5c1decee1065e581b28dba40888c100371b73001fe13f7b89915151f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425006, "uuid": "58c68320-b15e-4cc0-8a71-94ac01ef76b4", "comment": "Malware payload (Mirai)", "value": "084d206ea5dff519e01814113a01cda3f53e3d4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425006, "uuid": "1679cf05-35bf-4d55-9b8b-5d7caa5b1a72", "comment": "Malware payload (Mirai)", "value": "d4b575712308c44a22136a754a902430b94395df111f491147f2644bb61c514120f196ba7709969daccf7ced7fa6b1f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425006, "uuid": "d195e754-0d86-48d4-96fd-3d2a9cb827f7", "value": "T178F31945FC418F12C6D652BBFB4E428D372B17A8D3EA720399245F613B9B96B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425006, "uuid": "1f2baece-985f-4c80-b4a5-401c8194bda6", "value": "3072:B6cDQkBlIG+1JfHYNPyTtB0vA/l5BWFsTlRthDjDBwr2jPhz:B6ccD5r/YNPyZ2v8TlxDjNXhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425006, "uuid": "983c28db-8f83-46a5-a99a-1435c99eb1f8", "value": 161996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425006, "uuid": "21fe5313-a70d-4895-97a0-f326f4659c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425006, "uuid": "7f6edc33-2105-46df-bd6d-362ec5d3b920", "value": "229b4a213a638dd9ce2cfaeeca16351b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7f050c-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713467174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467174, "uuid": "16b2048d-701e-42aa-8cbd-9ef4eb0af4a4", "comment": "Malware payload (Formbook)", "value": "8e17d7f6a7a42733f0ff057dcd6e8be8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467174, "uuid": "e8be71f7-ce45-4e51-816d-4ec94853b8f0", "comment": "Malware payload (Formbook)", "value": "223d2f80a60223db2bcdf49cdafd000c7242bb7c3e87ff1a354697719483e68f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467174, "uuid": "7aeb3363-1c77-4d67-8bc5-c6b8c829f0e3", "comment": "Malware payload (Formbook)", "value": "8fe0a41955cf840843da296ecf7b1a57b0a9dfa9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467174, "uuid": "22319bf5-6458-4911-8d1b-557fd16e9d3c", "comment": "Malware payload (Formbook)", "value": "667ce06e1444f4d62f36fb076d7807785e27dd36a176a62638e3cd27aad02f280d155400518f53b27f4d382907985a6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467174, "uuid": "51951d25-a745-427e-aef7-e828c22736ca", "value": "T1FF543AA0CFCA26394F4B2FDABD60459289FC81990212247DE6D907AD7243D6CD3FED58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467174, "uuid": "80e9dc62-0854-4444-8ab2-27c80ac46dd1", "value": "6144:LBdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scObd8lxtRaFp:VnS2Iml8xrMVai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467174, "uuid": "f6c39bbf-847d-4828-9fc4-dfd8da4a287d", "value": 285371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467174, "uuid": "d16c431a-0dbe-463d-95fd-3aa806f38d55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467174, "uuid": "b4f2d834-97ec-4744-9374-970c1aef71a2", "value": "Shipping Dcuments_CI PKL_HL_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695f1d41-fdc5-11ee-a120-42010a9c002e", "comment": "Malware payload (PythonStealer)", "timestamp": 1713473481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473481, "uuid": "cf4f1914-5187-40ce-9b73-c548676229fd", "comment": "Malware payload (PythonStealer)", "value": "56543167a8b1731dafeee93e5f2bf479", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473481, "uuid": "638c0dd5-5760-43b8-b9d5-8a5bd14f0707", "comment": "Malware payload (PythonStealer)", "value": "22eedb7d3fabf9d2719f4baf7c6ec7a077b0d8c43f46cc2be02a4a30baa30726", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473481, "uuid": "a5dc92ce-5995-4e15-b6f8-e1102ce116b3", "comment": "Malware payload (PythonStealer)", "value": "de6722a7ac2976d3ae3780057beb18e461a035b1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473481, "uuid": "86af1ad3-e088-4f14-b08d-d1683136b036", "comment": "Malware payload (PythonStealer)", "value": "7cd4ece7d0e6164eae162cc17fe85d218da6897e710f0b687a91c408459a953e2c366e548e3308cbcfdc1bba0a5083ad", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473481, "uuid": "21450ef3-2892-44b1-a8b0-ba3c33c4e4e6", "value": "T15EA63322F3A124F9EF17917D29D16730696AFC0A8B24D8B70784C2A56E637CC5C5EBC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473481, "uuid": "1263b4e8-73e9-40d8-b1bf-a87c23af8a54", "value": "154977cd00315e1cd7a5ff0dceb81b2c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473481, "uuid": "e5495010-18dc-4291-afe8-68b6e22d3567", "value": "196608:LyMd0UMpIFNGxcUN2QnKz7BvFGMIpeHDcoBMtzwDoJp+x:ZdxmqccUlKz71NIp+j4zOoax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713473481, "uuid": "e39091e4-c8ba-4be1-87f7-ff2b44f0c5b9", "value": 9636864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713473481, "uuid": "13719134-06a3-4363-8db5-459aa8a5a450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473481, "uuid": "581be836-bd77-43de-a624-4d525627908f", "value": "56543167a8b1731dafeee93e5f2bf479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670c5a51-fd56-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425803, "uuid": "2df80e05-ff65-4ca7-b6a5-5fbf83d5b5ab", "comment": "Malware payload (Mirai)", "value": "227e75766787753269252db66bd3a646", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425803, "uuid": "ab2507eb-6fc1-4c99-977b-f2aa3fa90001", "comment": "Malware payload (Mirai)", "value": "2337525595c88a1d3fdcd43a7349f86258d40cafe45beaf02b8f449e7514b867", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425803, "uuid": "3bee482e-806a-4928-b1c4-5953d31a8a23", "comment": "Malware payload (Mirai)", "value": "b2394cf87c2911cfeb2c352e2cb24bca527fc9f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425803, "uuid": "79b478d0-7a6a-4fbe-8a16-80137528f753", "comment": "Malware payload (Mirai)", "value": "052f4e598c2ebf388f6f6389ba8cc185a7d739f9f01c262d6cdb2e968fc97c6dcb6fe94cef6e00a281ad8b62c6f822f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425803, "uuid": "219f408d-d1aa-4bb5-bc00-1264959301fd", "value": "T199434C2166393F1AC4E0E8BE21B70325B1F52A5E65A4C94EBD730E4FFF11A54A6036F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425803, "uuid": "ed14f5e0-c35e-4bb1-a6fb-e41eba70d3d7", "value": "768:7boeqn8PLtADbbi1x0q9+8A/026N+urOjfEU4WHO+t99lt:7bfqn0ZADbbi1x0S+8A/026N+R4U4G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425803, "uuid": "19dab1ce-aa31-4604-81d0-807a8ff6407a", "value": 58408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425803, "uuid": "a9905ac1-c4db-4f9c-80e5-78456e77ece0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425803, "uuid": "5a4d730b-b3a4-41d8-9a32-615baaff8696", "value": "227e75766787753269252db66bd3a646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8531c785-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713424994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424994, "uuid": "80d2e0fc-ffde-44b7-9dc5-5113ed0da603", "comment": "Malware payload (Mirai)", "value": "11940231956afdf6ab2c24fafcb0a7d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424994, "uuid": "4b0d0857-dbf6-4231-9ac4-72c9f20314b5", "comment": "Malware payload (Mirai)", "value": "23b9b98ccaa61728e45450b30b8211ca8516dcb6963056a4710bf36566f74f00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424994, "uuid": "53633848-5535-457a-b1d8-d5f90da8d47d", "comment": "Malware payload (Mirai)", "value": "5a3f0b5e85964083be389505ee75a1a4e9f38c10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424994, "uuid": "a19f5e9a-7780-44d6-b298-d3c7eab30db4", "comment": "Malware payload (Mirai)", "value": "2bb64cec026989ec12e1e9a57b4a5e145ecf1a774dbee4ee140df661aea1c8148f63b6036974603ec49c58d050a01a19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424994, "uuid": "0fe6ef57-3714-40f8-bbd6-208e2139a38a", "value": "T136242A46AA408F13C4D727B9FA9F424633339B64D7E763069528AFB43F8779A4F22501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424994, "uuid": "3f3f3bb4-04ab-4b26-8eec-77fafe3d4199", "value": "6144:dQLFkgj4oB0ast5up8X+OQ3Q5U3rCYfM/RhkJE9:dw54oB0au5up8XwAmOYk/UJE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424994, "uuid": "85427ac0-945f-48a7-b519-4874293258ad", "value": 216775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424994, "uuid": "7f2366fb-3122-46cf-9453-87501140ed07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424994, "uuid": "5a50c758-1b38-4e52-bc3d-a30ae38cdac5", "value": "11940231956afdf6ab2c24fafcb0a7d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f520511-fd19-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713399591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399591, "uuid": "0cec118b-3d5b-46a6-80a3-4345130f1662", "comment": "Malware payload (AgentTesla)", "value": "e9de39ce29b4e19d9487d6517f5fe390", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399591, "uuid": "a0397347-d6e4-4048-9aec-8d10b176a89a", "comment": "Malware payload (AgentTesla)", "value": "24390949599e57a802ea820e402befca0610937e51e19a4db8228235d0017a58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399591, "uuid": "00570e12-29f2-4b50-ad01-e248f318f10b", "comment": "Malware payload (AgentTesla)", "value": "aa9300231e426c9d0cbffe0bcf36f047235e79a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399591, "uuid": "cab81f43-553f-4459-8c1f-a2f536953bc2", "comment": "Malware payload (AgentTesla)", "value": "80b044ae513a223a119a44d72f9ffdbdd2cd96a0a1671a3cb2fd7b4823d9211758591b1a680b5a57119ae946eaffedd9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399591, "uuid": "fa01d3ab-7134-487b-b475-1f7d6b2fbc9d", "value": "T1A7E42394EA595A1FE14E97FEB912602843F112EE8036D7DEDCC91CAA5CD038947C233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399591, "uuid": "c4c59db9-6f0e-40e4-a9bd-3e90153b90e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399591, "uuid": "7b56a799-3f0c-4bc4-a357-c94619f8ab02", "value": "12288:GORgtsY15YRNYpMIhka5EzcCWee290ki+lMkmn4HA3eKzm1asfD:6P5S4MIXeeUn1mkmnqQeKzmwsfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713399591, "uuid": "6e17dadb-067d-4565-adc3-850fb6a9ff88", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713399591, "uuid": "c071abb6-8fee-4a51-ace1-dfe94f0da818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399591, "uuid": "b0f5afa2-e023-4f81-872a-10cd9bde6902", "value": "invoice & packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88ea507-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713472406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472406, "uuid": "44d0877b-3908-4d83-a4e6-f49906bae41f", "comment": "Malware payload (RedLineStealer)", "value": "6928704375ac2d87302a793757e54b1b", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472406, "uuid": "9d699a67-e700-498c-ada9-7923daab1738", "comment": "Malware payload (RedLineStealer)", "value": "25a42d6dbd96d7a70df28309aa1f29de5e4df5aa18eca1420302896f7324c006", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472406, "uuid": "7e9f1d7c-3dc8-4ee0-8bcd-117747bbc820", "comment": "Malware payload (RedLineStealer)", "value": "c1666b7d0724e908fdf6ee0d2f046dfe7524cdba", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472406, "uuid": "488f74d6-eef8-4aaf-85ca-bf1bd43a0551", "comment": "Malware payload (RedLineStealer)", "value": "b22b2c7a78a3de6667c1fd265d2d78897736d3a67b7b5492a348b33fd96f4b6ec27a72e3c5b12b25d21e2bb5fc6f33c4", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472406, "uuid": "6da2886a-6e9a-44e4-8b28-2f61ea5e302b", "value": "T1FAF43370D3389AFFE4D258879E6E71072038665D0980867735B9CAC0D01277E7EDBE9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472406, "uuid": "49b7ab8b-be06-4122-bc42-d32d96510aaf", "value": "12288:ce0KoGD25dF7dWqzxRnEAcmdVTc3kkWvlXL+HhGwMzH29orC4njXE8l3glOMxQrY:R0TGDmvhWSrEIO3kkqlCMjloxQYdbjHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472406, "uuid": "f71f3e7d-0bbf-4cec-9108-185346faa49b", "value": 741017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472406, "uuid": "932084d6-8883-43d3-a45e-08b5a8f869e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472406, "uuid": "125e1bf9-7230-410f-860f-dc0d1da6daef", "value": "Arba Outstanding Statement.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8923719b-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439174, "uuid": "f50c3603-a29a-459a-85ad-d7c0eb60abec", "comment": "Malware payload (Mirai)", "value": "792b063231f223d067abe9e0333818e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439174, "uuid": "4f019005-4802-4521-89fe-1b4d871024ab", "comment": "Malware payload (Mirai)", "value": "25f9a6269bfb2fc91830d65490fde96342b7d3b4a6fe4ef51d570c6c9e4160e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439174, "uuid": "e911bf49-4b50-48d4-af27-c35ac010923d", "comment": "Malware payload (Mirai)", "value": "439118160254c013e039e546ffb900a703459e61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439174, "uuid": "2a59b4be-bfef-44c2-a7ea-f62ae970e369", "comment": "Malware payload (Mirai)", "value": "7190f8564d9c8566f6abbcf9457c2c7e89641d663330a38126efeea096b24eedf0a15930e955e61a3befdcbe8f702832", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439174, "uuid": "c88587f5-540d-4925-8947-fcb8e051a935", "value": "T13B634A25B5352A1BC4D8693A25F79329F1F91B4A34FCCB1B7D320E8DBB24610661B2F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439174, "uuid": "35c5d61a-fe04-4cd5-8db1-3c8e6a344476", "value": "1536:/mKtW4jikM0ApdWVjdoAeaY+zhX6GOly2:/jtDM0ANbZ+YGOlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439174, "uuid": "540fad54-173b-4be3-825c-cecd33be6876", "value": 67060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439174, "uuid": "20196c68-081f-44d3-ab55-78db53c30a61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439174, "uuid": "1beb6d55-e000-4691-aff7-866ee59950ee", "value": "792b063231f223d067abe9e0333818e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7f6f826-fd88-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713447494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447494, "uuid": "87321bab-e7df-49d5-8703-8ead8292de6b", "comment": "Malware payload (RemcosRAT)", "value": "0bd3d2e19b1833f1f6e47ed1b280018e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447494, "uuid": "cdded33d-4038-4363-b351-2e9657a34d1d", "comment": "Malware payload (RemcosRAT)", "value": "268e4479aea3fffb3510526ae4fc2413ae7444d24604e90a33bc718fb11e5027", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447494, "uuid": "5fa3bf03-2261-4ece-8d5d-3b05bf2f76bb", "comment": "Malware payload (RemcosRAT)", "value": "97c097ce7c7f9e0ff21f3c2473be4f62c1469697", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447494, "uuid": "fd6f553e-470c-4f69-9ceb-10763587324e", "comment": "Malware payload (RemcosRAT)", "value": "73e89685ea9689fd425366d4d339a9c286561e89b6fa4dc6d0e65040a2370abb6a615f3ee076cf554399b32f7cbb3e66", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447494, "uuid": "19ebe5e8-50a9-4a80-a6de-1a148e2e9651", "value": "T1D01308D1C9D612284A4A276BDD530B338DE8431E73235D75BBBD828D21434AC93BF7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447494, "uuid": "d4ea1807-4eae-41ef-adf4-a2e77f29ea6a", "value": "768:La5MtHHJjzte49JZvrkudqaki7XyrWCWvcN59xwYy6:LLtFzMaZv5QOrZCdPwYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713447494, "uuid": "05f05e25-5c01-4301-bac2-01efca1c8700", "value": 43628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713447494, "uuid": "ab93449d-626a-4a85-ac3a-6340e91ef2b2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447494, "uuid": "7d5aa7cf-240d-4d09-b14e-9ae3b5515526", "value": "RFQ.NO. S70-23Q-1474-CS-P.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebba027a-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713467257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467257, "uuid": "8fc2d6e8-6f65-4917-a8ae-c931d3366f58", "comment": "Malware payload (AgentTesla)", "value": "0193a0a5847efd51f91bc7b2d4fe8a78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467257, "uuid": "07f85205-b53f-4784-8e0d-83760d81d8bc", "comment": "Malware payload (AgentTesla)", "value": "274013bc54c33bfd77473b8a92016b247b6832a1d26a9f412596cc9189775efe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467257, "uuid": "c109b66a-2fe9-40fb-93cc-72709b18bd15", "comment": "Malware payload (AgentTesla)", "value": "a328221484cc2d9d153d4bed7f1278b7d8bf37cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467257, "uuid": "a2eb4cf5-2d91-4131-8bfe-fc7b5b7412d8", "comment": "Malware payload (AgentTesla)", "value": "2d73b250e9811f962f0ac8ee701556fd1fcd99197ac0230156b4dc974948879c51454dfc5b35b4a50c0f57057417f38a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BBVA", "colour": "#1DDAF1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467257, "uuid": "b88b2c27-0569-4ed1-a32a-2ed7dd602e3d", "value": "T10135AD0273D1C036FFABA2739B6AF60156BD79254133852F13981DB9BC701B2267E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467257, "uuid": "641c2352-11ec-4f8d-b6e2-5956751ff246", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467257, "uuid": "1da1ea97-40d1-406d-859e-49ceb3a4c7c4", "value": "24576:dAHnh+eWsN3skA4RV1Hom2KXMmHazaV/F9MaT69H5:8h+ZkldoPK8YazA9MaC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467257, "uuid": "953a4c6c-54b1-431f-8de9-030f8bbddf1f", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467257, "uuid": "2b9faba7-5cb3-4117-8f4d-07b35b96838d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467257, "uuid": "fb108114-f0cc-4e0d-b4f4-fa70a0966f87", "value": "transferencia_BBVA_97866456345354678976543425678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055d55ca-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713472454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472454, "uuid": "9fcc04ef-4227-4486-bd72-6a938b75db46", "comment": "Malware payload (Loki)", "value": "d12761c635cb3799be45ab5c2df206aa", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472454, "uuid": "60bf6fd1-310f-48b2-a334-0cf29dd9fa2f", "comment": "Malware payload (Loki)", "value": "27b7d8e573c0cb497320264b80fd13dcda54c1d92a5b3356aa69280fe53624d8", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472454, "uuid": "45214176-358f-4f94-8868-b682def4cbe0", "comment": "Malware payload (Loki)", "value": "bd8fc30acc6c349b2ddb82a6d0639916b2b36151", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472454, "uuid": "63591a48-a7e8-4b7f-a39e-36551485b10e", "comment": "Malware payload (Loki)", "value": "8ece4ed298f268676d5592c2533b282bb0aa7121e5e436fb8dfcfd0f1f94ad8e7aa293b71ee88d34d932bcb02eec3459", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472454, "uuid": "1ea4d63e-810a-413f-b6f1-ab624103bf83", "value": "T102B4231546D53B43EF3EB5CEBDA6B920F95288BA3C689C4653CD341EAD5C0E4E6D0B80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472454, "uuid": "6418bdc3-63ef-4069-9afd-8bb9969757c1", "value": "12288:inz/xlXnPJZeUPGFhyCEV4GdNMVo9Mey3ka9iihS:mHPJnPGFICjhOeka9iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472454, "uuid": "118314fb-545e-4f33-a559-6c54f996d504", "value": 509510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472454, "uuid": "25c9c79c-728a-4766-a5b4-f25492f18896", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472454, "uuid": "84ee4882-a539-4710-98ac-c06f80723e8a", "value": "FedEx_AWB#53023114643_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af55291a-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713470592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470592, "uuid": "e72ba806-f164-4320-a9f8-aea6bf815017", "comment": "Malware payload (Formbook)", "value": "0111d8dff50eb7684ed4baf327b93aa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470592, "uuid": "d933edbe-1eb1-4fe3-88e2-e05bee5ab242", "comment": "Malware payload (Formbook)", "value": "27f8fe9e4c2cf7bedf462a311aaf91698fb375f7002cdb3b290e872b6a27768c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470592, "uuid": "3b30e7d4-804c-44b6-a292-d14ccac953cf", "comment": "Malware payload (Formbook)", "value": "e88281f919ce248f011265396f60e6245f5a639c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470592, "uuid": "300cbfe5-e085-4453-a0d4-95a310e69c87", "comment": "Malware payload (Formbook)", "value": "1a99192146a09ec643e10b838b433b0918fc7c700c3d290a1748fa66363cfae447a71698074f90c4d5eaef1e3bb7d855", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470592, "uuid": "1cfc5c56-e6be-40e4-9c5c-b5107114b528", "value": "T101E42356F6BE9B2BC5EE97722240994D1BF5A2402702CBEC0CE21CC94FCD7F01655A7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470592, "uuid": "4b6b3933-ccbd-4765-89d5-b25a912e25eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470592, "uuid": "7095f0d0-d1be-44ed-8037-4349b5c10549", "value": "12288:RVQmxUxWxKWNG/6xdWySZeh3I7O1/mnfv+hHG0i1e9f7qmKNDTKvAkR:Iq31PGehQc/myHG0weSPKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470592, "uuid": "cc200de1-7507-454c-b87a-8ce7b886f6c8", "value": 700424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470592, "uuid": "e9d54657-b78b-451d-8e7f-59fe0e8d785b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470592, "uuid": "717a3310-f6ae-4003-96e0-3eca96644307", "value": "0111d8dff50eb7684ed4baf327b93aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c97b805-fd83-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713445193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445193, "uuid": "502c9e5b-1008-457c-9af4-cf71436c80f1", "comment": "Malware payload (AgentTesla)", "value": "9a9df44932a55d7ed8b2eacd79b47b89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445193, "uuid": "23fb035f-a94d-4ec8-8ed4-c86e8f6f50df", "comment": "Malware payload (AgentTesla)", "value": "2829d7c07f3a1a966b25c244d05ad931e9b52510dbae293277ff2208f72e6d34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445193, "uuid": "f693b218-991b-4e10-8762-81bcc19848a1", "comment": "Malware payload (AgentTesla)", "value": "ad69039b9d1513898457403b224152762b3a5299", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445193, "uuid": "0b617eeb-90b2-4533-91bf-05afe4a99154", "comment": "Malware payload (AgentTesla)", "value": "dbacd56b5229ae20434568c4144c4e3cb27ab00e212f94d4136af96219ca56afa37d225919efca6326733eca8a459857", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445193, "uuid": "de7efe3a-ef2c-4284-88e2-ed74c1578eb8", "value": "T155E4231EBBA9EB13D99C43F6581045614330C6AACA13D3EF8DD60CC453A7BC695C5BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445193, "uuid": "f0ec76af-afd0-473d-9cfd-b1208fb5f48a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445193, "uuid": "5ba7322c-4b02-4c39-80cb-1e24e94b86f7", "value": "12288:GUt0wHmSabSgmBG2GPVgxZIkNFMpGUtBAsD+ZzW+csuo2SXWflK8:l0wHmSiSPEfdgNeGUtBAsIzW+csuo2SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713445193, "uuid": "4bec7a6b-d8db-4283-969a-3d352bb4722d", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713445193, "uuid": "070b3df0-d9bc-4080-8e6d-6f889bd5b200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445193, "uuid": "35f6117c-7598-478a-ad29-d196ac15739a", "value": "Scan-IMG PO Order CW289170-A CW201.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873e97f4-fd97-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713453774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453774, "uuid": "a7fc524c-2274-4fa1-909d-fdf96883f277", "comment": "Malware payload (RedLineStealer)", "value": "fa4c5f998dce90810c3ae85a896afce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453774, "uuid": "e9fe0427-83cc-48b5-af96-a8cc1cd55f7d", "comment": "Malware payload (RedLineStealer)", "value": "28874833c76b4054e0d497dbd7ed64b6469a79b509fac6387c9634f6128ab7a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453774, "uuid": "cc40900a-6fa3-4cb5-a7da-2c4f9cf689f5", "comment": "Malware payload (RedLineStealer)", "value": "551aeaaf52ab289adea17bb5c745b6c87be60f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453774, "uuid": "f1db13e8-fc8c-4443-8ec1-fced6c8f07e6", "comment": "Malware payload (RedLineStealer)", "value": "0ed75316cf0d9694eb965a5a8a4b4dd9a8ad7fdd875492ad7d0fdf39b15ed0e68df11b39d4b2d83dfc47f8b3d9f6396d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453774, "uuid": "2d74e810-58e8-4ac4-baf9-33f05cddaccf", "value": "T15CB4F11575C08072C57325320AF4CAB9AF3DBD700BA15A8F67A50B7E4F31682A635F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453774, "uuid": "77378a42-1864-415c-a147-2739b4073781", "value": "e233f55b2e1564f7081c0ffda9a4bede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453774, "uuid": "4d9f1168-87d6-46c6-8580-43a5ee6c43c4", "value": "12288:6vW6XnWVzxV7k+eUodPV+jk3JhxJaD1Ew2W28ng0UtdouHKxpuSd6teE:6e6G9xhaUoujk5hxj82ig7tZHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713453774, "uuid": "17d1b18e-55ff-44bc-949a-6ac18e60ff00", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713453774, "uuid": "48023cf5-8152-4911-bed8-6d681b96e128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453774, "uuid": "4bbb274d-7e56-4dda-93bf-1c9b7c71636a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2b80c9-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425384, "uuid": "4d480837-f690-4374-b50f-5614891c683b", "comment": "Malware payload (Gafgyt)", "value": "84049d29deb99c424e79dc6395035953", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425384, "uuid": "353a2e98-2877-4152-9d42-baaa13a983f2", "comment": "Malware payload (Gafgyt)", "value": "2b3f84b927c60aeb28f5014ebf0d44030bb99d09de9d505c9f2c8ac096fa66a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425384, "uuid": "446299bf-7f7b-4540-9e66-b31c96156adf", "comment": "Malware payload (Gafgyt)", "value": "df2d3cb63aaaa76f642b3a5a39100a3fb0350cba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425384, "uuid": "917bc98a-9c38-460f-b210-43a736fc792a", "comment": "Malware payload (Gafgyt)", "value": "e3c8178dd9b27213431dbec046cfd128e1337b0cfe5f813f4258c0276909eb33e32f6e50476f0e5a176a2e93877a6b25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425384, "uuid": "a771a1a5-6055-4c57-ad0b-ab174a969e63", "value": "T14124833E7A12AB7DE2A8837107F6AFB19B5511E323A19341E27CC7185E7124D2C8FB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425384, "uuid": "560da695-a550-4ac2-bb6d-fe38886baa07", "value": "3072:3XC9j6w2ZQgoYJlQeRmhDvy2uSNbtmWu+R9ask0QcYbG5hRBg1cmrpy6n9Nn:3SDCzcYbG5hR5mrpy6n9Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425384, "uuid": "247f361f-7654-4be6-bb7e-79416ffaf516", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425384, "uuid": "f7ce4aef-f55e-4f06-85d1-68a6b395e525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425384, "uuid": "5e317294-c0a8-46c1-8239-226758d810a6", "value": "84049d29deb99c424e79dc6395035953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee1a13b-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459075, "uuid": "d96af1de-05ee-42ca-95ee-0da992f85d01", "comment": "Malware payload (Mirai)", "value": "dff3b09745adc693247ec736be96bfa5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459075, "uuid": "ae38a3bd-5548-45a5-80cc-1a38ed6f6c9f", "comment": "Malware payload (Mirai)", "value": "2bcf7bd3c457112dc7d8229d3872a88b7889c09db932a24068ee95f5ea93948b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459075, "uuid": "1ecf19b3-e539-4f50-abe7-0f64a193deee", "comment": "Malware payload (Mirai)", "value": "607e24259b069d8a2f028937d902083f98b81db8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459075, "uuid": "1313f5fc-7f17-4f22-b034-e137bd918b0c", "comment": "Malware payload (Mirai)", "value": "8d9ef05727602a58d84c02e848e95e04a0a63255e7943d94e2e3ebdb55428dccaecf79dcb8e5c26ca11f837387a2874a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459075, "uuid": "b62bd2fd-3b58-4593-82f9-a6b9ff202ab3", "value": "T1E3330784B981AA17CAD543BBFA0E43CD37262398F2DE3217DD256F5133D652B0E6B052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459075, "uuid": "93450b9c-445b-4d5c-9c1f-b633fa88b009", "value": "768:B9Fk5xV47mh0r7VRvWRVavTg7Ks18/jeJBbbW5LCDxwoCkQK93aTm5HzMIx:HEN+aTaFs12jeJBbS/oRr9KE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459075, "uuid": "8f96d880-082c-4510-8263-dbef9bc19439", "value": 52880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459075, "uuid": "eb7e13ee-aa14-4190-9fe5-8f5df0a1679b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459075, "uuid": "8e0837d4-6fe9-4005-8ca1-1c515baccf10", "value": "dff3b09745adc693247ec736be96bfa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71dde20-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470605, "uuid": "11dc8e5f-9a8e-4bd4-89a7-c13d4085dc61", "comment": "Malware payload", "value": "81c83f27b6e88c217d634431ab7ca78c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470605, "uuid": "3cec0fdf-f5e1-445c-b485-f0d108226dc9", "comment": "Malware payload", "value": "2c3455514637842ad6ed1ef0f8cd53283d26c23d65a4cb9814ad079eae877f40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470605, "uuid": "d1951c4c-46ec-4376-81ad-96a5e702297c", "comment": "Malware payload", "value": "8c0f11fe5c2b95cb48b0869dda299dab6352123a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470605, "uuid": "2159816f-7dc4-4985-b293-847807e154e2", "comment": "Malware payload", "value": "b88b853e24c87a00855aba43d593147559d471779d474de78cf8835739e49d1260a994a80d24b5caa69b7a35bfb13ba7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470605, "uuid": "02ffe7e9-b810-4526-ba88-9b54f734e145", "value": "T14DE33905D7408B57C1E2277AEBCB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470605, "uuid": "3ef51219-4e76-4cf4-b827-428f936e4b17", "value": "3072:ut8iFDKEfFN+Fa+1sWCh7a8oXV7pUMbmQwfCMQiGW:s8iFDLf/+FaNrh7a8oXV7p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470605, "uuid": "e3f1241f-c51b-4d55-afab-92c3652c8fff", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470605, "uuid": "5b20340c-3c80-44ad-80f5-8ba83bf6e250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470605, "uuid": "365fba76-4c35-4570-891f-43ca05616072", "value": "81c83f27b6e88c217d634431ab7ca78c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200fbdda-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419241, "uuid": "b4adff42-ee09-43d7-b630-204eae560b16", "comment": "Malware payload (Mirai)", "value": "c2ae20f01bca016aa1ef7ba0bd4d0ef9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419241, "uuid": "b04feb91-f692-4570-800c-2e93c5d99659", "comment": "Malware payload (Mirai)", "value": "2d60b40f415ae6a0af78c02bbb33753521028be4fcecba3d56dcbfc51fab8186", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419241, "uuid": "9055b18f-98f3-4ba5-ae99-2d10ed4d4729", "comment": "Malware payload (Mirai)", "value": "eb530b4d52a25fc1cad0fff5c0f8d7320c5317c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419241, "uuid": "397a9b9d-4910-4cc8-9955-0b493ed96b26", "comment": "Malware payload (Mirai)", "value": "f5bf5dbc4e42324a3f9758648a54c412af65744b385aafabce5d701c12cbaa0980663ace4ec35fff90578c0441b214b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419241, "uuid": "202feda3-1f7a-46f1-bd7a-d080d33e3eab", "value": "T18703E19F8DA16589CDAC297F831A772A58056488B2C295EC63711D0C9327E8BF7CF078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419241, "uuid": "a83b113a-e59a-4996-a861-b8d9a789b8c9", "value": "768:hu+dhF07pnbFokdbXLk35zvXLjHMjD7qbtYs5QmPkGaWTNEY:h1j2VF9XUvWGb6w7NEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419241, "uuid": "4de2a1d8-7e10-4cea-8d0b-154732002098", "value": 39800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419241, "uuid": "87c0f1ad-6d8b-4488-a6e4-d2f23622b2e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419241, "uuid": "73f10699-f271-449b-b0c6-db4a783e7e66", "value": "c2ae20f01bca016aa1ef7ba0bd4d0ef9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1a1f17-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713457673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457673, "uuid": "3cc714a3-e6a1-4387-9a48-bc980e3b828f", "comment": "Malware payload (AgentTesla)", "value": "a6a52958bec5f9bca6d3dd49072b481b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457673, "uuid": "2a07333f-5f4e-4566-a18b-9e36a28ee479", "comment": "Malware payload (AgentTesla)", "value": "2dcedda2d433140e29c0e0efa141df17c0398b820922c7e39f4ab503ef1f1855", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457673, "uuid": "9514b041-a2df-406e-b4ea-666f7f3ad680", "comment": "Malware payload (AgentTesla)", "value": "c706c226c248dd1666e04ed404eab305e76228f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457673, "uuid": "0df3694b-e28e-4797-acf6-915e86aab5fd", "comment": "Malware payload (AgentTesla)", "value": "18e88ed73b0e244f105dc9461445029557fd09ea1d974a30fa70e65ea9a3334a40bf180db5207c752f605014898ed91b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457673, "uuid": "abaed2f8-6f6a-43cf-a0d2-4ab81080ea48", "value": "T12194E11575C080B2D933213109F4DAB96E7DF9700AA55A8F67E40F7E8F70382E635AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457673, "uuid": "68d98296-10ef-4df7-9b39-7b93d1223898", "value": "e233f55b2e1564f7081c0ffda9a4bede", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457673, "uuid": "a2509b44-3950-423e-9e1f-95257d740259", "value": "12288:W7/6Tsprci/CRTVXmsQuCiGhtsvo4H3mkiOYfjaneE:Wz62gi/wVmFuKmvLH2Jr+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457673, "uuid": "4d7ffbda-17dd-4bb2-a8dd-203b65403ff6", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457673, "uuid": "228a72f1-bf85-4d64-bdd7-583140fb02dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457673, "uuid": "745392de-7d27-4688-84a3-813ebefce13d", "value": "RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaeb22d9-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472410, "uuid": "f8a7e6d0-d36c-40e8-bc92-692ef94c6f68", "comment": "Malware payload (AgentTesla)", "value": "5218c73347af9657ae365ccfa0c9a796", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472410, "uuid": "03619cbf-35ef-40f2-a382-bfc0b563eeb6", "comment": "Malware payload (AgentTesla)", "value": "30121f858baf2593206744c6938684926726b4d6b24679fa6e7bb7e4b0c74204", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472410, "uuid": "fd8cb2e3-3031-4f63-885c-320588647078", "comment": "Malware payload (AgentTesla)", "value": "165af2270057cac4ec51de6e28e503c624ce4cba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472410, "uuid": "54ac7698-8414-45f1-9576-76c3e0f6ee20", "comment": "Malware payload (AgentTesla)", "value": "5b897a2251c248af3a03fc64a548ff63b9673c5303ec74e967a57bd08a0a302d8062babcf524befc1c550fb519804bdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472410, "uuid": "94b289f7-0171-41c6-a7b5-20ed94af7457", "value": "T1E1E4235B68F1C5D37DB546F129C4EFBAA111E75B3201A14EDA709E11B22FB6A00BE03D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472410, "uuid": "0b3f6ab2-3b5a-44fa-81a9-bc8721779e37", "value": "12288:CQ6/Ovt/7r2HGVLoKv+J4ZpeK09yYQko1mXI9oOC5Oeht7cSdcZK7MaPvCN25pGJ:Cty/7r2AoKvlOl9yYDq9BC5R9GZJi5oJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472410, "uuid": "aab34ff6-b78f-45fb-871f-07da10a9ad4c", "value": 673321, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472410, "uuid": "669f168b-341a-440b-a116-57f89a5c3498", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472410, "uuid": "b04d1828-32a3-4187-8dd0-0430d602a5c1", "value": "BL 00183001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2564249d-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419250, "uuid": "f579d15a-efa9-4321-90b1-7cff91ed828e", "comment": "Malware payload (Mirai)", "value": "f946de3390cdc1ff3335c5f08ac84191", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419250, "uuid": "8414437c-0b09-46bc-b90d-8a8606f05332", "comment": "Malware payload (Mirai)", "value": "30d7cd9723a8c35e03692f23154a0d35fd8e2db816dd059b130feecdc97916ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419250, "uuid": "5df22452-4cbf-43f5-977e-04e1f181a9ce", "comment": "Malware payload (Mirai)", "value": "c28b8e08755cef21e59ffa147a93804a370d84a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419250, "uuid": "cfa88ae8-093b-4ff1-91df-1c0e965bd157", "comment": "Malware payload (Mirai)", "value": "a423c33a5cd05eb8f74ffdfef27c145541f6ef279a127f75f942a52ada9e9ad15a0493fe6f76af020ca917daf80bf4fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419250, "uuid": "9c9cfce8-bbe1-4d69-9d3b-90363cd32835", "value": "T13A03F1A5F4C400F1D3752EFEFC26CAD3665D3D78A0AA92570605827E6EC089535F94E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419250, "uuid": "f37e7a0b-5b3c-476a-a773-0da26cf325ba", "value": "768:vkJ56p6b4bQr79+E2g6S7xUZ3tgYISdwFQY9JetC8dtsyjM1UVq3Uirbv:C4p6b4c30E2m7xUfgidXI3R1Uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419250, "uuid": "63f5016f-abc4-4723-8752-5617673c601f", "value": 41124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419250, "uuid": "cbb14e71-7e79-46ea-bf3c-4cd73e8a0c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419250, "uuid": "1bfb3d1f-e939-4d12-8798-69e9ae439bad", "value": "f946de3390cdc1ff3335c5f08ac84191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f834a9e-fd3b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713414194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414194, "uuid": "3a068d15-95b4-4029-a544-bc3a75469b6d", "comment": "Malware payload (AgentTesla)", "value": "8ae8e59f0df6887a86d8ac303d004095", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414194, "uuid": "0c1e1d32-2a0d-4fea-b160-5200c5909328", "comment": "Malware payload (AgentTesla)", "value": "30e181e98cb75e4324746fd2d27fcc9987a51dfd0182b45eab54781df26c1d33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414194, "uuid": "a1a3b870-6b52-4e5e-bdca-0aec879d6b76", "comment": "Malware payload (AgentTesla)", "value": "9cd99884369adfd6bb5d9f3426c91b25f4979281", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414194, "uuid": "ebb4a810-07ff-4125-9cea-d7de069c7c9f", "comment": "Malware payload (AgentTesla)", "value": "8da2775e7564b63953e102c4a25fbd30b9b08060a2ae82b805645d5b619d0fbf42cf86e65dc26100688002134129068b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414194, "uuid": "d2dbdc24-534c-4a32-98ed-f078420b8f7f", "value": "T1DD15025276C14B17D4384FF981B242982376BCA76163DB8F6F8072DD18767804E8BA7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414194, "uuid": "88434c8d-15cd-41e1-a4af-2029f61226c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414194, "uuid": "85f7a370-baa1-43c5-9e93-d3a4799aa7f5", "value": "12288:hWK/pbMHRwwAFD3XhWLBuFdTu9LcIfwC2ybQ+er3eTdmL7Dk69QlY+GauXxD1GI9:hWiMHgLOILTuCITKORCnIlSaYxR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713414194, "uuid": "68a7a26d-d250-48ad-896c-be23eb2c4c04", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713414194, "uuid": "703e7c36-9220-409b-9c85-90cca9dc9e07", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414194, "uuid": "56f6738c-043c-447a-a6de-d6d725b6af53", "value": "SecuriteInfo.com.PWSX-gen.32561.14552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a84f6c9-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419205, "uuid": "a4e1345b-9e5c-449f-abee-8bca7db800a3", "comment": "Malware payload (Mirai)", "value": "18149669f5eb4dc120845bb460553863", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419205, "uuid": "8f6d6315-5941-4a10-8045-1081a23aa27d", "comment": "Malware payload (Mirai)", "value": "313853a6026e0dfcdf15dbed914ddc36186e79e426022b39f732004dd5b11dc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419205, "uuid": "a4e72600-8c1b-407b-a5c9-f81dccccd90a", "comment": "Malware payload (Mirai)", "value": "d3a6295b9c3f04780534eab0d88ae30c8a45bd0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419205, "uuid": "258b7d24-5cf9-4b8c-9933-96df28bf545e", "comment": "Malware payload (Mirai)", "value": "a598e634437f4294e6a385a2aa999b17af6ccb3a3dbcb4461256fe865ff76d6a5dae40b1363f188b01974c47f5482db4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419205, "uuid": "b9b980e2-4fd6-48ea-a02c-c24caf73cd89", "value": "T169730896F8415B26C5D012BAFA1E128E33231FF8E2DA32029D116F6477DA95F0D3BD45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419205, "uuid": "611866b1-3b2e-421a-a54e-3a59bbd236e2", "value": "1536:XlnegJJ026cdZEXmTb0QzyMtVbL9az7OHwXKexN7LJUYIDpi64/zGrD8:o0AjCyIbHpexNBUh/4bOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419205, "uuid": "185c9f65-3e05-47c2-8ca3-9689d6e0ee73", "value": 79508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419205, "uuid": "4eee1bcd-00d1-45ed-a170-aeddce533852", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419205, "uuid": "9a250ca0-5c4d-4168-9aa5-2938c51299e2", "value": "18149669f5eb4dc120845bb460553863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984ce58e-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713431039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431039, "uuid": "18123d4c-b551-4ef9-afa0-37525ca022e7", "comment": "Malware payload (GuLoader)", "value": "ee9f4f75ebcf4734ca7a472f014a9682", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431039, "uuid": "14d0a107-f1fc-42da-8ce5-944bd4119d2c", "comment": "Malware payload (GuLoader)", "value": "319f43e5b712ba70a59285b4ccb0f362b5f2c0cae447b8bf69fdb542de431359", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431039, "uuid": "8deb30c8-23cf-40f0-b06e-b4725749a5a7", "comment": "Malware payload (GuLoader)", "value": "4878d0e591ae10ad9817c11be5abd34735dc7165", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431039, "uuid": "8e1f9de6-4f89-430f-bd7d-56b0d9c26c16", "comment": "Malware payload (GuLoader)", "value": "8bb7c4c65d285333a2a624c4567385aecc8e2fabd2d8fd67646387d5823017aafafd2cabec3881317614c6d07840ace8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431039, "uuid": "16e42ab8-0af7-495a-b906-030f2567fc87", "value": "T1602419F08F0B36199F4B3EDAAC6445928AF44195051638B5AAD817EDB383D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431039, "uuid": "24a3f83f-672a-48f4-871c-75af007ba105", "value": "6144:XYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfaqzl:02dOXnuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431039, "uuid": "51ceb80a-1f39-4cf2-9346-b381b4280d7b", "value": 215938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431039, "uuid": "a14404f4-3c54-49a7-8f35-699fb89a033c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431039, "uuid": "6e1d11b8-1d8c-4850-807e-d8607f7a16c4", "value": "Justificante de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b644725-fd6f-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1713436601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436601, "uuid": "be13eb6c-8dcd-487b-a214-7137b0fcae17", "comment": "Malware payload (Vidar)", "value": "1cd2b133df1c0e1ace31e5ebd4622001", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436601, "uuid": "17288411-38dd-4dc6-8bac-f5e4d3384145", "comment": "Malware payload (Vidar)", "value": "3207e4d698ac64dd7c30c1e1ce6247b6e2099e408f36832768cac8f3d7c36942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436601, "uuid": "4c2d0df4-c332-4904-b88f-f77ebfc1c64b", "comment": "Malware payload (Vidar)", "value": "ac9a2288a9f51daac2c9008ad91308aa63cacb2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713436601, "uuid": "51fb0cc8-823d-48bc-8997-feb5ffca0c04", "comment": "Malware payload (Vidar)", "value": "8fd32ef28f2700cf12108186141d0f7ca4550fe839c6b3b67d7fc5c4d3049da88336b4132b7dc43a6fb05fe2e610c025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436601, "uuid": "f5d2c2e7-2935-442b-939e-0e29e309f909", "value": "T1EF64021679C0C431D9B71A320560E6B48B7DF6300E60ADEB235D6AB91F707C29D29E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436601, "uuid": "cdf52a03-77db-4304-9d88-542619d71e9f", "value": "82004e1f718cc406824f64c2578845d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436601, "uuid": "1a350c1f-a47b-4957-a870-66814b09b741", "value": "6144:fOLuCdfiVOMD4RKfCzVmc39hQQeUd3O4RPrGe5pic5WHwk4pQ:fOLufOszU5JqiWHH4pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713436601, "uuid": "4fec0525-9852-48da-87d9-3b20202c4771", "value": 334960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713436601, "uuid": "9e4e210f-d320-4969-ae4e-8a275125fde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713436601, "uuid": "a3d26c39-ab40-4d29-af27-8df8d11c1149", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db0a2887-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419555, "uuid": "acf27b07-201f-4e58-8490-947c44aa8ebc", "comment": "Malware payload (Mirai)", "value": "8622bebd8e2cbc2b5771884826a0afe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419555, "uuid": "5fa62c6d-4d67-42fd-99e0-9397d612ff3a", "comment": "Malware payload (Mirai)", "value": "3242dc29b3aeffc6cfbb754278b327953eaccb1488fd6cdb5101d06baaf98e91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419555, "uuid": "1fd90343-a17e-4af8-ad79-eab656785d83", "comment": "Malware payload (Mirai)", "value": "9563625717e0b5408a169c200182f81f6adc373a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419555, "uuid": "dfa5921c-ab26-42e4-9c33-2b2324b2a7af", "comment": "Malware payload (Mirai)", "value": "81a9cccfe10f8468ae117572a374c31935cc739cfc599112b557a7a7afb7fe7582333f6d00fa3b41443b7363a848583f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419555, "uuid": "5b3efc22-86f0-47d3-8048-98c9d0679920", "value": "T15F533A94F743D4F1D8470930119BFB3A9A31EEE11160ED2BEB98FE72AC729129116B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419555, "uuid": "a9ba63ac-3b03-450d-b939-3a265f3dbcfc", "value": "768:lXlW6Ur9L39tzOL1++vLoIC22mSAeao6fYkeUo6LEz3BvyPwXnVrUAM31g2yXMDd:hqL399OQsLQmSn9UoIwrU531g2y70r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419555, "uuid": "70fb0471-83be-4f39-8609-df5f11232d90", "value": 62316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419555, "uuid": "2e0e5dd6-0e61-4434-b8be-a2b9cda84614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419555, "uuid": "7619d8ed-d784-4938-bd04-84da019f40bf", "value": "8622bebd8e2cbc2b5771884826a0afe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b9b249-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425373, "uuid": "75dab3ad-0d4a-4160-853a-e49040331967", "comment": "Malware payload (Mirai)", "value": "33250a7772ab1e023ca8997364d4b39d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425373, "uuid": "37ace848-d012-43b8-9be5-2be7b2c0e28d", "comment": "Malware payload (Mirai)", "value": "327c18672e210e6e79471ec18cee5e763f8715e5cf4b24c3ad85fb3466b625c1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425373, "uuid": "d35238d0-d7b6-4ace-81ae-1bd2a7264467", "comment": "Malware payload (Mirai)", "value": "bb8db716a0b8c0bd265c62eeda8838e06dc77da1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425373, "uuid": "298938e2-a39c-4aeb-a5ae-4cf5277c2f6f", "comment": "Malware payload (Mirai)", "value": "21b29b5a3e2fa3a19d4bccbfbcbbb43bc9ce558161bace31e2d057b166538ed53fd42dfd6b9930caa2e44b4ef11a88a4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425373, "uuid": "4591840a-f7e6-4d4e-a3ad-f66a73e569a2", "value": "T1EA145C0775C2D0FDC4CAC1744BAEB536E933B8AC1239B15B27D4AE229E4AE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425373, "uuid": "d68df762-a91c-49f0-b0ce-bbffca142a66", "value": "3072:8IssMhtRGFd8ack0cKb11Gv8dRIn59/hv/h3V:0sMpGr8clHhxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425373, "uuid": "6c0b5ff7-fe86-4448-b6f9-71be0dd2a33b", "value": 195184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425373, "uuid": "047b7063-32b7-4648-8c9f-b79e45f413ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425373, "uuid": "88a137a2-70d1-4db6-bd53-3404efb09543", "value": "33250a7772ab1e023ca8997364d4b39d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e233bcc-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416634, "uuid": "add6d02a-bbb3-4709-9309-26e9507d83ed", "comment": "Malware payload (Mirai)", "value": "4362c850d7c29898c3ccbf8fe7314f7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416634, "uuid": "29b0b977-3328-4885-9d19-9b52872cd722", "comment": "Malware payload (Mirai)", "value": "348683f24dc13e4d8c299f2aff2c68e2b57ca50f86a84427b9a3dfd7d731b4ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416634, "uuid": "7e04cc21-22ec-4ec4-9837-e0316b0a6315", "comment": "Malware payload (Mirai)", "value": "2a1605fb2a0fffe0c8fdcfb8b14703b1223debf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416634, "uuid": "eda65be0-c9d9-438c-97c8-bfb2a9d5c4af", "comment": "Malware payload (Mirai)", "value": "50cefb10fa9e89eb5e52febbbbfdeaac69235f6a25c41a439c488dd6c8a5892b97edd4474d900d58fd9e83c72207a490", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416634, "uuid": "59cc4088-7ea7-40c3-b70d-92a70e68c726", "value": "T1DEC34B212A392B32C0E5A53D00E79736B7F62BD82A71820F7E651E8D6F1979031537B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416634, "uuid": "0500602b-628f-416b-aa4a-d9aa41afe24d", "value": "1536:iYy5KrYZioZjlZuwzS24S17ZTj//8WV8rhKjTXUAuYMToOeoGWNzdY3g90brAI7:5vKT4S17ZTz5jQYM0xtWM3g90bP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416634, "uuid": "706a4e11-76e9-40bb-b095-684ae6079fe1", "value": 119843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416634, "uuid": "3882dd75-c85a-4c26-b2f3-2e62e736cce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416634, "uuid": "27e17378-a3c6-46de-922f-252051755e47", "value": "4362c850d7c29898c3ccbf8fe7314f7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70398265-fd25-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713404773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713404773, "uuid": "a40f950b-fd6c-403e-9852-f9264797296b", "comment": "Malware payload (Mirai)", "value": "321367874c11451a5ac8f89551cdf5a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713404773, "uuid": "580d611b-836d-47ae-a070-e91d912b984a", "comment": "Malware payload (Mirai)", "value": "34881ca6cff31098ed669fc379ca8b9d319aab5f14e0fb7d0b107a20ff1130e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713404773, "uuid": "cdaa55ed-5b2f-4d2b-b5fc-f3f54f5e5983", "comment": "Malware payload (Mirai)", "value": "2cc7b1c76e4468a16eec8480a5fdd106f6019b99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713404773, "uuid": "cc2a0ad0-92f1-49d3-9024-bc78f9245cb2", "comment": "Malware payload (Mirai)", "value": "559b6a28ed015f902ccfe0e750d0c93af6c61f39fa15d6bd2af71a682749004f210ec1c150c955ae15a1e7f229fb39e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713404773, "uuid": "3768869f-e1ae-4844-bb72-288aef712352", "value": "T1B9143B46AA408B13C4D72BB9FBDF424533339B64D7EB63019528AFB43F8679A4F62501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713404773, "uuid": "0d87295b-2188-45aa-a687-aef66a824289", "value": "6144:UTAFN2zWwY7xa/2mSimB0cBJzNr6nBwaM/RMd2Px:yK6Y7xa/2mSimLn1Ewj/Od2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713404773, "uuid": "d8314544-77fe-49d2-ab71-61ba777408f9", "value": 206808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713404773, "uuid": "b3319dba-32e7-4d95-be72-b067a9df2a35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713404773, "uuid": "2588e0ea-b121-4a84-845a-d51b18ac97a5", "value": "321367874c11451a5ac8f89551cdf5a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f78904a-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433951, "uuid": "9d75cfb7-b185-41e5-a461-6852e8ec288e", "comment": "Malware payload (GuLoader)", "value": "385f453c2e1447ce087c43d74a6c6bd9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433951, "uuid": "4b19e3a0-f56c-4ee0-a1f2-eee4391aab17", "comment": "Malware payload (GuLoader)", "value": "34a0a440bb0ba86303c4298d72ae80f9f96ab5250fd37073a0e7328f482472b8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433951, "uuid": "fd8fbeb1-1f98-47d6-8e67-fca808785616", "comment": "Malware payload (GuLoader)", "value": "a3b3502e77797ac9858c9126738ed2f374d69236", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433951, "uuid": "c273f92c-4790-42e9-852a-dc2abaf3c58b", "comment": "Malware payload (GuLoader)", "value": "4b7111043eb70c346b6a3007024617b16d765e17489309f8b2b23784bcd25767b7b898f115dcd1d8f5b03c08eab53359", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433951, "uuid": "ceebd803-49bc-4ffa-a768-2c148208d5e7", "value": "T1E22408F0CF0B36199F5B3EDAAC6445924AF88195011638B5AAD817EDB283D2CE3FDD14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433951, "uuid": "34162843-dbc0-451e-9ae6-9d654f62f66b", "value": "6144:xYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf6q9m:62dOBRW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433951, "uuid": "ed2b4bd6-7a10-43b4-9dea-7047db283bd8", "value": 216151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433951, "uuid": "bb2eccd7-6e0f-4989-994a-e0a1b7c84485", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433951, "uuid": "99e6653a-59e5-48bb-83c0-0073e3c3f8f0", "value": "FACTURA2402616 - BP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da979e37-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459068, "uuid": "921cf945-8d36-4290-8ec2-b75bb0976a85", "comment": "Malware payload (Mirai)", "value": "f9ccf66c85aab3e8d3dda16b04f9c17f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459068, "uuid": "88020713-7b6d-47ce-8f2a-81e5cafa4c6b", "comment": "Malware payload (Mirai)", "value": "35354eaed252bb3f8584a8cd58186ead77fc9fc27e7e31b7946ec0dc829b3a96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459068, "uuid": "38993cb0-ffaa-47ca-904b-b289fe3d6d09", "comment": "Malware payload (Mirai)", "value": "3aa63be62c7db4cfe6759046902a2d091e844066", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459068, "uuid": "630a606f-ec4b-4ffe-9556-b13f1fd89424", "comment": "Malware payload (Mirai)", "value": "d79c231435ef77b22ca0c74f2742514ecaf3b2ac9223dce01aa70eed393747275c759722862f1f689517e6e440536e7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459068, "uuid": "c4a23f60-fbc1-4dac-8eb6-c0212b0ecb73", "value": "T1A3639309AB610EFBEC6FCD3706E91B06248D641A21E93F357934D918FA5A24F09E3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459068, "uuid": "2ed9c3fa-49d0-49ae-9f15-eb1fd838bbb8", "value": "768:BFQ6JIpxGD4CaUo4Ee7cczn/hGLO6QVfa8VeceSWeS3sDwBEGiFizg0NoXitI3X8:B9CGja9E2QVfn9jWT3sD9+GX2Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459068, "uuid": "fc602716-5b91-4b59-9d56-6dc7029a26ad", "value": 72576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459068, "uuid": "7ab71b68-7e26-4f0a-b1cc-b79653dfe744", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459068, "uuid": "6a138804-7818-48c5-b91f-8cd46fdd9204", "value": "f9ccf66c85aab3e8d3dda16b04f9c17f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463ffe1c-fd8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713448941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448941, "uuid": "66089614-ae76-4a34-b8d6-b41d0351ddff", "comment": "Malware payload (Rhadamanthys)", "value": "7def16e0ceea0ad69d53e0e636541dd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448941, "uuid": "38093c83-6eff-4c3d-a81b-b95b52e15cc4", "comment": "Malware payload (Rhadamanthys)", "value": "35ed65d9919843300db648bf93ae57d7330095eb1ce18d6c6050db88a2e4f297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448941, "uuid": "3562c12b-b242-418d-909c-0320d2221dcf", "comment": "Malware payload (Rhadamanthys)", "value": "92080bb5ad272cf69f69aa0588856cda4b4b1c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448941, "uuid": "d9a1e2e1-d56c-4de8-8266-2bea1a1657b7", "comment": "Malware payload (Rhadamanthys)", "value": "da5150188b32d979d6254404792375eda00aaba6e9fa22ea466bff356f5ca0550b1bd1a6692fbd5aa8b244e58492d343", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448941, "uuid": "a7b7254a-dcfe-4843-aacb-04a111e05b4e", "value": "T1CB152314E6686AEBC43A433A147DAF66DEC2CD691A1DEC071704FE2ABED31D15B1D320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448941, "uuid": "f74773c4-4b6b-4644-8db4-c83ab7efbdd3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448941, "uuid": "62b2524e-bd58-468c-ba74-724ff737e18e", "value": "24576:gbVB9BI+CacE07NGWx1G0MEL2XH09GIGiSUS00dpf:qVrIacF7dnMBXU9GIzSUlypf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713448941, "uuid": "393c7928-bd3e-4e7c-837d-1c733af06a28", "value": 956676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713448941, "uuid": "850bd97b-5b4f-49f1-8fec-4823ab95eae0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448941, "uuid": "c0a6f918-2dd5-4f46-84bb-0478f115f65d", "value": "DisabilityCharge.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bad4f056-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470611, "uuid": "050ec7a9-75bd-4ee2-87c3-7c683ff3932f", "comment": "Malware payload", "value": "15bd2835c6bc65193291cd2a7155ab42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470611, "uuid": "effc9b7c-dd22-4802-b318-3ca510a701f0", "comment": "Malware payload", "value": "362a6ad3ee41151ec92bc5fb589f4b388ea455e3e10ac2d812426420a20d04a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470611, "uuid": "8b0766eb-09d0-4ff9-80a7-1bda4ae6d6f1", "comment": "Malware payload", "value": "940e4662febc8163cfe2793a6d06e14d92312708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470611, "uuid": "556c2ba8-8bcd-471f-a8d8-630d711ebb14", "comment": "Malware payload", "value": "b2957476355fb95311334cda49974763c0f8b0fcec6d46aa5b4ffbe3f6c885a6fde0f7ab68ff2d4c026e171b34eeab8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470611, "uuid": "eca1a254-3029-40e6-87b8-b51ec23b0d70", "value": "T183D3C62E7A61ABFEE169963107F35F7083A625D227A09345F26CDB181F3128D5C8F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470611, "uuid": "543570bc-6ff0-4334-9ba1-40a68e89dbd9", "value": "1536:DHfGlkuMau3GanIg2rK/c6U1J8iEHLfPti2dSImNEz7ugf7hoWlNDsHrj4hs29NA:Kx+/PtiJn8ugN9sLXoVmCBgAYiCh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470611, "uuid": "4ba9c3b0-ccc9-4890-8293-0a9173bce9e3", "value": 140059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470611, "uuid": "8b1441ec-02b4-4346-92ea-a86d34ba3efc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470611, "uuid": "724fcb04-eef4-4770-9beb-bb206a947e6e", "value": "15bd2835c6bc65193291cd2a7155ab42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a01643-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433905, "uuid": "c1c1f08f-80d6-4843-bb4b-afba17296d2a", "comment": "Malware payload (GuLoader)", "value": "0d7f8e709882acc61cd9366186f1e7d5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433905, "uuid": "dab461e1-a751-4e77-996b-f30e119362b6", "comment": "Malware payload (GuLoader)", "value": "364817faf68a4f6da9d49eeb14735537230c35f5bdd6e0a24e13a1f3652f6e19", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433905, "uuid": "3ee7cf12-7407-4d5f-9ab5-7b59bde96f19", "comment": "Malware payload (GuLoader)", "value": "b6fd422590eb87824051092b8c04cb1e58ab4abd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433905, "uuid": "f4c27b38-dc2c-4fe5-a64f-5ae654fb1be5", "comment": "Malware payload (GuLoader)", "value": "f6f654305c22e46948bf56ff577023f5d22c9b77bf7db5d0eb7c19c78d692e0e675bb37de6c9ab1488fb98a8cd34ee45", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433905, "uuid": "7e9d872e-a695-4955-a674-757f4b2f21a7", "value": "T1C32408F08F0B36199F5B3EDAAC6485924AF48195051638B5AAD807EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433905, "uuid": "840e3302-a939-4014-a654-c6d5fa8453dd", "value": "6144:/YBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfAqNl:M2dOxP6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433905, "uuid": "f8f9ef78-6107-4c35-8f61-f553e75115ce", "value": 211634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433905, "uuid": "efe87c04-19a8-467a-9182-37ad6be92f55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433905, "uuid": "76803d6b-9575-4754-b81c-82280c17d6ec", "value": "RFQ122.494001.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21589c27-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713430840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430840, "uuid": "26260aab-2546-42b3-8113-5937f9ab808c", "comment": "Malware payload (Mirai)", "value": "0e2b118a0ec23dfeca4e088de6959354", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430840, "uuid": "d977f725-8905-4d3b-9bb4-68cfe36596f7", "comment": "Malware payload (Mirai)", "value": "37ad92cca30ef9226eb43c6da6d0658099c3e64373dd11e4e118c69750205880", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430840, "uuid": "64e3958b-45ab-4e2a-972c-abe003e910b1", "comment": "Malware payload (Mirai)", "value": "1ee611d5c9bdfdc0ef03f119193e26d86a1331dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430840, "uuid": "eecb0350-4de9-4f45-9cf0-aecc1939f7ea", "comment": "Malware payload (Mirai)", "value": "eb1dba70ba00ae02aa8fcad17c0dc0c5e500dd81138d9ddb3dbe29fcad9ee5b9ddca4301dae90bec1c44f4d132d72b05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430840, "uuid": "de6049eb-fafd-43ba-ac58-c48de8e6c392", "value": "T141430174E11CE930C9C315B3E05D168772068DA8E8EC356133225BA35FA36EFCB68983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430840, "uuid": "eddf46f5-6b03-468a-810e-5778f7866b12", "value": "1536:DfVPcxTjoptM6P7eEfgd716NYigL1DDkWmbMfEVxvMQ:DfVECphTjId5kYxDDkWmbj7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430840, "uuid": "eb6e0a8a-87ff-4d8c-8b4e-84bdae6e4166", "value": 57996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430840, "uuid": "bc92f5b8-ab89-4d69-b250-53b04846d3e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430840, "uuid": "c461b2e7-e209-4388-8587-0835824861ac", "value": "0e2b118a0ec23dfeca4e088de6959354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76463de8-fd4f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713422822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422822, "uuid": "3af1a8b7-458c-4d9b-a9ce-0fd29abd1d3d", "comment": "Malware payload (Formbook)", "value": "49e038fcffc683c025060ca5610e0ad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422822, "uuid": "c4c5a299-bf96-4db5-8589-bc5cefc25d4a", "comment": "Malware payload (Formbook)", "value": "37fd7b8035bd49b8dfad405a793428dda8cbf623de0133818756d05a1191d8b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422822, "uuid": "9270a4c7-fca1-4b75-89c2-1492fce7ab27", "comment": "Malware payload (Formbook)", "value": "20007286f125b0f2dbd097000c1c3cd014372d1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422822, "uuid": "740066ba-2be6-466e-92b0-3f6879cd362b", "comment": "Malware payload (Formbook)", "value": "37333dbc0e75f26aff18c744b3397d102136a9480aaca00122813dd1fd1c7796d611802099d4e4a2221bbda0b754802a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422822, "uuid": "657e89b9-cebd-44cf-96ed-5ff4fe678302", "value": "T19CD4230C33FD85ABC36866FC9D3160AC03B8C68640D4E7F74EC569AE27C17AD5156A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422822, "uuid": "72a1e0ef-6781-4ddb-81ec-70a3b24d0254", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422822, "uuid": "2a5175d8-8273-4c45-9a53-dad8c6f3d992", "value": "12288:7WkV9mUBhIooC3jjSc6bun4f8vNN3JRSA/DGzf9JEMWI:7WkV9mGuqzjSc6bkzN5RL/Ub9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422822, "uuid": "ab958558-34e2-428d-9866-665da0b1d93f", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422822, "uuid": "68097e4c-d7e0-42e4-8c06-b9ec5d32da69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422822, "uuid": "73394453-97b4-4dec-8db5-b05c5fa6445f", "value": "Invoice copy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee43c40-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472470, "uuid": "f5e223c6-390f-4f52-8659-b9c2422d2036", "comment": "Malware payload (AgentTesla)", "value": "9a6474186b145552217cf4d421309733", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472470, "uuid": "a6145ed4-ed52-4991-bdf8-d8d8ac63f277", "comment": "Malware payload (AgentTesla)", "value": "3815bc3a78dc96a0af4aca4446b3afa741d3910530ae69b06895b0e499d49aa6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472470, "uuid": "8302e97a-4219-497b-bae4-a12145cfaf11", "comment": "Malware payload (AgentTesla)", "value": "b21733889432abe65233736ce0e0289f8f3bddc4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472470, "uuid": "110976c2-f678-48d6-87d0-707564c3b320", "comment": "Malware payload (AgentTesla)", "value": "23be5ca5cb54608cd7f0984cb5f22870b84ab6c9c5a30a49e2f94c60250676f855ff91d9b9d14b6dc03ac54b39df4e43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472470, "uuid": "010b3ce8-6bf9-4d07-bc48-f107d88237bb", "value": "T1C8E4120C9BEC8E08C95D477CF593984447B2E717E243EF2B6DD460E91EB6BC88680697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472470, "uuid": "123f08f5-3642-4488-a70c-daa5719d7220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472470, "uuid": "ebc96784-e2d3-455d-8145-0ebf40efeba8", "value": "12288:urfrr2rrDirIlL3zxlDB3gHSmlNyqrCysnM8f/zR0NIV8ngQItKxKQCHrdWnuS:5lL3zxlD5aTl0VpM4/F0NA8ngQPird8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472470, "uuid": "5ab2f547-7ca2-4296-b48f-bf2378d067cf", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472470, "uuid": "da4f38f5-ed5c-4443-b748-57541fcdbef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472470, "uuid": "9e974b3c-525d-4b71-a528-43c6cf1f4b49", "value": "Gcerti Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec73367-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713467155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467155, "uuid": "7ad348fd-3cf2-416e-aee2-c55f440c609d", "comment": "Malware payload (AgentTesla)", "value": "ca1a3a65e75a3429cbe2e11ead30d934", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467155, "uuid": "3e2b7f21-1212-4187-9674-3fd756f77ecb", "comment": "Malware payload (AgentTesla)", "value": "38a9c17ce48749de677d27b614e3e8f2c407e7a50813458b69fcebc815224bd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467155, "uuid": "9cdf39cb-9200-4eb8-bca5-c9b2c3ed82f6", "comment": "Malware payload (AgentTesla)", "value": "ddacba9157a3a339705845576ad243c32b331da3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467155, "uuid": "0c075451-7eb2-475c-8b42-2586bb61e801", "comment": "Malware payload (AgentTesla)", "value": "09dc20f8dffacdc2bc101eb702219dc5b7a6f216363e41a4c47c443ebe2a14d10ba92fff164f54142a334c4c4776e535", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467155, "uuid": "aef12735-06b4-4a2b-b599-7ae61855c276", "value": "T164B3BC1267FA5208F5F76B88A97611350B37BD9AAD7DC64C05CC290D0FF3A908825BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467155, "uuid": "dd71ab7a-43a4-4931-8fe9-800498b0f437", "value": "1536:j2AyMtIU1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:j2juIU1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467155, "uuid": "e98ad22f-770c-4b7a-8819-6275c78f0486", "value": 115874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467155, "uuid": "fa27de38-4b82-4329-a73f-ad2e6e2d6a0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467155, "uuid": "6e7d7bff-6c55-46eb-a3a6-8c0dd5ba27ac", "value": "DHL Receipt_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a36156b1-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713471001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471001, "uuid": "7bc903b4-22f7-434c-a710-d8c70cf4e0b5", "comment": "Malware payload (Gafgyt)", "value": "168c05de8d0c9a9c86514bd6b2aec7c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471001, "uuid": "78c2c36d-5778-403f-a6f0-12ed58f6a4af", "comment": "Malware payload (Gafgyt)", "value": "39031d576a69fad46a1d3d6d08dbe637126181ad47e51e96e643c6c35de614c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471001, "uuid": "c4f5a68b-7541-4714-93fb-e8449843c01f", "comment": "Malware payload (Gafgyt)", "value": "ba41797b64490de54294e8e289e15815fb610a15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471001, "uuid": "f9410a78-c27f-4a99-b2b8-5c31692e579e", "comment": "Malware payload (Gafgyt)", "value": "eeb53dc0645091b2f884a793796af336d2e53fe29fd579344200b3ad1e650c3e7976a7e544c604b0519ac42fc1ba224d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471001, "uuid": "a1272765-44c8-4925-a363-87cd018aeead", "value": "T1EAB30741D6548627C2D32B7BAB9F438D3336AA54A7E733095528BFF03BC27981E3A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471001, "uuid": "9d213423-f46e-4a0b-b5f0-b163c31998c3", "value": "3072:HgvUxOcKFN+B9Jy8D3XvpIhfXX4CHz9cm7QnKQXaeW:HDEKXy8rvOFXX4CZcm7QnKGaeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713471001, "uuid": "20400e9c-ae6f-4f66-ab15-492d34f03f37", "value": 111561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713471001, "uuid": "16ae968f-5733-40d1-a9b4-fb8152c7793a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471001, "uuid": "8fa52cb5-62aa-4380-a87d-e45b0bffb343", "value": "168c05de8d0c9a9c86514bd6b2aec7c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9692e7-fd21-11ee-a120-42010a9c002e", "comment": "Malware payload (Quakbot)", "timestamp": 1713403129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403129, "uuid": "2d8a6d8f-81cb-40dc-a537-40d23cccb27a", "comment": "Malware payload (Quakbot)", "value": "acaf01f83da439915027c3e2e900c8dd", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403129, "uuid": "5bc5be64-1b72-41c5-b02d-4f9080ec54e8", "comment": "Malware payload (Quakbot)", "value": "3b3bd81232f517ba6d65c7838c205b301b0f27572fcfef9e5b86dd30a1d55a0d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403129, "uuid": "c4dfe81b-cb59-44cf-8e1b-de09f509bd99", "comment": "Malware payload (Quakbot)", "value": "2861b4e463fa89e05f2d7d629fae5140cef49843", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403129, "uuid": "61328c46-a3c5-4b88-afdd-fbf61f674b46", "comment": "Malware payload (Quakbot)", "value": "80a7b5b1ffbbc0df49ef2b24ad9c946048e7b96baddb0ed26bc272dbf60f06537a0ca37dafcf7f0f9d14ce96f5fbda39", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403129, "uuid": "ab6ea674-9044-4dba-a3e6-891ffab718d9", "value": "T15EE0CDB3F03BC420D23138684F06555FB81B448B1F895E56B0E101E650435994A6B67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403129, "uuid": "d974e952-9c95-43df-b2c1-b0d1fd1e499a", "value": "6:hcq/KwAt1aFVlOjbRb/Yd6kj1kTBq/KwABLLLHVaFPYjbELqFcRO7KUYepLsTBqw:BKwKaFVwjbRc0oKwWLRaFPYjbiqFcRO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713403129, "uuid": "c856d903-c8e0-49f0-8fd0-72ca4debb49a", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713403129, "uuid": "1e32a2df-8f9b-419c-9b6a-365754c3a497", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403129, "uuid": "5b7d8122-6e7a-467f-b13f-a9ca6a5b7b8a", "value": "u2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac91864b-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450830, "uuid": "92d304af-15e7-4e55-a642-f5d579893618", "comment": "Malware payload (Mirai)", "value": "dd153a65c7f50f46cb2ddc98ac31f054", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450830, "uuid": "0b139413-15e2-4610-8e99-1b22593c1b10", "comment": "Malware payload (Mirai)", "value": "3b8718b51d2e003026150d1720203ffe37c33fe623c8cef2108307937cb3df72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450830, "uuid": "884ced40-05ca-41c8-ad4e-4f8510482527", "comment": "Malware payload (Mirai)", "value": "3b9e695efccd0ae37852b1ef857961d3deca31f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450830, "uuid": "83427790-7429-4c33-b40b-11adab1affcb", "comment": "Malware payload (Mirai)", "value": "ab163853012372ea20d2e5a8db87d94cff8674755e6797396ed35852ca0b53272b4c7249bd0ea61b76ad73c6d0e32d40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450830, "uuid": "8668734a-77cd-4c76-945c-efb12d962bbc", "value": "T17E042A46EB404B13C0D627B5F6DF42453323ABA497EB73069528ABF43F8679E4F22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450830, "uuid": "f94f51f9-c581-47af-a503-722e289cb2bd", "value": "3072:+9/MEs+DE3egQEkvamZ+S70bRp1yPqZBF6S/hJjogM/RP7XIr:+9/FE3grvamZ+SgbRbrBES/XMgM/RP7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450830, "uuid": "70d8e37c-5919-4d08-8bd0-d19f4b51f376", "value": 179757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450830, "uuid": "f0da9362-9aa5-414a-9645-61afe3f3391d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450830, "uuid": "a787435c-536f-4e55-9e00-e58b0f998b8d", "value": "dd153a65c7f50f46cb2ddc98ac31f054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede36708-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419587, "uuid": "e2b6672a-996c-496e-b849-004c672bbc38", "comment": "Malware payload (Mirai)", "value": "caa9cd99e5c8476af9df276a84d0d7c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419587, "uuid": "012d3245-7f25-4224-bb13-cc77da38a2c9", "comment": "Malware payload (Mirai)", "value": "3b9a170902335984dfef5c60ba8ae09b0fd0944637ceb7999c5f409139cebd47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419587, "uuid": "c0463686-30d9-4f29-a951-0d0d8f53c97f", "comment": "Malware payload (Mirai)", "value": "297ad9a1439c704422962e8258c05a5486978fe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419587, "uuid": "f30f8661-50ec-487a-b054-c46b0d0774b1", "comment": "Malware payload (Mirai)", "value": "c06913ea5ab2c5e9f9b28f00b32430274a3fedd4e991ff407ca3578f2697885cb5d52d51f7ef69bd9c6539908df3e0d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419587, "uuid": "0041300d-88aa-4fe0-94c3-39284638fbb3", "value": "T1C8537C31F4142CB0C85215B4B438DEB80B2368F552D92C725EADDA9518A3EEEF58DFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419587, "uuid": "52ba09af-220f-4689-89ba-fd73b54f1f50", "value": "768:hBENyYufhyHBJym3xGgB8uKDS5UH/usIFrLVOhBimh5f6FcNE1A0w/zSIEr:my+BR/8O5UH5tBiAJ2A1/zGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419587, "uuid": "5d7eb621-35b3-40e8-bae6-2a1e7d132a53", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419587, "uuid": "2f08376a-17a7-4648-843f-fd76f24829b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419587, "uuid": "dcf251b7-4d15-499f-a2e5-35165cf8da04", "value": "caa9cd99e5c8476af9df276a84d0d7c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b72f44-fd53-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713424645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424645, "uuid": "cf826427-27c9-437c-a4c4-fcce3b4fd8d2", "comment": "Malware payload", "value": "4f036b9423890d0b407466981b906269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424645, "uuid": "d6b8ad23-fc70-47f3-abf4-cf879cfcf20a", "comment": "Malware payload", "value": "3c2bc4bc7f290b6834833fa4d770927ae164a5a535ec6cd175ab1e1bb8997224", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424645, "uuid": "07d87f54-d3a4-4a92-8afc-f0ae83b916ec", "comment": "Malware payload", "value": "fe6706d6de8d6bb0ed6d9b12bf0be5296f485635", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424645, "uuid": "5c15074d-106b-4fd6-86b3-54d342e61ea0", "comment": "Malware payload", "value": "778d53ebcf4ca30d2cc5ea553b536ee7bd3726b75c9e02e89762372c3acc5df547c9f4c5ee2b0885c81db27e55005b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424645, "uuid": "e35e96e4-2252-4b73-bd57-d1bc3bfa9d2d", "value": "T1208733AB6211486BF159BE3BF8948F713461F00526F2361B9BB48F364DCE5E3AD34624", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424645, "uuid": "87c54e82-2c51-44e8-a9ad-66da75a3b71a", "value": "a3d629f5a29590a5e3c40a85e9084e58", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424645, "uuid": "a243ba16-0d9e-406e-a771-bce8e43149b1", "value": "786432:YQZeCRQwKXohj7b0o+GU52j6+s7LWB75zu2OorN7W8QOd92OY:YEPQTXQ/bv+t52qHWB75ierN7Wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424645, "uuid": "a218e4bd-f063-4234-9bd9-66225e6f7d50", "value": 38656985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424645, "uuid": "c4a526a1-785a-42fb-b62d-8fc4fe4c8c11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424645, "uuid": "6c6a3e89-3efe-4f89-9407-7e7c4dddf32f", "value": "Sp\u251c\u0434ti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc21725-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1713457704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457704, "uuid": "6ef9ad82-c3ff-43d3-9653-eb73f60d9f2f", "comment": "Malware payload (Kaiji)", "value": "e97eef55eb472d2ade9bc98b43ba2eec", "object_relation": "md5", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457704, "uuid": "da9ac945-4e43-4ac4-ad8e-b62701787cda", "comment": "Malware payload (Kaiji)", "value": "3df59e66242b59fc077970fa0f3c74d82a24c673394969041133f8bee8c70775", "object_relation": "sha256", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457704, "uuid": "73841022-9327-4ab6-adc8-b78b430198c1", "comment": "Malware payload (Kaiji)", "value": "426529f6ce6e495a669d00a542bc4c7ef3722e53", "object_relation": "sha1", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457704, "uuid": "0535add1-4afb-4034-b30b-f91c2d8cb0e0", "comment": "Malware payload (Kaiji)", "value": "38715fbc63d705c10b295bfc4f14a7d5c0796c15a18267c89d309426908172c637c8d7c62cbdac7721ab8a0427d9448b", "object_relation": "sha3-384", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457704, "uuid": "865f2f1c-de44-4379-a3ee-b0a4ea815d54", "value": "T19A26F712BF98ED2FD694213187B7C23033D57D1481E07433AA96E71E2EAE275991BDC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457704, "uuid": "0d5b394d-f9c6-437c-9647-dbd9cd098c38", "value": "49152:XralYsYZ/MjJ7fhP2pCQLg1xbnZdY3MnO:Xr9lMjJ7fcjd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457704, "uuid": "5981f91d-7116-43b1-b64d-4869290ed07c", "value": 4786658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457704, "uuid": "db393544-5aed-45bb-b0f0-92575d2ce3d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457704, "uuid": "a21a9e94-fc30-494e-bd29-106a77dac543", "value": "3df59e66242b59fc077970fa0f3c74d82a24c673394969041133f8bee8c70775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae56d33d-fda4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459423, "uuid": "867fe1fb-749c-458e-a5d5-55822f56496b", "comment": "Malware payload (Mirai)", "value": "3adb3a4bf4939d9c0b2510d12fd91abb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459423, "uuid": "92aba5a4-6894-45b3-a791-73dcaf40158b", "comment": "Malware payload (Mirai)", "value": "3e2a4502d0ff6aca1c5494747103750a48b9a951f9cc841ffdcd5d13114d24bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459423, "uuid": "c5be3864-fc9c-47c6-8b0a-e9e29c546822", "comment": "Malware payload (Mirai)", "value": "9b2ca276cfe51cf44c4625b690884b523c4f8628", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459423, "uuid": "277cd278-2961-4ae4-840d-c7130205562d", "comment": "Malware payload (Mirai)", "value": "234115d37a40abc59a1d44a4c3fbae5473c1bc00031c3a604fa8687fb324ee0eed8c7f99505f3349a93a55cf290fdabd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459423, "uuid": "8f059441-9033-4a65-b334-4cd18c4ee11f", "value": "T1E163844E2E218FFDF7AC873487B74E32965823D622E1C684D15CD9012EA434E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459423, "uuid": "a9ba69f8-8934-44a0-a1fc-95d06b0d72f3", "value": "768:b03j8jEJbSNYSjsuIbF7eqBMd67ZdCem94Np8kX8wCiqpUMR644oAw75nUMI3Zkn:b0wjEJOLsuIbF7ehaCe14gSb5nW3Gvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459423, "uuid": "42fcb77e-b3ae-4ee9-bcbc-311f6d0e2fd3", "value": 72576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459423, "uuid": "88ec07e6-11e2-4fc3-b858-c7b7e9636a13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459423, "uuid": "98983874-d32d-4bc9-8d3b-e47081b3b416", "value": "3adb3a4bf4939d9c0b2510d12fd91abb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eccf60d9-fdcb-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713476278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476278, "uuid": "41103988-8379-49e5-95db-8fef9c410b6f", "comment": "Malware payload (Amadey)", "value": "a0de5117f2db3409eeb42464b5c2e811", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476278, "uuid": "48a35471-0bf0-4a70-a003-b8e27c1a2c61", "comment": "Malware payload (Amadey)", "value": "3ed276242a69770fe215a6cb9941f57e24eb2289635c65c54353fe62ea015e8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476278, "uuid": "4b829664-fd1e-49a2-9912-5316796b5a42", "comment": "Malware payload (Amadey)", "value": "20300a63f6c8ccce917110e53bd8d4f1a49407fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476278, "uuid": "22571f8d-8b46-4e50-bfba-74b0a6f94606", "comment": "Malware payload (Amadey)", "value": "ac2656187dee21305f0025eb5cd02c0618f7bc2c32bf9a5d9ccfc0d90cc3b40d8fc08163280ac8409e90a264af350cd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476278, "uuid": "23d77eb5-a942-43e5-9618-63c8c7a545dd", "value": "T100E53B91B80676DFD48E27789837CD42B95D46BA0F1048C3D868F4BABE67EC115BBC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476278, "uuid": "a1ceba01-5d21-4968-9359-295d2a010e48", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476278, "uuid": "3d1d11b2-b040-4478-832d-6b5905ab8fa1", "value": "49152:hrS87rJwyCOjzzXkKkuVVofoPEiNOlpRV1or6/mM4:hrv7CdOjzz0KkuYfoPbNWnLor6+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713476278, "uuid": "ad876f30-5219-44da-b4ff-ac06bf3e156d", "value": 3102720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713476278, "uuid": "128f4b6e-7a89-444c-9af7-7086e1bce7ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476278, "uuid": "b2cc2fd9-dcfe-4013-a06f-8baa3a0554ce", "value": "a0de5117f2db3409eeb42464b5c2e811", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d625060-fda1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713457891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457891, "uuid": "61c665a7-e910-49de-b0a7-0a897b0c6538", "comment": "Malware payload (AgentTesla)", "value": "2accde69d71a0b3b2bbcaa71fdc3f6f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457891, "uuid": "28bb8fd3-d99e-40d6-990b-b98af22edfc9", "comment": "Malware payload (AgentTesla)", "value": "3f47691966661e7411d19f3d06774eda985a226bce2d887ab0a95fbdea35ae45", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457891, "uuid": "30fc04eb-d992-45e7-b033-e20e738c267f", "comment": "Malware payload (AgentTesla)", "value": "2aa5e4fa9cef353132a80338bb9f586eed0f8f53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457891, "uuid": "d3848f29-0d5c-494a-9448-420e7812b410", "comment": "Malware payload (AgentTesla)", "value": "74ce5ddaef267023960db81859b66edb2773e1880170dc630be3e5c43e83c8d0adea9720bf4f8cbea32d0e274e8bc6e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457891, "uuid": "53033984-c7de-4eb4-8b12-308c3c012fce", "value": "T157E4235A8BBBCB38B26C33D32138F946524A1707ACC92F3C06192B04E965D5F5A767B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457891, "uuid": "91a379f5-4f54-45d5-8205-1cac6aca8da1", "value": "12288:62quqWl77godZdya8WzUCklrK81xZPhtS95eFOTOU16sNEP:hqk7DdZdzoCklr91jfSjeQaU1NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457891, "uuid": "04d4780d-3b17-43d6-a031-ecd4ba56ac54", "value": 667441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457891, "uuid": "b2d03baf-8003-411f-be8d-3af4447dc36d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457891, "uuid": "ad8ad683-cdab-4906-b21d-b4f074c21ee6", "value": "SOA MARCH 2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c198e17c-fdba-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713468904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468904, "uuid": "d3f64c01-4a0f-4957-9100-aadadd1cdadf", "comment": "Malware payload", "value": "e133869ae6f2aa011fc5a2a0dc91d15e", "object_relation": "md5", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468904, "uuid": "6aa4bf04-7895-4035-bfe7-cd97fef9f6f7", "comment": "Malware payload", "value": "3fd83cc93718799c19670c69ba7dd44596defdd2adff3709c4a24d14d13a0334", "object_relation": "sha256", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468904, "uuid": "0eecb03f-3297-4f5b-84a2-10ec6f26879e", "comment": "Malware payload", "value": "e39aecfd69503f3737d4ca8568284fa475e7c101", "object_relation": "sha1", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468904, "uuid": "b96cb655-815d-4ae4-badb-397e5d9d7ea5", "comment": "Malware payload", "value": "3ce0ed23ebdb90742f5b38e6f5f079e98aa011e32536fbbaa96ed3a6bc1e6a81f246cca87ec46943683834e83e8e39bd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2024-3400", "colour": "#5EB158", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468904, "uuid": "5fc18fbb-148d-4b07-8da8-b5e98306a693", "value": "T1D4263950FACB14B6D9031E3011ABA23F67325D058F24EBD7EA447F29ED3769A093225D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468904, "uuid": "d64a8fc9-9da2-4697-a818-5bdcd15455ae", "value": "49152:R0scvjdrB+d9NlcN3rYXoLqN+gR+tP8vQ1SYF3jWg//iX6uDgEyb0B1:RAX+dPOJrSpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713468904, "uuid": "0380e851-fbb9-45f4-af7a-72ad7be22680", "value": 4702208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713468904, "uuid": "8f213345-a9f1-4ca2-a033-5cd7af6313ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468904, "uuid": "0f8472ac-e0cb-4ba5-a689-4c8293269e14", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb36eae2-fdc4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713473269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473269, "uuid": "470fc756-6bc2-407a-9be2-58301df6d9eb", "comment": "Malware payload", "value": "c5140207d2276f64b3a8f4ccd3487723", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473269, "uuid": "2e379115-3ca3-4823-aa46-dc73b531a126", "comment": "Malware payload", "value": "4102d9b119dd8eb1f4e74ccea7c23fa7fc84d44cb8079abdabbe51629ea25ec4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473269, "uuid": "5f64a2a0-871b-4687-a527-592691c05047", "comment": "Malware payload", "value": "4d688086cd47a23444b2329fbd83a3740c40d0ca", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473269, "uuid": "39942adb-5abe-4e02-898e-248cbfa77ebb", "comment": "Malware payload", "value": "485bbd7ad158cf203e748336c2da105a67a4b7db116cf903f353a23127376fbedb480925a15f8a533e2d167a4d429b69", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "gamaredon", "colour": "#AB67B3", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473269, "uuid": "138c9f96-9865-45ab-aafa-6b34b321ba69", "value": "T1E53110243FCA2227E6B98E37500EE701D798750BDA02DF2D42E1408CA875500BC7DDBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473269, "uuid": "2fdc6945-eb6c-4760-868d-f76b922401a1", "value": "24:84NUgXnhSSx8Aie1RcNLQO8cS6ce54QZab+mE:8EjDbHSZaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713473269, "uuid": "2ce17ec1-63ad-4332-aecf-13a71959aaca", "value": 1827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713473269, "uuid": "e0ebf99f-57dc-4948-800d-30e445ac4aa1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473269, "uuid": "32bdb311-3012-4125-b976-d55e896f3fa4", "value": "\u0415\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0430 \u043a\u043e\u043f\u0456\u044f \u0441\u043b\u0443\u0436\u0431\u043e\u0432\u043e\u0433\u043e \u043b\u0438\u0441\u0442\u0430 \u0432\u0456\u0434\u043f\u043e\u0432\u0456\u0434\u0430\u0454 \u043e\u0440\u0438\u0433\u0456\u043d\u0430\u043b\u0443.\u0406\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0456\u044f \u0437 \u043e\u0431\u043c\u0435\u0436\u0435\u043d\u0438\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0443 \u0441\u043b\u0443\u0436\u0431\u043e\u0432\u043e\u043c\u0443 \u043b\u0438\u0441\u0442\u0456 \u0432\u0456\u0434\u0441\u0443\u0442\u043d\u044f.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df73eb2a-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419562, "uuid": "2189b9e8-33ee-420d-b279-5eca6ed99114", "comment": "Malware payload (Mirai)", "value": "4a7ca8c328cb568cef9f3e2ab48d30b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419562, "uuid": "3a945683-30dc-4b78-ad2e-66bda8f5d1b6", "comment": "Malware payload (Mirai)", "value": "4164c7efaf18295255b8953b67a0cdb82a5add0134d1fc42e2fe3ebe14e16cf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419562, "uuid": "64421d6a-7562-4044-b6ca-09f3a1bef259", "comment": "Malware payload (Mirai)", "value": "39c215d038997c8cc7f0f1cf8eef1cea30beee9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419562, "uuid": "00514293-efb3-46f6-b12c-79872e326179", "comment": "Malware payload (Mirai)", "value": "ca090c5b04a2e72210646ad907df84ba39d1962cc59997db22b0727d88e64b57c6e2bf068d72ec76deffbff7c06b468e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419562, "uuid": "521303e9-092e-4d77-a86d-2cc82266667a", "value": "T1CC732801B7190A5BE0E31DB03B3F6FE197AA9EC221E47149395FBB819671E321446ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419562, "uuid": "206a994c-0c25-4d48-a811-d12bde5d4700", "value": "1536:kvqIc6JbBfK84owQftDxCyukp5YmULHIrznrzq:tEi0wUvrzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419562, "uuid": "535fa07a-a6a9-43c1-969c-6b6ff1f24845", "value": 74644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419562, "uuid": "3f379bf7-abe3-4b4b-869c-45fefb017db3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419562, "uuid": "a181dac6-b10e-4955-b863-31612ddf3ab9", "value": "4a7ca8c328cb568cef9f3e2ab48d30b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd710201-fd59-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713427236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427236, "uuid": "1adb767b-fd2c-418a-b901-17a5983b42f9", "comment": "Malware payload (RemcosRAT)", "value": "ba91098f69e003ca4d4d9c83fa6350d6", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427236, "uuid": "a133435e-96de-48a9-abe5-0966420fe46e", "comment": "Malware payload (RemcosRAT)", "value": "418c376ea99f08d252dc0ce3650056497a2e180a7fb52bdb4a1a1cb661ef013f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427236, "uuid": "89f3ec30-7551-4890-b24b-588a36d2f11c", "comment": "Malware payload (RemcosRAT)", "value": "3553a1fe2fdbd2940a59ed20fb361781b6150abc", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427236, "uuid": "62133695-a042-4af1-8465-73f6b569d64d", "comment": "Malware payload (RemcosRAT)", "value": "5b76190d079fb9ef7194ee6aa56908c047abf81d31ee83b699f992f09d05107fe30001a2286b5160eec2c24719d8ed03", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427236, "uuid": "441ca078-727e-4100-87b4-e263e3b0f56c", "value": "T1D4724BE5A94D10318D4F23E9F528C694D86B40DD4E2211A5BF89474F2077BA8F3BEE4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427236, "uuid": "788ed08c-3f90-4625-abc1-94f15c117f11", "value": "384:+uMcrrXFo5t8VvomRWq1hn+h/RW5MaMIN0Oq5u2:+tGov89lRW6hqZWqaLGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427236, "uuid": "ea7bdfbe-8dab-4e70-8862-a6fc1f802294", "value": 17363, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427236, "uuid": "7c381f3d-17a8-4deb-ae40-c2370946a808", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427236, "uuid": "e63e8484-dbc7-45e9-bddb-54443faae9af", "value": "DANMADETECHMXGPT_A002054700000000000.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a4804f-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472473, "uuid": "5cc632db-3527-43f3-ae13-b54d049c01bf", "comment": "Malware payload (AgentTesla)", "value": "357819113a4c45ae00b90d06bdd54f67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472473, "uuid": "a9755e74-342c-4ba8-a59b-375b58f10ad4", "comment": "Malware payload (AgentTesla)", "value": "41c1924e758c705eab2c725624c7c01923601d805c3e4ebe6cac379e32ed4140", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472473, "uuid": "38a7424e-f859-4e5b-82eb-290a92f33cbd", "comment": "Malware payload (AgentTesla)", "value": "ed16e3a8b5d359f6f59cde2cfedc619bcf24bbfd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472473, "uuid": "690014f1-0200-46c9-8148-f047fbb73147", "comment": "Malware payload (AgentTesla)", "value": "c39b89feeba314241b12f1be38a0392878dd26f36694cc878e25d34392334d3312d75b00614df61dc36fb2431e6f9dbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472473, "uuid": "c531dfd8-955f-4ac5-8f12-63ee00f22348", "value": "T137F42244FD0D6237D89556FB1011627043B3F68B2639FBCA1DE6B58DAAE3B001686F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472473, "uuid": "f06b1e4c-7ac3-4865-9a31-65af66b46aaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472473, "uuid": "72a556fa-9222-41a5-8685-c76337d6b637", "value": "12288:pGL21ILpqe2cWjoI8F1P3FkbBrmofmjuFP6U74BYE3+FhjXmZdwwpIl:IL21ILpqerAY3FkbZmofmvQFh6Hq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472473, "uuid": "6556738c-8ad8-4e90-a28d-1c6b4dea452c", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472473, "uuid": "bbe49ea4-141b-4846-8777-aab9bf11277f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472473, "uuid": "a92e2719-7f29-4ddf-bbde-d9503e931a5a", "value": "KZWCMNWmmqi9lvI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c29535-fd9e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713456919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456919, "uuid": "3fce3c99-79ec-4d60-bdb9-96c52741e274", "comment": "Malware payload", "value": "ad15c8f35af52d9258c025bc2f051e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456919, "uuid": "00d4e0b0-f1f2-4ec5-ba72-007ec0dada91", "comment": "Malware payload", "value": "41ca9b3177da771632347aeee0aabda5da37954f8933f80738f02f4fe07cbca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456919, "uuid": "62e70cbf-45f8-445e-9e36-6ebc07f5c380", "comment": "Malware payload", "value": "042c427cab621421a89a87f83e76361640cb9bfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456919, "uuid": "0411d760-387c-4cd9-b4f8-fa36330ed625", "comment": "Malware payload", "value": "07f9364cb1b9c07cd162f23c539a7f6b55bb65d84eee5209ad925e1e7fb84205e6be0972de17f09bf285a556a8f74fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456919, "uuid": "72eba8c9-2344-453c-a13b-716d08f862b3", "value": "T16F04B84643AB19A4E44714F4F87AC87533626E609E33525E287C76BF69BE0CEDCD0236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456919, "uuid": "147b879d-4c64-4529-bb7d-b5d42cc99f33", "value": "4d14d19b876bbb7a86ffba329be9d956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456919, "uuid": "3d5307d4-bfbf-4121-a5f1-5c8fccfc8590", "value": "768:lfGgTViahszDOtfGgTViahszDOKJBq9YfGgTViahszDOHefGgTViahszDO:F4WsO94WsOKJBq904WsOC4WsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713456919, "uuid": "da0ecb28-aa18-4c6c-9a9c-b3d4c3ef6a29", "value": 188960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713456919, "uuid": "bff8640b-ffe3-42aa-a422-51275d9fd2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456919, "uuid": "2678584a-84d3-4658-91ec-08bf7befb488", "value": "last_stage", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dc0f98f-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Nitol)", "timestamp": 1713433572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433572, "uuid": "72f9e50d-fb0e-4fbb-a555-8fb3606b139e", "comment": "Malware payload (Nitol)", "value": "58209232dc0242ff09f700e66de192ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433572, "uuid": "edc2cda6-1e56-427b-9cc2-2c5d134a134e", "comment": "Malware payload (Nitol)", "value": "42a3d4f8ff7f4831a8925bfae62dfd25dc01e77f21ed7c9f9588e0bee4a0373b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433572, "uuid": "094a7f68-5a71-4ad5-be0f-c4997394dcc5", "comment": "Malware payload (Nitol)", "value": "bf272010f72c33f7aa3fd1a7ea3036d012e40dde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433572, "uuid": "216e4a25-ce8f-4c9a-9a35-fd50cacc7716", "comment": "Malware payload (Nitol)", "value": "e98532fd33d86d36b4cf360cb976d01b2c0a666d165aa331a82d188186ac627f975a9623d90b0f913c6edb59ff1fa86b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433572, "uuid": "39ff63b7-a053-4a8b-93b6-3b0dfe4624f6", "value": "T17C02B0BBFA5ED1EECAE099353728961B39499690CB7F1B4C5CA9F6CD5CB10480688730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433572, "uuid": "e6eaebfc-5e8a-41ab-a559-8f5d1932d6bd", "value": "7f1935d25bd798408d40412db873cc16", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433572, "uuid": "2ecb2024-ea69-4b59-9147-5a1ad39fa6a2", "value": "192:8Bk2UvX8HFgpVA51APmbMWNkOEaZX3U2Nb:8q2UUkA51oWNZZNNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433572, "uuid": "6035b885-0a53-4607-83ac-58ff3f96391e", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433572, "uuid": "48436b41-8cf4-4498-bfb7-1aed128fe762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433572, "uuid": "cd34b4bf-0e0c-44bb-b0be-833e8f2eea66", "value": "58209232dc0242ff09f700e66de192ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ce033d-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416627, "uuid": "074dee43-4892-487b-9495-f1220aa23acf", "comment": "Malware payload (Mirai)", "value": "ffa14b284d5f05107608d3c20a97b7de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416627, "uuid": "f616ec2a-c243-48a8-b27c-c0307d2c8e38", "comment": "Malware payload (Mirai)", "value": "42de2071f8cf51ff9dba04feb84ad342461300cdcbea7e18c55f112d3a648d36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416627, "uuid": "a5c0f199-0e55-48ef-9339-6a1d96de11c0", "comment": "Malware payload (Mirai)", "value": "4578161986cc5a0471e996a4fa626619ddf30687", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416627, "uuid": "d5c8fb09-5ad1-4136-9ead-9cca5aacebec", "comment": "Malware payload (Mirai)", "value": "0e1c41698b016ccb90e21f4e677b2c2198a07f2ee25f9ccffdf4ed7abcb21b304d3b66ca49e119f191f3fe2df0e63515", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416627, "uuid": "5b003802-e1bc-44f5-a49b-361dc40ebcd2", "value": "T18EA2CF151B17DFF1D4E05CFADAA1824B7A1937FC90BEB5F368908325B7C25462EB8844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416627, "uuid": "b9796050-5201-49bd-af47-e667ce56905b", "value": "384:lBx65lmnprlxorHVkmyn6qpyGUf3dD3bksZ5YILCDobdnTUsh7qmdGUEpia5G:lBx0lQpROWm0JwnPB3bkQ5YuJbdQs9qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416627, "uuid": "381b736c-d2d9-4f0c-9395-a012236615bf", "value": 22612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416627, "uuid": "b042ddec-f201-47c3-9977-ae5798eb7f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416627, "uuid": "b4af0704-024e-498e-8b0f-1b10f9487cbb", "value": "ffa14b284d5f05107608d3c20a97b7de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6241d326-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433955, "uuid": "23f699c4-537e-487a-b4f7-87f0e172352b", "comment": "Malware payload (Formbook)", "value": "233da05dc6c62704603e0da7f3080979", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433955, "uuid": "51bcf34b-ebc2-48d9-a6bd-fbc3a6db0c8f", "comment": "Malware payload (Formbook)", "value": "432c7b2facb95ba5867473d02a2ca1e25f8067f28669c314a3cf2924bdde4082", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433955, "uuid": "911f11c6-8854-4cc3-9c47-eb8ca7878284", "comment": "Malware payload (Formbook)", "value": "352c6e4794d54d84b08b192823b4d58756332b5c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433955, "uuid": "90d5bf20-3610-4bbe-8015-6d23ca03f2ef", "comment": "Malware payload (Formbook)", "value": "ccceb9a90e0d9d3fce8dde7097aa9a2d868d0b2d5d526619e335067c983700f7dc7c45acd1f49dc5e4015e697352dce4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433955, "uuid": "fc2368d4-d5a7-4547-a0dc-f4a92cbaf051", "value": "T10A544BA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433955, "uuid": "6f1db2a1-dc1f-4f6a-8063-48ebb00c189b", "value": "6144:LhdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOb18CoBnNFr:dnS2ImF5op3pnB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433955, "uuid": "3f297b3d-ea2a-45f6-b092-59203e7e4f8f", "value": 285430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433955, "uuid": "0c7904f5-e605-42d0-bcd5-bbb78a199fe7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433955, "uuid": "7a8e70c4-99ab-4350-b5d8-de17126ac947", "value": "Order Details and Specifications.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c09cdfa8-fdd7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713481358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713481358, "uuid": "b8f83e17-6427-4bb0-9fa8-c706c9bc390a", "comment": "Malware payload", "value": "f9faae7acc66819bafd5523f719d5c11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713481358, "uuid": "0afa79b9-cea6-4b9c-878c-64c3001962ec", "comment": "Malware payload", "value": "4404c09ad18da9aba1945dfb2975e210ff96ab3698e5c075bd6c8ec57cf854cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713481358, "uuid": "bf894928-c8ce-4790-9461-8a630ad790af", "comment": "Malware payload", "value": "c424f400216b27f0fdd919b39fb01920c6e2cfe3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713481358, "uuid": "19136e23-e456-4285-b435-214a3ff67173", "comment": "Malware payload", "value": "595bc3aa58b0fd2736d97fe0241b497f4d369fbb5cfd9857bbdca24d3dfd0e5c2b0bcc3d6b6d60bd83ed6c77048cb2b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713481358, "uuid": "46bcbd5f-710b-4ce8-a362-65a162d2b4c6", "value": "T1C3F63356B3454CD4F49A9B3BF8A1861376B1B0574BC7E3832BB85F110D576E2AE3A380", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713481358, "uuid": "e536b91f-b60a-419c-9a09-e3c53f1891b9", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713481358, "uuid": "cee69e95-78db-4bc7-80fa-149b46ed5fbf", "value": "393216:CV+M4eN00nY07eFsZETDfDgOREc64qDW8Y3+d9T4Q:CVCeCLsZETb0OZcW8YOd9Tp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713481358, "uuid": "4daa5723-8a6e-4c55-bbfe-08a624bc1958", "value": 15929368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713481358, "uuid": "94319e88-e448-40ce-94e9-53d300859c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713481358, "uuid": "e766fd20-e034-4bc9-a8a0-638a7b173b49", "value": "s.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1651f30-fd70-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713437068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437068, "uuid": "db885ad7-5874-4706-9e00-bc5291a22334", "comment": "Malware payload", "value": "e414dbc175518f43cce737ade647903b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437068, "uuid": "52e65360-6cb5-4afa-a287-87cf52282afc", "comment": "Malware payload", "value": "45799010c5f1af00c77d8954e3073d9c006e9e6087aec818906e2ec0988487c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437068, "uuid": "81ce332a-7f6b-46dd-9a68-835119225f4d", "comment": "Malware payload", "value": "c4a1a3f6bf764da551c9c8bc2d18aa8f5f30f8ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713437068, "uuid": "a9199fcc-4668-42f5-9e76-355805e577d2", "comment": "Malware payload", "value": "087e4817ec81ce338e388617bfd2ae455a80973cb5715048b846763c2ee096c8d33902ea26a98c1aefe99297aaa0e46d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437068, "uuid": "9c124fb5-e915-4e50-a163-1acbe1aae5d7", "value": "T17FB53300C35C8C56D644B5FB988B2BDE43B6F3096A3D876D6F833C04F66106B653A6E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437068, "uuid": "48a6fa2d-d64a-4edc-92f6-aa605108dac4", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437068, "uuid": "c7087aaa-979e-4012-93b4-ca29657fb26b", "value": "49152:YMKP2Vh29Iq+6Qt5BOQuP+wYitSTmS+XzXLxH2vSSmh0QPIXS7:YMKP2VjnttPrQvtST5+X7NY6AXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713437068, "uuid": "356269d9-14ad-4df7-a11d-e44f8091781c", "value": 2307056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713437068, "uuid": "2b82a01f-a467-4c91-bb55-c63c48853f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713437068, "uuid": "4bdc5a8d-98a2-40bc-8068-3498ba2d11e0", "value": "SecuriteInfo.com.Riskware.2144FlashPlayer.20362.15838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b71135-fd5b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713427779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427779, "uuid": "2406d914-51af-49ad-92c8-1c81a388c189", "comment": "Malware payload (AgentTesla)", "value": "3a70ce88c392ad13548a5337379ec365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427779, "uuid": "f8833f0f-ee53-4448-85e3-3271ae18c15e", "comment": "Malware payload (AgentTesla)", "value": "45d5436e268ed053f251044846ac8f0c5c09015cc87c4ccbdc86c4efbad9e570", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427779, "uuid": "a20c564c-e96e-4396-a47a-5364fdc34ef0", "comment": "Malware payload (AgentTesla)", "value": "759142b5f93e6b7821c9eb30639448fc2fd13cd4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427779, "uuid": "887f1f3f-de6e-4c3b-8dc3-12fbd0bf3b37", "comment": "Malware payload (AgentTesla)", "value": "9ecbc298569c85d32de411064d8478e62f4774d111af78da843fd408a4c222a9530bfc22024532fc5cbb7c54adaac66c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427779, "uuid": "b65ceae0-f56d-4224-a3e5-3881fe6ef37b", "value": "T110547C2ED35E02698F520273AB1B1E94A6BEBB3EB39051B1341C433433D9C7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427779, "uuid": "70d52a2c-5f48-4f55-b8ee-33dd2cd8aa33", "value": "3072:jsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEIFp+pk:EKMeKMeKMeKMeKMeKM7F8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427779, "uuid": "f7549483-3600-4f13-8771-a864f091fae0", "value": 282583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427779, "uuid": "2dd2f569-b441-4042-a2c0-5384ca5d6baa", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427779, "uuid": "d2e52944-61f2-4cff-aed5-d823619bacc7", "value": "Remittance 17042024.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88972fee-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425000, "uuid": "1dabaf85-9850-400c-9047-f2bd31e6662b", "comment": "Malware payload (Mirai)", "value": "a30695a9452dae4fa832c93299cc215e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425000, "uuid": "6943c5cb-fad8-4876-9851-cfec4f2f3cdf", "comment": "Malware payload (Mirai)", "value": "46204f018c444024166ecbd825186fa708c5a82b38cb1964f3cb7f2b581a39f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425000, "uuid": "3a393e48-0255-40ad-bc01-d93d761308d6", "comment": "Malware payload (Mirai)", "value": "c5d63cd94b7b786eb4de82fe0ac7fd470bfd88e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425000, "uuid": "f77c0f8a-022c-40dd-95b9-73456370e8bb", "comment": "Malware payload (Mirai)", "value": "69fe0b7edfcd73cf224f3026f7ad3399f8b9e4ad7a6eda3a79b8444af5ee0d9b32b4a2e7bb6a30a7de474bba19d2cf88", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425000, "uuid": "30e3d3db-3a14-4c77-8bfe-93818bc4c21c", "value": "T179333EB9F4222D2EF8CFE5BF9C224A1CED51230162831F1A579BFD931D321949E52E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425000, "uuid": "eade1bd4-5706-4593-8d12-adeec07f069e", "value": "768:rCe9jk1ZEAfV9dg77ooIwlUn8w8XgLBT+RkaGK6mo:2p1iAf1g77ooIEw8XGT+RtG3mo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425000, "uuid": "80ab5e0d-dbec-4dd1-891d-6c6b23290cf9", "value": 52152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425000, "uuid": "eb85c756-8594-48f9-9dde-bf4f4723348a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425000, "uuid": "56b7482d-ab7b-4bcc-80c7-e2ef9338fe54", "value": "a30695a9452dae4fa832c93299cc215e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee50140-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419212, "uuid": "4dbe8e83-049f-4f63-a2fd-9ffee69538dc", "comment": "Malware payload (Mirai)", "value": "a39aacba3ea473a91eb962c37e95ad46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419212, "uuid": "0816ae7c-e45f-456d-8ad3-5860ac793302", "comment": "Malware payload (Mirai)", "value": "46b1137f3b9eca9aebb1d51377384c03727c2f0771037a125bcff5b4488d2c4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419212, "uuid": "aabc8eb3-4f25-4f24-8595-94b163141076", "comment": "Malware payload (Mirai)", "value": "953b0054dec3899c2b1afa7ffbe3bcbeb83d95b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419212, "uuid": "d00575cf-57bd-42fd-be4e-b8384ac4d95e", "comment": "Malware payload (Mirai)", "value": "d7e838802c959574f3707e893c6eec736d1a722b0014cf6d4cf461294e264d0932ee9c5f89d08e43bc1ff50f9ca45c76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419212, "uuid": "ea040fdc-ca83-4b98-a696-4265ffe1abb7", "value": "T1D7D31A45F8808F13C6D652BBFB5D428D372A17E8D2EA72039D206F61378B95B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419212, "uuid": "c71bdf2c-0b00-4dae-afe2-1cb32284ed1f", "value": "3072:rHZo3hdkQCa90fnveB9FnVh0wX9ejr1rnpke:scQCaWve3SwXEtnue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419212, "uuid": "823b9116-eba6-4d4c-b33d-c072bb2eec52", "value": 137516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419212, "uuid": "253f667f-dfa5-403c-ba11-15468c5c0ffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419212, "uuid": "9cf31281-1867-493e-bc5f-2d695fcef916", "value": "a39aacba3ea473a91eb962c37e95ad46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f33a61-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713467247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467247, "uuid": "51560fb0-40df-4c89-a96b-d76c3ba33a46", "comment": "Malware payload", "value": "902c91012912a8aaee6a3d1e43af13af", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467247, "uuid": "263d3e6a-1317-456f-9abd-a442275fd452", "comment": "Malware payload", "value": "46ff258b05454a780553a2bde8d1847aa2b9c804c6ee432ed5180a4bdbb5a4d7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467247, "uuid": "d55b3876-b215-41ee-8ef3-ff8e1d3d2aec", "comment": "Malware payload", "value": "9fe644a8d52f153fe568f0390e8568b16a0e57c5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467247, "uuid": "8bea32d9-471e-48f8-902e-aa5ed33ff34b", "comment": "Malware payload", "value": "06d02f8fc142e6cbf6c8c918a2625e66a3ace0a248b38d5234c9da80a0e6fce95d218f047a7412d7bc3a464589bdaf85", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467247, "uuid": "1aa61501-b59f-4ab2-b21d-4cf227152a3e", "value": "T14B447C31B38C4A6BC7AF4379A4B814200BB0E266550BD75F6E9498DDDC87B835E23793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467247, "uuid": "77779ac2-34a8-424a-809e-6be94e500266", "value": "3072:gAD1PdfN6FFYYtEWbolKItHrz9jwG1J+U3GmS4skEE9gqaHN6:r1VcA/FrtskcpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467247, "uuid": "9f100520-49e3-4bad-898f-efef468f93c7", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467247, "uuid": "0a34ae13-c186-4539-9dee-5a3b76872aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467247, "uuid": "799c8923-c85c-4262-ad26-b2fe10aeba5c", "value": "DHL Receipt 004673321.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c828fe8-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713457487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457487, "uuid": "7f3dc80a-8571-4371-b1b6-7a5d17bffbb5", "comment": "Malware payload", "value": "83a354d6f038699cc00acfdb1b82e3b3", "object_relation": "md5", "Tag": [ { "name": "python-rat", "colour": "#804400", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457487, "uuid": "371242e1-6203-4315-9fc4-2f976376b301", "comment": "Malware payload", "value": "4717a271d4811d6a889a7cb1987c1385b262600d4a4981ef9274abec6c511ebe", "object_relation": "sha256", "Tag": [ { "name": "python-rat", "colour": "#804400", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457487, "uuid": "4591daf4-8efe-4b21-9c8b-233919788cf5", "comment": "Malware payload", "value": "c43770925aa813c1bc014a50b795dd7cf5a94a17", "object_relation": "sha1", "Tag": [ { "name": "python-rat", "colour": "#804400", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457487, "uuid": "1414acf5-914d-4dcc-acc5-993f52ca4da5", "comment": "Malware payload", "value": "18bcc1740a0454eeba035b57fec8db5031bc2e89570ce77abd4e939698d92a2f6860284010fcb573ca1e4dbe37d95a86", "object_relation": "sha3-384", "Tag": [ { "name": "python-rat", "colour": "#804400", "exportable": true, "hide_tag": false }, { "name": "tgz", "colour": "#AB22ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457487, "uuid": "ae0dc574-24d0-4948-b9ec-df3640f62e78", "value": "T1BEA733AA42501F87D26641377AFE7E319CEA7F0942E2C03DB8A0D78231437D6DA39D95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457487, "uuid": "ccbed518-fd5d-4160-8000-6287262a46d1", "value": "786432:WV6h9AGQqVBpvEtMJecMFyxapCDU9P2tthVQWxwTNiaob+YzFoslGMHO3k:KA9tQqDpvEmJezI0mM+PhVQWxmpoaszn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457487, "uuid": "f696aa42-3be7-49dc-9cd0-b16031f50221", "value": 47298560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457487, "uuid": "8924368f-2dac-46d0-a3ce-032ce802b8cf", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457487, "uuid": "3172a3ce-d94b-46e0-812c-06c9e3d9b650", "value": "src.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9812d5-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433702, "uuid": "44193890-1fab-4758-987b-a67b83f386ec", "comment": "Malware payload (GuLoader)", "value": "b9b0cb584d4f39501f427645d8dade56", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433702, "uuid": "7bfe6b95-4677-440c-a429-146e147509e9", "comment": "Malware payload (GuLoader)", "value": "48650c8b5f16dbc8cf74c2e9953b573a3c41785c67f2e71457ba306f04020694", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433702, "uuid": "f2d391aa-3e98-4dee-beca-9811c38413ed", "comment": "Malware payload (GuLoader)", "value": "815162a79a8da42af1035b07f797223787b666db", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433702, "uuid": "4a944488-980b-4ebd-b73c-74c7be96357b", "comment": "Malware payload (GuLoader)", "value": "fa6fd171299491c99f9c248f0b71d0a75dd57d732934157f01582623ace26a6d030a5da033fe81033e9acfe21818b6f6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433702, "uuid": "e346bcd4-c5fe-4cdd-a548-9284c178d4aa", "value": "T1542408F0CF0B36199F4B3EDAAC6485824AF58195051638B5AAD907EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433702, "uuid": "9d4467b0-a899-4000-9ff5-dceffa043817", "value": "6144:MYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf9qmk:12dOr6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433702, "uuid": "57a5c93c-625c-4e1d-911f-2dafe153c076", "value": 211515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433702, "uuid": "d294515b-2acd-43cc-b2e9-78806ad4cd97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433702, "uuid": "839dc423-7b26-4899-971b-be9bf51db9cc", "value": "Psychologizing.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a4f362-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433958, "uuid": "880a463e-87ac-4ac6-8cce-62c8f0165c8a", "comment": "Malware payload (GuLoader)", "value": "4dd365afd7e8492402b7085ddc4bd66b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433958, "uuid": "98a3c5ba-c7c2-4dfa-84d3-bc68cbb43aa7", "comment": "Malware payload (GuLoader)", "value": "487900466cf9a708a96f2bac15da523c6864b88ffb0090b6b58d114b141d8e86", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433958, "uuid": "abcf72a5-d162-4b7e-837a-1bf7689780e3", "comment": "Malware payload (GuLoader)", "value": "2abc1ea2974a94af2baae30e6b37e0112e518b93", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433958, "uuid": "96735c30-cb98-420c-9919-bbb6df2576a4", "comment": "Malware payload (GuLoader)", "value": "4107d63d509b31d5514bfe239e3d47a4ec1babca2d6306ab4927207347b82c1555023c7e5edede1d13834c2e1f4dfd19", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433958, "uuid": "2b546602-160c-4c1b-87d8-7a24af4df10c", "value": "T1FB2408F0CF0B36199F4B3EDAAC6445928AF44195051638B5AAD817EDB283D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433958, "uuid": "63f772b3-6fee-40bc-b5f7-c60d59ab0d35", "value": "6144:dYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfSq7f:m2dO177Oc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433958, "uuid": "6aa250eb-4d2d-4ac4-b552-6954fccf6e6f", "value": 215868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433958, "uuid": "c5b6cf2b-023d-4bd9-b272-4d35d1da30d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433958, "uuid": "5d61d941-a0ec-496b-bff0-8c98ad6817e4", "value": "FACTURA_325.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3712b0-fdca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713475821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475821, "uuid": "8c1df1b7-277f-4099-a76f-cdbec6b226cd", "comment": "Malware payload", "value": "b696181ac3dcb8cf23d3ac6c0dafed12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475821, "uuid": "596c4e9b-18e6-4d60-90a1-7106636d38aa", "comment": "Malware payload", "value": "487f4df71699ada1abc071283823f9f248238e0033c596ec9c50cdb4e1a102c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475821, "uuid": "9a58f291-83c6-424f-9457-5f392425f6cc", "comment": "Malware payload", "value": "a95f75df30086eca2ae0c72b0681ceae1507a41d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475821, "uuid": "166bf316-c8fc-4e26-8e4c-876caa125388", "comment": "Malware payload", "value": "56ddbd4bdd2e3f5d0fa15d6c94c4506c6decfc4bf42f522c214bc9f4a3dc0955743be32a846c01ba55982f8ca3d2be73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475821, "uuid": "e8c225e5-14f1-41bc-b2ff-daf6bbdbd7d1", "value": "T1E4337B4323EE1317FABA17FD49E094295F70E166EC81EB5E381C54E82B237959B40E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475821, "uuid": "66db819e-49b1-4d6c-b1d5-0c849014f265", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475821, "uuid": "88653c13-f361-4c48-9414-529cd8d6b869", "value": "768:rFiF95SufAKLJ48ms1u4SSFLgSvD2cBSzeq/YcaPCIA+jkNlTb:QJszequK1HNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713475821, "uuid": "13ff088e-13db-4c79-b052-5edac202c839", "value": 54760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713475821, "uuid": "5705a222-c752-4f67-b9ea-ec670453d3f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475821, "uuid": "f54d9ad3-4e54-434b-a205-e3491ddd9083", "value": "SecuriteInfo.com.Win32.RansomX-gen.10310.21629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0197e0b-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713467211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467211, "uuid": "e6fe137a-dbd6-49ce-9f47-46f41c995851", "comment": "Malware payload (AgentTesla)", "value": "d4e8894fb5ed5f45972882fbc6ef04dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467211, "uuid": "02b0e76f-1763-4060-9d8c-418e36a4c715", "comment": "Malware payload (AgentTesla)", "value": "4888ef9f557bfc04c0c7da3ff2dc1fc34767273d90053aa1e04c3892300afe12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467211, "uuid": "87804fd8-2b18-4cf0-b919-2353fcfa705b", "comment": "Malware payload (AgentTesla)", "value": "f5ac926e2501659cd3933afb72e1172b1147f95d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467211, "uuid": "c6d05631-c8e1-47c6-adf7-f5d851191ab8", "comment": "Malware payload (AgentTesla)", "value": "3fcdd306801ae126bb9c8c099a81c01b88851a013a2bc98615e21ad720fdc3e5ed4edabf199a0f92c7c63cd601505921", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467211, "uuid": "e9fc6526-aa58-4d69-b2c9-8059509861bf", "value": "T14B74E1A9C2D66BB9DD864AF4ED52107D01FD0803668F6F9D4A4D2C362C6E20D3B42B5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467211, "uuid": "2de44aeb-6b9d-4b4a-8d1b-a869f2dbc69c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467211, "uuid": "7e37a624-e693-4afe-b514-3464a71ed45c", "value": "6144:MvkECw92bslgwmEuLCP50vDht1LIUcz7zyr+RCniN/F59ZrE:MvKC2bwmEbIht15c/qip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467211, "uuid": "cd0f9a65-0b32-4b1e-b7fe-fc1a03999038", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467211, "uuid": "8aed3511-76d0-4c96-80a9-c4de1bcefd1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467211, "uuid": "d36cfdc1-58e9-44fc-ba4c-3d4a9531a1f5", "value": "hesaphareketi-01.pdf.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da3d4a7-fda1-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713457919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457919, "uuid": "db7ae55f-2807-432e-b794-48b9f6006eb5", "comment": "Malware payload (AgentTesla)", "value": "0db5fd892ff98e5ee7f079d69e5ee579", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457919, "uuid": "69de000f-2781-438f-a767-51db62addeb4", "comment": "Malware payload (AgentTesla)", "value": "4917724a9a203983bc44a1d605d3ef09b074a9ef65adb01b2b28e49822fe7cf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457919, "uuid": "64206d9b-2e3c-454b-a554-a168b38c2fd8", "comment": "Malware payload (AgentTesla)", "value": "d3d2403719b7ff202cbb7c1dbecc9934a3d8e44c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457919, "uuid": "38b9d454-7712-4010-a49c-c5eaa7a5d9ee", "comment": "Malware payload (AgentTesla)", "value": "790e274590153dadabdba9edc43d1c762c78063f74df5ec3e3a554418091323c38eed5f36a2e7c86008e0e472ac9bf45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457919, "uuid": "30c4ccf2-7d7c-4b5c-903d-8a4e90003e18", "value": "T195E4235A8BBBCB38B26C33D32138F946524A1703ECC92F3C06192704E965D5F5A767B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457919, "uuid": "69048ee6-2aac-4b66-b962-06b338a43669", "value": "12288:82quqWl77godZdya8WzUCklrK81xZPhtS95eFOTOU16sNEc:/qk7DdZdzoCklr91jfSjeQaU1N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457919, "uuid": "016c026b-b7da-4f5d-84bf-d8fa3a50c3fb", "value": 667431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457919, "uuid": "f1127273-d635-4cd9-9092-586d27723c79", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457919, "uuid": "6d9841f8-ed74-499e-b5c6-dcabb7fcfd72", "value": "NEW ORDER.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8489f159-fd21-11ee-a120-42010a9c002e", "comment": "Malware payload (Quakbot)", "timestamp": 1713403089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403089, "uuid": "2e9418ec-aefc-4281-80c0-17e7a3f104dd", "comment": "Malware payload (Quakbot)", "value": "4b7b85d70329e085ab06dcdf9557b0a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403089, "uuid": "471aa6e3-3768-4f0e-85a7-30282229fd0d", "comment": "Malware payload (Quakbot)", "value": "49220571574da61781de37f35c66e8f0dadb18fdedb6d3a1be67485069cfd4b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403089, "uuid": "ce0b150b-659d-4c96-a9b2-d047e2b0d103", "comment": "Malware payload (Quakbot)", "value": "3a277203cb4916eb1f55f867f0bd368476c613fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403089, "uuid": "dec92c91-49a6-49a2-a967-526a4d004121", "comment": "Malware payload (Quakbot)", "value": "f8bbb20fe20dd1754813bb9881c1a2851c64773a92ac86048908ed11f88b8cc4154cfda870c1cd430296bd7e45dad733", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tchk08", "colour": "#EC8D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403089, "uuid": "318bc24a-9494-40b3-8f10-df28b880db59", "value": "T163068E9AB7A80198D876D23CC6575217D7F2F8111370A7CF1AA85ABA1F33BD6123E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403089, "uuid": "0f962282-1659-49bd-b957-e28e8a44a1e4", "value": "13904d1cc18631217d0dcb5bf82fbc09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403089, "uuid": "3e1c2576-bf44-4ecb-bcb4-6519759f49fd", "value": "49152:Js0ewfW1oFguIXFkCEDeQi5LpAO85kDe8MS6pBAuowCSHeuOz8eoY3qtI:vfWzuEKCh91Bw8HFwCS+uXevq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713403089, "uuid": "ff458213-397e-4bde-a958-59f405bbc3dd", "value": 3691008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713403089, "uuid": "22186976-1506-405d-8a93-fae271500129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403089, "uuid": "9905e52a-9742-477a-b595-227392230d10", "value": "02.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9b66f2-fd84-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1713445465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445465, "uuid": "0422ecdf-212b-4eed-b882-9eae7d58288d", "comment": "Malware payload (QuasarRAT)", "value": "b12dcc0b6399196333d30649f325397f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445465, "uuid": "9c643328-02fa-4f0b-80be-7cdcb48da81e", "comment": "Malware payload (QuasarRAT)", "value": "498844e96c76ce422fdb328f5deadd5e0785582cf291c1cf9d32ed15f45fa964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445465, "uuid": "967b5604-5923-400a-b54e-bc21d6d53231", "comment": "Malware payload (QuasarRAT)", "value": "6f208c9b6d3dae57e4c22d5e319db0d237feb909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445465, "uuid": "1dbd2c91-21af-4ed1-beea-ad556adda139", "comment": "Malware payload (QuasarRAT)", "value": "38b5ee439b10cf3d9bba526911c37ef7ee8db9fdc2ae9b44537a3a99b0df933104a1e0c2b5da3a0fd07a324b1014cd44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "VoidRAT", "colour": "#5449B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445465, "uuid": "4af166a8-f4b9-45ad-bbee-ca8ff7d03818", "value": "T141746B1377E4EA3BD1FD173AE4320A194BB9D407B616E38F9A5855B92C623C68D403B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445465, "uuid": "97b7fb05-c3f6-4bb7-9544-4248ce3898af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445465, "uuid": "6c5b29f3-c93b-4087-87b3-1d4b29e46276", "value": "6144:67qQ4i1FFiEKyK5ALbddCEaBHGdNXUnO:8plipKddGIdBUnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713445465, "uuid": "66cd958a-5de1-4e06-8316-bcf3a3c32fbc", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713445465, "uuid": "d0172ba3-0056-4384-ac93-6f86b352f717", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445465, "uuid": "dfd1a3a0-291b-4b7c-ab8d-ec4ccf27dbd1", "value": "xmrhZ7VhlJjD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1371aa7d-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713472478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472478, "uuid": "7bee468a-78a7-47cb-a1e5-f821c1cc41b6", "comment": "Malware payload (Loki)", "value": "87e331c4dd791e6e0a66c1e56d8cefec", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472478, "uuid": "7b389198-90e2-4ee5-9cd5-a1ee79e94843", "comment": "Malware payload (Loki)", "value": "4a49338d1093a91cb0176df46341dea8afa65b6c2244118b14ddb5fb554a7735", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472478, "uuid": "709a51f2-e467-43b4-a1f9-194b248a0c38", "comment": "Malware payload (Loki)", "value": "b44e8463560a4e56480f42b67d278871851a5355", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472478, "uuid": "34b00d92-058f-4d69-aca3-a2da420ba2b8", "comment": "Malware payload (Loki)", "value": "1325ec59f04f04afc761a641fb4c2b2a50733d2c5128d9c7ef07b6fad0f61d31e28f49dc4770fae47821b55cdaf46098", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472478, "uuid": "cbb3fa1f-0dcf-48aa-8d8a-5a28547db15d", "value": "T132B423AC542209BD70BD9B394BF5E88CEFB5D95BEA6403DB045C82233447C5867DF2A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472478, "uuid": "688d1fec-c5e0-4241-a470-090240c6e47b", "value": "12288:RJso+jCJ0wfs/26JkoJvLJOtOLf058JfNLWllwMtPJK+8/4uVqKy2rfRNJDEcG:Cy0wfsVlJD8tOLGEfQ7BI14eq92r/lEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472478, "uuid": "67e44a34-26a3-4940-86e2-774017fdee60", "value": 527249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472478, "uuid": "ef4d8dd1-85e5-46f0-8ac1-7457d1fee57b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472478, "uuid": "26601f06-d907-4637-af73-39d999fa8e13", "value": "Payment Advice_16007618765_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c504295e-fd18-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713399332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399332, "uuid": "054b0731-9f80-442c-91c8-066e7cc6ccca", "comment": "Malware payload (Amadey)", "value": "11daaab30c6301d62d80a0bd038d4e87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399332, "uuid": "0d9ff89c-e2de-4578-ab3c-ef0e70c3bc77", "comment": "Malware payload (Amadey)", "value": "4b3214ca5ec9721278989a43bf21b9450e5b8597dae25a4262dbece4a1193351", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399332, "uuid": "6a4f2224-67ec-4352-bde2-0036c80490d6", "comment": "Malware payload (Amadey)", "value": "b5309987895d1912547356d9ed90c44fafb5e810", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713399332, "uuid": "b8d536d7-765e-4647-ac42-3208ac994ef8", "comment": "Malware payload (Amadey)", "value": "5c26007d9b4499da541f3be6b3e87dc97cc660964c783cb4a1a02cbeb459b2f09485af8fa85e1dfd02673ec3bf683650", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399332, "uuid": "5531446c-2802-4a5a-88d6-d0e6e8ec0702", "value": "T1D9133C8BF3D754FCC207C17885EB6772E8B2BC210125AE2F1768D7311E11DA4AB6E615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399332, "uuid": "adce842c-e784-41c1-b8ef-6b0ce7f01825", "value": "e6b983a19f472490a7e3785144e6d74a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399332, "uuid": "17c183e4-1a15-4e70-875a-255ee74147cf", "value": "768:c6I/8GUjlxONKZ1ZjA9UUu93ZR28/A1RBq7XF0sDKW:zIUhjWNKZ1ZjA+UA3Z4e710suW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713399332, "uuid": "3e458eaf-3716-4ca7-b5a6-80bba77fbfd3", "value": 41472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713399332, "uuid": "3d53eb2e-c7a5-44cd-b3a5-2d43218bed3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713399332, "uuid": "50e770ce-5d04-4b9e-a6c9-6453ca5d6c14", "value": "11daaab30c6301d62d80a0bd038d4e87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79b1e79-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713467143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467143, "uuid": "4ee8a985-3442-487b-a620-b6163f94a172", "comment": "Malware payload (AgentTesla)", "value": "ed94a32330d4f8bc01426f17de225782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467143, "uuid": "48b5aeb7-500e-442a-a3e8-5c4e06965d87", "comment": "Malware payload (AgentTesla)", "value": "4cb5158bf0867f8d1990aac298da8f9a3aef98f1cb99065b44e1ceb1e2908396", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467143, "uuid": "801d2984-2e8a-4049-8c6e-691d36e98d32", "comment": "Malware payload (AgentTesla)", "value": "c615ead1fc2f00fdff3478a340df3e7dd883bd66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467143, "uuid": "56d013e3-0c84-4883-be27-6a3e57eae7bd", "comment": "Malware payload (AgentTesla)", "value": "cdee2627eb922bfa81d7d6de2357585a99ec78362e5e816e5b77e8a4f130f6ada09b02b11999479e53eea22875a3d983", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467143, "uuid": "442f75bb-70ce-41b3-b625-c5a743f38a18", "value": "T183543AA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467143, "uuid": "ffa54933-ac42-415d-b7d5-f11d6d82c438", "value": "6144:L3dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOEG8xYI8tEi:LnS2ImLYp8Wjn2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467143, "uuid": "c9d875c2-df94-487a-b395-efdde19fd15d", "value": 285803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467143, "uuid": "4df70302-bc40-4b52-a683-caf48e9af1cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467143, "uuid": "f6d0f6a6-9874-4cfc-a5e3-263ecef5c8eb", "value": "SHIPPING DOCUMENTS_PDF..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb1ed07-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425388, "uuid": "f57f8e9c-c23f-4925-8af3-96bed73f8b4f", "comment": "Malware payload (Gafgyt)", "value": "b19c3bbc302a955765570c59ade5f646", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425388, "uuid": "cfdb7fb6-ac36-4114-8bb6-2e5559273626", "comment": "Malware payload (Gafgyt)", "value": "4cebdbd3623afc5f28334742a530304d0361528ea8ff12c4becaaa42fd255cd6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425388, "uuid": "233a7a86-ec0f-40fc-abd0-869da20b149c", "comment": "Malware payload (Gafgyt)", "value": "097d0f6df95b8cb96438683a4acb6b8181326b54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425388, "uuid": "ce83ee9f-57a6-4e8c-bbfb-a94eb85dae4d", "comment": "Malware payload (Gafgyt)", "value": "268ac9592e0f1ede2e8b3e6572a51f1da9a2cb02c8726c5b48f4e23acaec10d034187b46156a29e95fedfbed87e37382", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425388, "uuid": "416cff94-2cab-4c42-9d55-8eeaa3737c94", "value": "T1C743012918856021E2EC86B88B79EAC417727CB471B833B713D4ADFC9B87D4921BC35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425388, "uuid": "4e0d8780-3188-4167-8b8f-047f85d21abb", "value": "1536:xn/rxl0CWQKGGBQ3V+OqtfqTu+mbkF+9LzK:VxlPWSGBBqT5m4FALG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425388, "uuid": "e3afa8d5-4658-4a09-8fb3-cc04b4633e5a", "value": 59740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425388, "uuid": "6761c0a2-8030-4fc8-81be-6107c65ab916", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425388, "uuid": "6409397f-cefa-4763-a7b5-93da5b5d7e22", "value": "b19c3bbc302a955765570c59ade5f646", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7670ed-fd84-11ee-a120-42010a9c002e", "comment": "Malware payload (CoinMiner)", "timestamp": 1713445487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445487, "uuid": "b3c6d6dc-c0b1-42be-9491-f22224905b56", "comment": "Malware payload (CoinMiner)", "value": "0cf8715cbdee01676d24f4f78c7b431f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445487, "uuid": "c72813eb-78e2-44be-8844-4dfffd48b7a3", "comment": "Malware payload (CoinMiner)", "value": "4de22f65551da53a761b1e9049abfcfdeddb4f36dfd50503f4ac45a0e4f972a4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445487, "uuid": "ad2a61a7-4f0d-4157-ab59-6791922503ab", "comment": "Malware payload (CoinMiner)", "value": "74989063fd05ffb28d0d705c583c2c6b1e9aef99", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445487, "uuid": "54e2c646-5e99-4fb8-bfbb-4d8bb4d0e46e", "comment": "Malware payload (CoinMiner)", "value": "2d6129181cffc3279bc9e0cc71738d1b92988aa1d0988ff160c753daab57d45d90579bf49382e12d99005c522f005ecc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445487, "uuid": "93df2e37-8959-4b90-907a-a0c079ab8321", "value": "T126D6332A46842529FDF04B3403ACC8952FE1DF145D7E6E49161DF43CA6B0FD398AA63B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445487, "uuid": "00c5c05f-1d3a-4305-aeef-77f35495e405", "value": "32f3282581436269b3a75b6675fe3e08", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445487, "uuid": "65424dc4-c76c-4855-b4a2-475dde3da163", "value": "196608:pSjaAQ7Z8aVC/xE4hVS930UqN2FItiZESkM8ZCLfsFrrdTM4nGgAU1Q+osH:oOAQaBvWq0QiZH18ZaIr2qG/sH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713445487, "uuid": "cea46977-cb7d-454d-9807-10d5b2b97e71", "value": 12936936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713445487, "uuid": "ead379d5-503a-4ef0-869c-21d3f9e2ef4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445487, "uuid": "bd2c3248-d054-4100-9881-ace39d260ef0", "value": "ReimagePackage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747f53e2-fdc5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713473499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473499, "uuid": "89a7b051-f015-4b39-b908-68fea405356e", "comment": "Malware payload", "value": "51b0ed6b4908a21e5cc1d9ec7c046040", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473499, "uuid": "ba13dae6-8ed0-4d2b-ab14-d6b9c9851152", "comment": "Malware payload", "value": "4e68c5a537320cbe88842a53e5691b7f1a590b9c0b491a12baaeeda111dcaa4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473499, "uuid": "8374b3bf-8c5f-4136-8a5c-4accc628c208", "comment": "Malware payload", "value": "d874f6da7327b2f1b3ace5e66bc763c557ac382e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473499, "uuid": "a42cdc4a-c22b-4c88-9cef-bd9ea5b930bd", "comment": "Malware payload", "value": "23151063e13ae04cfbc270d1cd56665fab4b76cb86212c6edb8b5fdde3151d5d1fd83a33afad9d82fb5b1da97a0a9ff0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473499, "uuid": "cb4c1746-e964-4cb5-8ad0-e4f9e4f24292", "value": "T10F24D00275C1C472E9B62D391460DBB65E3EFC340F6499EB235856BA4F303C29629E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473499, "uuid": "cf8b7424-6e3c-43f4-9308-ae335d840492", "value": "82004e1f718cc406824f64c2578845d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473499, "uuid": "5a5cd699-173e-4c84-937f-88a6186966e8", "value": "6144:gQtdqzqv7rArb/LoEyavuW6uqQqNW14pv:gQtdqWk/LDmQqQqK4pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713473499, "uuid": "e4f4bc41-f08f-421a-a60c-5259976ae67f", "value": 215152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713473499, "uuid": "1eed1883-ff5f-43e9-b1e5-515fc8bad58d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473499, "uuid": "9d4e5953-9706-4af9-aa48-aba5f30ae62b", "value": "51b0ed6b4908a21e5cc1d9ec7c046040", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8682344-fdd1-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1713478767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713478767, "uuid": "731ef373-1873-40ca-8587-d0f2f8e6827f", "comment": "Malware payload (AsyncRAT)", "value": "b385264019d78c7225e7e088d5ad6042", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713478767, "uuid": "a35da1ab-8722-4f40-ba77-1105ee3f65ef", "comment": "Malware payload (AsyncRAT)", "value": "4eb22bcde9c1f6978506647ab39e9e4245cb4bde3a359c0348e37ec3f9c12116", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713478767, "uuid": "dd1ee088-1859-4114-b83c-2ef6a8727667", "comment": "Malware payload (AsyncRAT)", "value": "544ef98e04e0218af42302970199dd1f66182118", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713478767, "uuid": "630ef93e-6bab-4120-a6e8-f7433945871c", "comment": "Malware payload (AsyncRAT)", "value": "c9cbea1e070b9f97b02156ff0c6e3289fcedbffca328ec857f45d63c282e55e827eadc175c2036eff8efd6c3f8ecfc46", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713478767, "uuid": "fcecec4e-d796-4fdb-a7ae-ed9081c45e50", "value": "T196235D4037D88136F2BD4BB4ACF2E14586B5D2676903CA9D6CC814EA1F13BC59A136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713478767, "uuid": "d99e62e8-762f-4099-a5d4-b42d6219c464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713478767, "uuid": "a21739f2-ce2c-45b6-82f8-afb897d20ee8", "value": "768:4q+s3pUtDILNCCa+DiptelDSN+iV08YbygeiOOW1tWtirvEgK/JvZVc6KN:4q+AGtQOptKDs4zb13OOW1tWErnkJvZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713478767, "uuid": "a4192792-a9a5-4630-92d5-287986f52e5e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713478767, "uuid": "bee283dc-95db-415d-a865-5260744c14c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713478767, "uuid": "44816d68-e314-44ce-9b25-82a8a74c3c64", "value": "xXQ39a5f9EJP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a67e91-fd98-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713454385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454385, "uuid": "25531009-467a-4682-a2eb-9ac86eeabb3e", "comment": "Malware payload", "value": "901ac7a94b75648f4084a37640473271", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454385, "uuid": "de0303cd-c8ad-4cd9-9bcb-53f7a356bb2b", "comment": "Malware payload", "value": "4f2e6b78996b8ffbb294305fdd79f4ceffbafc2474b90d701e1beb7e116e0471", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454385, "uuid": "5f89e73c-81e2-413d-bc5b-c7ade40dc6b2", "comment": "Malware payload", "value": "fa790c788bc05383660e356cbc45b5f6f2152aa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454385, "uuid": "54ed99c5-70ca-40ef-be67-9e3aab6e979b", "comment": "Malware payload", "value": "9fdd0b5a49ccfeaf247bfa52255d3c68ce7c5c68bf65536c5cf689e30ee82ca7c6d590e3fd35b33e4c952fff3e5747ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454385, "uuid": "8cd4f166-61a3-43c6-ac50-2844fbca1836", "value": "T1EE15121672F48070F7F25A7099B698620B7BFC519930A2AF37C0195A5F70AC0D7397AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454385, "uuid": "5c85f7c3-07c7-4e84-b469-9db8754ecee8", "value": "459c3aa71b327403228988f8c94ecf4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454385, "uuid": "2bb470d3-fdce-47d5-a557-c1338fca228a", "value": "24576:zGwB4/ivaVvjOgmDs67kt0EKIZE4Lqds9:zGW4tbOgmDs6wt0EM/du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713454385, "uuid": "f86e4a8b-36d6-49b5-b825-72a8145a2b87", "value": 895120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713454385, "uuid": "57af9fd6-f8f9-4957-950a-e0bd21ce01f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454385, "uuid": "6b77d2bb-f8cf-4c14-8245-b988a0c54745", "value": "SecuriteInfo.com.Win32.Malware.Dropper.Heur.30989.19921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed70910f-fd74-11ee-a120-42010a9c002e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1713438913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713438913, "uuid": "a45e0bfc-f813-438b-983d-6a856ea980ea", "comment": "Malware payload (CobaltStrike)", "value": "11fb9b098eb4806f43f59c91c0258dd5", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713438913, "uuid": "8e778e9b-7dc0-4c10-a025-12f301702641", "comment": "Malware payload (CobaltStrike)", "value": "4f94527e08239589116280232130732409ec92c28c0ef8943dcbdb8eeb6a3ecf", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713438913, "uuid": "f75c98d3-9b4d-4263-86ed-b92e0ff4355b", "comment": "Malware payload (CobaltStrike)", "value": "9c0b3b83792434ab3df0495d3124fc5db4995767", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713438913, "uuid": "1a225774-b8dc-440e-a150-be1e21073cdd", "comment": "Malware payload (CobaltStrike)", "value": "f29a6797c395a2b83834515c2ed3c69be2eb5dba35b8fb524fce74d7cf4ecb4708e01a2d05c6ec4db3b60093f0f4fb13", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713438913, "uuid": "f54f4f97-18f7-4ff4-a6f1-b9149f2d4598", "value": "T132851747B88115B9C4AAD232896A5252BB70BC990F3167DB3B50F2FC2F727E45E39314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713438913, "uuid": "09ca20bc-6029-4e37-83a6-4d8626d95dc9", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713438913, "uuid": "318f4c6e-93e0-47a0-9fac-2da583822ed3", "value": "49152:FE6G9taeXe7AbSCDneCYgtPYgn3+2lz1:v7un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713438913, "uuid": "acc76ad7-7fec-400a-b3c5-b760cd6e4cb3", "value": 1737216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713438913, "uuid": "b80e5138-4c82-4c63-9c25-c5f555947ebc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713438913, "uuid": "697dbe14-e340-4b1d-9a7e-586181c37cdc", "value": "11fb9b098eb4806f43f59c91c0258dd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70ea5d8-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713427762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427762, "uuid": "632869f7-62bf-4418-b9a9-273dce66645c", "comment": "Malware payload (AgentTesla)", "value": "f22c33e0af52d382e821ff26fe23f30b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427762, "uuid": "339718f2-74aa-4987-b3e7-8a4160325ed1", "comment": "Malware payload (AgentTesla)", "value": "50297c7705e690b43057219bc9a89cfb49e6d739742bbf4d904b64832b1cfefc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427762, "uuid": "1486c241-ec03-4bb1-b6b0-b02d430f9b6d", "comment": "Malware payload (AgentTesla)", "value": "15bdcdd580cbb66c67d8fd90151e25fc285f7de3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427762, "uuid": "b3b80ba0-ad47-4e7b-8efb-a87e07cd4f0d", "comment": "Malware payload (AgentTesla)", "value": "d4d88465fae1e44817308e2e31324bec91ca0997480489003329641a8ba97ce1540362d94260b5249f70e852b88c1b75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427762, "uuid": "fb418ed4-f3bd-4b7b-9e05-79f510f51c2c", "value": "T12864142EE34E0269CB520377AA1B1E94A6FDBB3EB39051A1341C433533DD87D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427762, "uuid": "f75a8ee7-6834-4f46-ae73-353d848cc949", "value": "3072:GQsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEt955Rj5/BBRnLqOT:GhKMeKMeKMeKMeKM2j5/BBxLqOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427762, "uuid": "c0aae229-89d1-47e8-9cbe-f8257366dd90", "value": 327186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427762, "uuid": "413d6279-95f3-479f-8ede-7db4bbffab43", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427762, "uuid": "95ce7a30-754c-4c98-9423-d27f6830e2ea", "value": "Scan 368 1.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84d077f-fd50-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713423416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423416, "uuid": "f476259a-066c-4849-b429-01b236e12694", "comment": "Malware payload (AgentTesla)", "value": "6bcfa2c640476bdf4b3e946ce29d2aa9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423416, "uuid": "b39ae3dc-2afa-4cab-b502-61f2fe434a65", "comment": "Malware payload (AgentTesla)", "value": "50b5eb20f116100571a794e5fe30953bced95340d1a180108806cfe9e04da768", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423416, "uuid": "8ecc5797-79cd-4735-90c9-2fb90656a7ea", "comment": "Malware payload (AgentTesla)", "value": "628847272c99b511fb1b13949ed0c3afb08da414", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423416, "uuid": "1198e4ec-6132-40c3-a693-f0b8eea11a96", "comment": "Malware payload (AgentTesla)", "value": "2f6ed4c85452c1fbdc0e1176c6bfdc253e14da0eaa80e1263388f877a1fa93acdf14b856445dd1907fea11b20d6f9e49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423416, "uuid": "6cd43865-d7d8-48b7-88d3-867205f8b86f", "value": "T1487423406B6A199DDA1E8836407B4F2069B1BE2485E5E21E4E94F35FECF374F5D03AB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423416, "uuid": "754a52f6-e4fd-4c36-a57e-f618ef86f9eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423416, "uuid": "f3bbf93e-ea70-47a5-8dc7-714465b303f7", "value": "6144:ik0VF4CoAoQEQjeyM20g6nj0MBfc7oAdBjLyHnCrCaBAy2u1ns:SVeETeg0hBf+BjLyH4CZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423416, "uuid": "ad04d9b6-9423-4148-b87e-0006baae3c2a", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423416, "uuid": "e9ab9989-682a-4e38-bd37-d3e599fb194d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423416, "uuid": "d81210c1-e27e-4224-a69d-c59d8184729a", "value": "Leoch-Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ff82f0-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload (zgRAT)", "timestamp": 1713427727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427727, "uuid": "1d240e74-f17f-4af7-8d3b-fc17ab47f9b6", "comment": "Malware payload (zgRAT)", "value": "6d59b75f2b8bf7590c144cd4b3d24516", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427727, "uuid": "d707bfc2-f5de-411f-83c5-ef7e8b7430c0", "comment": "Malware payload (zgRAT)", "value": "50ccd3682708ff0e7a6bfe46730937d469ca29e0ae405f3607b70fb15ad2e5c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427727, "uuid": "c3f0d8c6-8dc6-4f54-afdc-4dbcda43de65", "comment": "Malware payload (zgRAT)", "value": "6325d9ea89692248cf599493743f637b7fefe726", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427727, "uuid": "c101bc0b-5a1c-4ecd-a723-71be593137df", "comment": "Malware payload (zgRAT)", "value": "304bad0ff16a3e18d5895fea03f81693752f5f7e226d10f10752254d6749d0b6cbe87b2ea6587b61405608f9f72331f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427727, "uuid": "531546d2-75f1-4c2b-91e4-950bb5380480", "value": "T16126BE2177F8CD5AE5AE1B36E0F1012847B3E4429B26E75F29C072B90C933AD9D48767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427727, "uuid": "5d170f05-2302-4b2e-b034-8b2a01c044ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427727, "uuid": "ac2124ba-cb19-4627-92c9-a4734c1f7bd4", "value": "49152:fc6PM2ku7KoRtVYIN9uCftMVtWf+NSzuHI791x4Ayjxw2PjCSK6Q70zPbyg8L3bn:fc6p37V9Bfa3Wf+N3I7Xx43byg8ua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427727, "uuid": "e7c35ffb-2395-4c6a-b78c-54a47b107b09", "value": 4479608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427727, "uuid": "aad2dbc2-5987-4766-aab3-93900500bb5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427727, "uuid": "87bcdcd6-d594-45f2-b992-57d43ea72dbc", "value": "6d59b75f2b8bf7590c144cd4b3d24516.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ff77b-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433603, "uuid": "42d7af83-715f-417e-b73f-e7f7aa045a50", "comment": "Malware payload (GuLoader)", "value": "7c03632cedde555ca1461edf9294879d", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433603, "uuid": "7c137472-0fe5-4178-9c70-16a9b58deb63", "comment": "Malware payload (GuLoader)", "value": "51efc3d15b21ddf73b70193f9eb0e4144d7bddf3c99a046c8817a74b175868ec", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433603, "uuid": "45b5b495-76d2-4cb2-8f09-c0596726c042", "comment": "Malware payload (GuLoader)", "value": "8ba008f5364a9e7130d01b0e0f3fa2c2eef4db06", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433603, "uuid": "107a20c5-c585-44fd-8b7d-63fff60eb3a5", "comment": "Malware payload (GuLoader)", "value": "a64d1ea6c5fdf7a52b4acc11bf10232fa6172c8b93ec94118dae40cc61d5f71e7d5c4b477d3e1bf4dfd39be9004234eb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433603, "uuid": "ed8e61c8-e564-4ca7-b775-0dad5a497e6a", "value": "T17EC25111BD4D9BF0AD1A3B225903BFA34679A3B8BD3028252D7F47CAB4271979D261C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433603, "uuid": "9a730c4f-2870-4fce-be56-ad61d1279e41", "value": "384:pIdX18H6p4HWy2GYQ5cl3MTxSiMFpWrd2Wxol4cgbF:GN18tHr2XHl3uSwzyl4Px", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433603, "uuid": "6ea98398-64e9-4ca1-97e5-67f6daddef68", "value": 26400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433603, "uuid": "3f0c123d-2a01-4d80-bf2e-b26de4fc2561", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433603, "uuid": "441ad625-dfa9-4686-87df-0fb45874541d", "value": "PurchaseOrder.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b6a392-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419246, "uuid": "5dbed9cb-7f42-4ca0-8b7d-a46e3a2b1268", "comment": "Malware payload (Mirai)", "value": "e20f475a8bc540686441721b41ea76bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419246, "uuid": "c7f67855-eeaf-433b-9ae9-b8a63b78d579", "comment": "Malware payload (Mirai)", "value": "5268b17dfef328c417542412ed99057ec65aae68c02b8934a46c1ea95cbd140c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419246, "uuid": "1665b780-62e7-4182-a26b-cf083acbadee", "comment": "Malware payload (Mirai)", "value": "aab91ad8a8d9ab14828ab4a598198facc21bba66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419246, "uuid": "f3eba313-8e4c-4131-aa99-6b8c9033730a", "comment": "Malware payload (Mirai)", "value": "f7b8e61742d91c46c41aea86b0227a0283d07e8037b9262719ec71cd10d990d48e858fc79409f2b6bd0f6510b18cd4b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419246, "uuid": "0cc698ca-a076-4851-98de-5e2b2ce360be", "value": "T126639CB2C9642E18D3598AB1F124CF358363A504A2972FFE9166C76DA483EDCF5183F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419246, "uuid": "88e7fb4b-07aa-4b7e-9f09-b6ced687209e", "value": "1536:E6ICOnrFO8lRO6xMmw899iwa9rDmCreMMAKw1cUu8NJ:XAwCO6xMCQ9rDmVHwcsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419246, "uuid": "7b4f049c-41e2-4331-82e7-cb645b352601", "value": 66928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419246, "uuid": "30be1335-2854-4477-a0ec-b036f5a0a07e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419246, "uuid": "baa5e30a-8faa-4497-8116-b0db05493e4f", "value": "e20f475a8bc540686441721b41ea76bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab785ad2-fda4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459418, "uuid": "d53fc4ef-452c-47e9-8ac8-63aa1b70e375", "comment": "Malware payload (Mirai)", "value": "c571d2ff0f31f9d6de07328012bc2a6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459418, "uuid": "02ac557b-0f35-490b-b599-40dcd7e9b643", "comment": "Malware payload (Mirai)", "value": "532d832e14a860cf3ddda9d9ce95239aedf9a3ebf248f4613076f677c13b421c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459418, "uuid": "a7bbee9a-c7d4-4d53-9f4d-2be4f7ce5eef", "comment": "Malware payload (Mirai)", "value": "706da6c30c8113d4abf95cbfc55e5197ec5e6706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459418, "uuid": "90d9cabd-6b90-4f01-9bfc-56c6f5519044", "comment": "Malware payload (Mirai)", "value": "596ef5ee408846c47df12247be00ae89d47c2a34169f24ecca7ecb470f29f84969bad7cc33801a8a7672ab57ef0a386a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459418, "uuid": "6fdfd0e6-5d85-4d05-aedb-b0c15c2e4f34", "value": "T172432A25F935692BC4D8A97A21FB5329F1F90A4A24F8CB1BBC720E8DFB6451053172F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459418, "uuid": "744c56ca-7433-423d-9816-3ab3cd2e294a", "value": "768:97K7uv/LDXt8y1XBFMYU9TzVVRBHFwY+QTqFRjUM+eNO+lXWrAUY8rf:FEM/d8KvMYUBzVzBHFwYTTqFaML9lA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459418, "uuid": "082004a1-dc24-4646-9b52-0326cafc8bc3", "value": 59532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459418, "uuid": "43dcecdb-6258-49b6-aceb-933b71ad8e5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459418, "uuid": "e1ad360e-cfeb-48d6-829e-5e31721af7f7", "value": "c571d2ff0f31f9d6de07328012bc2a6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bb6031f-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466452, "uuid": "489ba978-3b5b-4314-a4eb-f8ec4c0c6514", "comment": "Malware payload (Mirai)", "value": "fefe0c55c9a9c668ef212765111d886a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466452, "uuid": "fa3d6ede-fa3d-4de0-a740-9e2d84cd8faf", "comment": "Malware payload (Mirai)", "value": "53475acef62fc99bfd6e4add25a563bae4e294d6fd68463da8b3caf943adce6f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466452, "uuid": "bfab15b2-00f9-4bc5-89b3-291c6c4e0364", "comment": "Malware payload (Mirai)", "value": "4458575dab7a3f964b99f4d21ed51a3f17510a0e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466452, "uuid": "766734e8-2870-4a32-b062-af261a439526", "comment": "Malware payload (Mirai)", "value": "55690dcd771970a8793d2952f0e5600be8ab35a95d3b8373f857e934aa7883f386cfcdfdd762b08b6da6ef1314acdc8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466452, "uuid": "8c0aa77f-6e40-4841-bd2a-50606916696f", "value": "T194E30A56F8819B12D5C111BAFE1D128E37131B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466452, "uuid": "10a086bf-246f-4628-b888-0d87ca456073", "value": "3072:0CKAUmbgWz4XFQ9YHwEaXrxqjBPCm3C95Rjo:0CJpn4XGWHFaNW/3C95RE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466452, "uuid": "e3d9d7ba-591d-486e-bd79-318fe975987d", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466452, "uuid": "e6a1ad48-e577-4fe9-8413-30cc50c23766", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466452, "uuid": "700e0324-5336-4a59-b3d6-8aa1c9672ad3", "value": "vlxx.arm6-20240418-1854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea330a30-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713439337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439337, "uuid": "6490a0cd-88ae-4917-a6d2-bf9eb9b78823", "comment": "Malware payload (Formbook)", "value": "81556c04b78490685e602d47202617e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439337, "uuid": "e10ab941-7d86-4ffa-8f4c-7f116a4a0169", "comment": "Malware payload (Formbook)", "value": "54c9ab39f879d1c9f3fc61e3cb1ffb06ac237bb20647c1f521d09b2dbb4964d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439337, "uuid": "d5252694-ae80-4037-aca7-9b4ac2eeea1c", "comment": "Malware payload (Formbook)", "value": "afcf7ca914c76a8b80136cdbbf2b31d8c6b96c7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439337, "uuid": "3fb0cd1e-77cc-4724-964c-7e0719f2f480", "comment": "Malware payload (Formbook)", "value": "359efe08bd053a914241589eb80670b7f6dd4ade11d39c269434f47beead7134a611860d359353989e85f39dfd389e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439337, "uuid": "1b3ad7c3-c3a4-45f1-ad14-b43a2b084533", "value": "T1F145BE0273D2C036FFAB92739B6AB64156BC79254123852F13981DB9BD701B2273E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439337, "uuid": "0cdf9c15-5f8f-4cb1-805f-b73ed0dc1a68", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439337, "uuid": "e4e098dd-812f-4de3-bad3-3310e58600e8", "value": "24576:wAHnh+eWsN3skA4RV1Hom2KXMmHa2OqYIe6JZW9jV0jy59Qa03NSh5:nh+ZkldoPK8Ya2Oce0W9jSyLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439337, "uuid": "3a5dd3d9-7b46-41fd-9a4d-275bec95becb", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439337, "uuid": "49d3892a-e005-4716-abc0-c128e0b0938e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439337, "uuid": "4d208a7b-04b7-4623-b19b-1227ae9dbde2", "value": "DOC 331-100920-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f92254-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425452, "uuid": "01a2b590-c1f3-4dee-ab04-ae0fb13c3ee8", "comment": "Malware payload (Mirai)", "value": "10c74cd9b3e8f2dce3d84b04c56f3ba8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425452, "uuid": "03a4b71d-f460-40ac-ad7d-e1b99a553c5e", "comment": "Malware payload (Mirai)", "value": "54eb34bbb703416f9c1b2155d5f23607bcf42eae70d91913bb4d7ecf7e8320c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425452, "uuid": "6a663272-7319-41d9-bc6e-5fbc745e5d41", "comment": "Malware payload (Mirai)", "value": "28a324b0887f936a28c80b8317bbf9638366db13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425452, "uuid": "b82e766b-c93a-4464-bcc5-f021ac1dd6e3", "comment": "Malware payload (Mirai)", "value": "387fecb67a7d5f8f172c5068cf8232d147495a5a741caf1a95c4f1fb2e222fe6abe1bbf1726146455fb44a57dbbab8b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425452, "uuid": "77e8c37f-c5c7-4b12-bb8f-804735c22090", "value": "T1DD63B415BB650FF3EC9FCC3B0AA92705198C650A61A57B367D34C85CBA4BA2F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425452, "uuid": "57975ddf-4669-4323-bbb5-bb3e530a5dec", "value": "768:jiKGqC4ppekuS4/xnFoniIInh3UV+veP3eLeAkeu8rhZu6Z9XiKhfb1nM:jFppek4/x+3I642Odk76hZu6thf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425452, "uuid": "90414ac5-affa-4a2a-85ec-9c41c85f960e", "value": 71596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425452, "uuid": "a0b2eab5-162c-4d69-b5e9-a1046c1e3996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425452, "uuid": "42321e13-0a79-4e25-9617-df1d61048874", "value": "10c74cd9b3e8f2dce3d84b04c56f3ba8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f60bc9-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439189, "uuid": "2e86db3b-d21f-4cf5-a8fe-17d700381371", "comment": "Malware payload (Mirai)", "value": "55f14081570442bb8ca57cd26864cc65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439189, "uuid": "29cc4af4-5231-412f-b3b1-97706283ffe3", "comment": "Malware payload (Mirai)", "value": "55214e49c1f3b04f7cd225e6243733b08665ab9f84e24f807c77e226c5f92d1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439189, "uuid": "d4cfa1cc-a565-4666-bb9f-feecd85931a4", "comment": "Malware payload (Mirai)", "value": "95f608b2d2a6653a51940d838e3d339a6e939e7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439189, "uuid": "bfa9c89a-1007-4449-9fa8-933f55f8410e", "comment": "Malware payload (Mirai)", "value": "6cc5c41ca0b65241a468e1015fd197be327ece2ec74d5cbedc331e152c17e8ea0580658554646c39f8e715aca507f10c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439189, "uuid": "1cc1f688-dd32-472f-8271-2509c7f59d62", "value": "T1CA431894B991AA16CAD443BBFE0F43CD37262398E2EE3607DD252F5137D652B0E6B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439189, "uuid": "32d9fc8c-d835-4439-ad65-9223af9604bc", "value": "768:dsnF5dDITUoadpcWO8uzfpy4CTjacbL10GbrlTHDSwlsCRcPSv8jtsMy89CDgkbO:q2udWW4oacbL10GP5eM8SvmtH9bs0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439189, "uuid": "2ad80b94-94a5-464c-9dfc-02680453aebc", "value": 59608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439189, "uuid": "ca8964e2-a0f6-4536-8c2c-8a7a2e0e82fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439189, "uuid": "1d1fc249-f8d6-4186-a882-c1b4ca9911fb", "value": "55f14081570442bb8ca57cd26864cc65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ad0df3-fd66-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713432652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432652, "uuid": "55139f86-4214-421c-8562-9bdc33075960", "comment": "Malware payload (AgentTesla)", "value": "34070a881f75f12cd4e5bfcb3bdf48c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432652, "uuid": "0bb6520f-a78a-4209-846c-253d627f33e7", "comment": "Malware payload (AgentTesla)", "value": "562b14cbead15ecad71e6e25e6c00656e47c3cf6e7d12eec64bfb4b9a6aaca05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432652, "uuid": "e7763618-b547-4f2c-bd05-4710c896d20e", "comment": "Malware payload (AgentTesla)", "value": "68d694a74aa970c84bf48ca15c979b408970843a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432652, "uuid": "856b7233-c765-46bd-8bc4-b5566cac31d1", "comment": "Malware payload (AgentTesla)", "value": "29ae65e18ba408a8eadbf496448aa6f4948b21288df92b877ef2c570da16d6948c71b520584524c7a7c97b5c6471b9d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432652, "uuid": "12224a2b-d2e1-4451-996b-1fae55183758", "value": "T18725D13D1CBD2A3B91B6D2A9CFE98567F040D07B3A11AD7698D383958346A9335C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432652, "uuid": "75fbe590-72df-47c3-bf97-6a25f767f60a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432652, "uuid": "4219e0de-8a62-4672-b3c7-0022ef00c245", "value": "24576:N6gObWRvPAbx/N35bTeguR2EHPF9kPps:BObIAt/nbTeguRdnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432652, "uuid": "5bb32fe1-87f8-42be-b58a-c6a967176e51", "value": 1036288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432652, "uuid": "4dfe49d4-2c68-4f27-8aec-7254ec6c265f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432652, "uuid": "059f945b-e8b8-41ed-859f-d3d6d56eb9aa", "value": "ORDER SPECIFICATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79884215-fd77-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713440007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440007, "uuid": "ac88a3ed-f129-4952-b938-4ace2e69eca7", "comment": "Malware payload (Mirai)", "value": "cd007fddc96eb0c050c4b9372168ed66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440007, "uuid": "afd61340-c9d2-4679-bc49-637415a25dab", "comment": "Malware payload (Mirai)", "value": "56a9a076d47d25f5d3882fd8d2bb58253e8d3d2a85d5c013f3aed6a160dc60e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440007, "uuid": "36855d81-69f9-4bc2-9a55-d62b1badb973", "comment": "Malware payload (Mirai)", "value": "cd7cc58f4bd24d6893a2d14fe26d8066e57c79a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440007, "uuid": "8053152c-0161-48f2-8781-96a6d587c98a", "comment": "Malware payload (Mirai)", "value": "6ac926b12ad297a681a0c830e4ef89ee17d4fc8f15fe6a3d5e957a825e38b3e1d981210e6f9bc6cbc6938c969b5211da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440007, "uuid": "9c5fcd42-9a0c-4260-b234-2ad862042b40", "value": "T1D1F2E1A883176DE0FD7FD0B904B967681C108BBAD542942B46B0FC96AD010B6F857FED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440007, "uuid": "f6c7723d-86ae-4738-880d-686f16924aa2", "value": "768:X5BLyfH8exgwqtOvIbs5b11/PAl39QJgGlzDpUYsM:XyH8exg7Qb11/PAYVqYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713440007, "uuid": "227dc1fc-51a7-4d45-8350-8c9cb9efc43c", "value": 35028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713440007, "uuid": "f935a3c7-58d3-447a-8dc0-fa2bde76efca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440007, "uuid": "b32aa747-2bb6-48a6-abec-79ed85a8046b", "value": "SecuriteInfo.com.Linux.Mirai.671.6996.10117", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d9b15e-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713467116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467116, "uuid": "899aff7d-1509-4193-a872-daf93dfd1d5e", "comment": "Malware payload (Loki)", "value": "4c0d5b830080aa8b72546a6d7f924aca", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467116, "uuid": "05601fed-dc40-4ef5-b42a-d06dfa1c897b", "comment": "Malware payload (Loki)", "value": "56b71885512e781975e310bc62af1a41bd731895d661f5cc49eff2a640806cd0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467116, "uuid": "082b57d2-77a1-4206-9903-56fbf7a4a3a7", "comment": "Malware payload (Loki)", "value": "d061aa6f577e894eb58fd4bc64b366e2e7919630", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467116, "uuid": "019ae515-200e-47c0-af13-c3e7edf52c23", "comment": "Malware payload (Loki)", "value": "8bb70be3c782c8c7557f1a3ef2b98bf3eee38a3eedb882ca6185972ba14799a9da5ecabc434754a8b3da67839e7e417b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467116, "uuid": "43501016-ec17-4afd-8ab0-ff18aa0eb5cc", "value": "T1A38427E3DAD526298A4A2AB7ED134B738DB4415C33131E78A3BCC65D604395C82BFBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467116, "uuid": "c9c83dd3-2686-45d8-853c-a196209de14a", "value": "6144:1qJLaVfs2VTA05zBWJKJqDv9WlmDg6bMiaNb3rczF9V4I5Btg/zRoFTC4vSUUkPE:4uInOi5cI5E0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467116, "uuid": "0d7d888b-12b4-4200-9d8d-a19222a0355a", "value": 372599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467116, "uuid": "c9f1dce5-eddc-49fd-bc1f-a0613b4a4206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467116, "uuid": "08cfe221-69cc-42dd-9708-10f6f3d3e6cf", "value": "Request for Proposal Quote_2414976\u00b7pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc0b7fb-fdab-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713462402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713462402, "uuid": "69f9f3ab-f7e2-452d-b4ec-cba947868cf8", "comment": "Malware payload (Mirai)", "value": "bc86183c67db69ea5c83b7a596a6cc21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713462402, "uuid": "46372241-664a-48a9-aefa-7bf8685af397", "comment": "Malware payload (Mirai)", "value": "57387202c335220f7e19bbb08758a735d3307ae45e3fbe6ee1e1bffe9e3da53d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713462402, "uuid": "a1f2f0ba-7972-4043-ab22-1c1a652a2678", "comment": "Malware payload (Mirai)", "value": "74fcd1752f465bc553b55cc66500529ce9039dd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713462402, "uuid": "b73747a4-bada-4cea-95ae-85f89ffc2f2a", "comment": "Malware payload (Mirai)", "value": "d168241df8d41b1e7f719edf93551d0f5b39aaa1f4e34186afd697d682fef2a83f42f092f0e095a54252876d8a50d878", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713462402, "uuid": "a4cfd1ce-79c2-4667-a517-66137819aa5a", "value": "T16AF32A46EA414B13C0D6177AB6EF42453323A764D3EB33069928BFB43F867AE4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713462402, "uuid": "d0864dd7-2cd6-4988-ae43-b7a4897e34d4", "value": "3072:SHQhEOh1gTtA58ixaREUAdZJ3ujmR+1yeT2gBoM/94GPJ2P:SHQhaGhxaREUAdZRuD4eT2gSM/948J2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713462402, "uuid": "35bf7641-3085-4208-8aef-d64ae8d598cd", "value": 161102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713462402, "uuid": "8b661d42-2215-4576-835b-0eeb189445a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713462402, "uuid": "96fea7e0-facd-41cb-a0d6-522c25c819c9", "value": "bc86183c67db69ea5c83b7a596a6cc21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e964ebec-fd9d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713456516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456516, "uuid": "88fa2831-1b6f-4a2d-b283-e5698f3e2bb3", "comment": "Malware payload", "value": "f9f276db97c371b83765a24ee1d14d66", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456516, "uuid": "03f52e61-66df-4fbb-896a-014698d63536", "comment": "Malware payload", "value": "57aa9cce85c62c5f29fd37a5cc02f11d1f7c0ecb73a8e17688bae859d4695f42", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456516, "uuid": "15d77d97-5c9a-4ab9-8cd5-bf3bab94bb64", "comment": "Malware payload", "value": "b09e627b60d2d4d1331749404679d436b265bbf4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456516, "uuid": "eba3055f-0cfd-47ce-99c6-87280ae1ec33", "comment": "Malware payload", "value": "17252531659e6174473e4147d9c55f0cad6c306ad3d41f45e8198d116372bf500286cfdc1ab7204dad44e5987500c402", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456516, "uuid": "1b23df0d-550f-4705-abef-3756f73d71b6", "value": "T12541FE0527FD1731E3F3897614BAA731CE7BB405CE56AB1E019113886862B40F969FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456516, "uuid": "ff14beda-86b9-49f6-b8d7-f0ecb0a0155a", "value": "24:8faNkDmgih41Av94zcuhJBkOtp+/4P+8PxkSlqdd79dsW28mT84abtl868z7m:8famDmCC9AJL77mSgdJ9pn4a46q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713456516, "uuid": "1034098d-3fd8-4f8f-92a1-6b00ad654617", "value": 2007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713456516, "uuid": "a1306ce4-8c2e-4966-ae78-c504398ea220", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456516, "uuid": "7ef6e261-2f5a-4df6-bb38-296be024077d", "value": "SA162.pdf.download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e966d014-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419579, "uuid": "f7b44abf-91f3-4f73-a9ff-596f8ceeba9d", "comment": "Malware payload (Mirai)", "value": "9f5b50a77e18a5aa70701e3fd0d1cdb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419579, "uuid": "735a6afa-6a01-45c9-a4e1-643322aefcae", "comment": "Malware payload (Mirai)", "value": "587687b2c2b12f29938092c3870cdde553002a9dd93aa99956f8970b418f641e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419579, "uuid": "f2c2a82a-cc2a-4224-837c-6a75a0932167", "comment": "Malware payload (Mirai)", "value": "750b645806cc58de54fa4aa75ab3b1459e0ebc30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419579, "uuid": "6b824118-4e7a-4c93-9e74-9f8658b84b94", "comment": "Malware payload (Mirai)", "value": "30f7d89460ebf8999d9dcc04a53390a3ad1b6117931c58077499af190c3f3d874eb6f7deed6625e1858cf85c97201818", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419579, "uuid": "d98cfd8f-c4a3-4dea-9bae-37ba829e0069", "value": "T19EE3426BBE109B19F65C973106FB6D28834A23E72AE5E54AD19FC2002E7131D5C0FEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419579, "uuid": "cb000e25-9c1e-4985-b29e-854af0d59a5c", "value": "3072:mC1zHgj7BnRNegrUp2yNzPnqKyVixix5Q4h4xF9aFb1lHW4bibg:r1zA/BnRNegrUK/iE4xFUFb1lHW4uU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419579, "uuid": "f083e692-1204-49ef-b49a-3408c9303e72", "value": 153752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419579, "uuid": "934e55b0-e297-4d9f-be21-794a0a8efa5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419579, "uuid": "12c86ed9-e760-4a40-acc4-607ca45d55a0", "value": "9f5b50a77e18a5aa70701e3fd0d1cdb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9b297d-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713430808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430808, "uuid": "2e335bbb-bcda-4323-954b-e62f73ce5e9c", "comment": "Malware payload (Mirai)", "value": "d2500977ca5778dd105c2906229755cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430808, "uuid": "2b888728-67a3-4f34-b5a8-bdd0daa3d793", "comment": "Malware payload (Mirai)", "value": "58d890cb0d3d48c2d121997fd813439308de0f8261a0400b0ae95a11a1f5ff3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430808, "uuid": "316f9686-b77f-4355-8943-e6fbc81c8e13", "comment": "Malware payload (Mirai)", "value": "5f9bac2b182f7818b3f6bd5aa4a37447dfd43f99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430808, "uuid": "11ca9930-22b9-4fba-a921-474ea4aaee4f", "comment": "Malware payload (Mirai)", "value": "8faaa05025beee391226f039aa61af7a636021ff1a281fb84f5c04892b03ac767931d5558b419f1c8f5fc4a87423a679", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430808, "uuid": "8fcb5419-44f3-4d56-97da-4ee4402f2e56", "value": "T108F2E15BD865768DEAE82E7C50944A52CC8CF0C473572B6AE3614CA3659F413F10F86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430808, "uuid": "f4e2d676-77a4-41a8-a4f4-8ef2c7641219", "value": "768:3vaocZyVFReRpnX2kCZhOe5svrBIOVJdDjwL2WMo:3iyVDe+xZhxsvd9Dd/kd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430808, "uuid": "099c877f-d840-4666-bf86-73c2629674d8", "value": 36320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430808, "uuid": "87bd42b3-0eec-4ea5-9bc2-f72bcf9b8aa8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430808, "uuid": "57634bcd-29c7-4b77-b0d6-d33adf10da36", "value": "d2500977ca5778dd105c2906229755cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3919550-fd87-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713446950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713446950, "uuid": "394bf398-1f12-4511-a34b-1022e3207036", "comment": "Malware payload", "value": "db25f2a450d4be805c688fed361f3ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713446950, "uuid": "a5ff81a6-6f76-49f6-ba93-d7868fc90072", "comment": "Malware payload", "value": "595048b693edcef46d5d3f84c2cea2372cf0068246ec8ff06a48d5c80a3f3911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713446950, "uuid": "30cecb43-9fab-479c-8e8a-b6e90106b51f", "comment": "Malware payload", "value": "56740a28b18ed45bfcd298e66e996cc3eacc6fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713446950, "uuid": "6131ecac-b242-4979-920d-48e2cf391888", "comment": "Malware payload", "value": "923a88d9cdf3e0ff8646531a6c38b81d3cfadb05d013b62109c8e34bbd5b9ca72c5e58f01cb2f6f8b5d8c76f949892e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713446950, "uuid": "b2f47ac3-49dd-46af-9a23-142a85f8b91b", "value": "T15725D3427DDDCF22E36561308A72C6B862696CF5E6E51247327CA11DAB27331B23E317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713446950, "uuid": "e9dcfd71-42a9-4346-bb26-eff7e33ec2fd", "value": "3939abde5434dd98e9c954580939d71d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713446950, "uuid": "26c6cf28-2e32-420b-b896-dcf2093e63b1", "value": "12288:DP2wrnoYS/7WLpoRX3r8DyCHEPgV85uMhZ3F:DP2wrnzSgSeyCHEPgVEhZ3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713446950, "uuid": "5f38e077-c9f9-44d2-93a0-1eb20f8b98df", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713446950, "uuid": "74fc51be-94fa-46c1-9192-1170f584e54a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713446950, "uuid": "abacde6a-2329-4527-9450-1752f26a281b", "value": "SecuriteInfo.com.Heur.13638.30419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feca9f72-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713427775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427775, "uuid": "43e2c6f7-4a95-4aa7-a9f0-7b6d9b358f56", "comment": "Malware payload", "value": "7750fcfabed5e3a98c599589edae023b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427775, "uuid": "3f2a95e3-5e4a-4f6a-8dd1-2bd247317942", "comment": "Malware payload", "value": "59b0567b65c02619fdb7a55650f33d4bc50029ed56a6a8e1470e387f1d2e9b0c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427775, "uuid": "68856207-9b57-445a-bf13-ec271c803eb9", "comment": "Malware payload", "value": "b601ec218bfe6f7ce4643d6f9435ee2bfc5349c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427775, "uuid": "1e41f75a-55f9-4308-b664-72158cbaf0b8", "comment": "Malware payload", "value": "3c85e6e4801edd55e2631221a1f6113b0f4ea3544ab702538525f57d67987ebbb850f7aeca17c9fb17a308950b7ce938", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427775, "uuid": "0cf0dfa4-e9d9-4157-aa05-f80ad8061285", "value": "T144936280B5B3BE3AD04C183455AB63DA1BFCBD7E8C45A72B22D23B193E74564AC1472D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427775, "uuid": "65d40f8a-e772-40bb-a94a-7aa4c5ce1418", "value": "768:9s0uUFM1sQro2PnMfcL+6KgdQl341uWXnGVz8xw+t8Iq36z8mQr4HsHn6wF:9wJWA/0gdi41uN2xrtA36gzrwa6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427775, "uuid": "ce090330-95d0-4865-aa88-14948b9eae7b", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427775, "uuid": "46f852f7-764f-40b6-be58-7dfb6f944c13", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427775, "uuid": "265e7600-a74e-4397-af27-748df8ee5077", "value": "DIPANKAR WEIGHT LOSS DIET.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187ef4db-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713430825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430825, "uuid": "afcef4bc-9ab7-406d-befd-7f054fd4f1aa", "comment": "Malware payload (RemcosRAT)", "value": "9278d07272accaf33d132bb6dbf6a7e7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430825, "uuid": "128e7027-422d-4d22-8d08-c383ea2b338e", "comment": "Malware payload (RemcosRAT)", "value": "5aebe72f050d5977cccf05c5c21bd56dab2c8caf96b9edcf9b1bcfabcf0702fc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430825, "uuid": "09801f03-e722-4993-b254-94ec8b6434a8", "comment": "Malware payload (RemcosRAT)", "value": "2baca87c9698a70badda973491cdb8fdc82982d5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430825, "uuid": "d3b2f70a-421c-406e-a1a8-d03368a1db41", "comment": "Malware payload (RemcosRAT)", "value": "190af4e30c2f2600d6136d2f27dd95620140361927c7751b5b592db909e830d2c6268f8e47ce933b9de0eccb67ef0756", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430825, "uuid": "3fd4914b-51b3-4d05-b8e5-1456f466a84d", "value": "T1B1737F6ED30F0954DF5997BB434A4B0A05FCB33EB28540A139BC677437AD82E4A619BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430825, "uuid": "1f5304ea-fc9b-4456-9bdf-1afb62ccc8a3", "value": "1536:TdgqOavGX0Rg0irVBw0hyRHnmAZwzWsl9fvIeFWnRmTM3PdCxjws1fEheLL7Xbl5:Td+avE0Rg0irVBw0hyRHnmAZcXfvIeFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430825, "uuid": "908de02f-016e-4d98-9d7d-dacff2bb74c6", "value": 76414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430825, "uuid": "e239b464-9614-40fe-84df-8c644462f9b6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430825, "uuid": "bf1c84a2-c4d9-4475-a014-762f5509948f", "value": "9278d07272accaf33d132bb6dbf6a7e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f44d3ff-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466458, "uuid": "ce8cc602-43b4-4478-b80a-4c8818a39d2c", "comment": "Malware payload (Mirai)", "value": "ec1600dc1175188cd5a806a37a5cb2eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466458, "uuid": "d2b2f365-0b75-4419-9a11-8c3c75491a5d", "comment": "Malware payload (Mirai)", "value": "5c51316ae93bfb2a0fa274baf19d4f3179996bb8216679039eb0cc73b7ecdb59", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466458, "uuid": "f5d02c94-6049-45af-b78f-48bc5b224b6c", "comment": "Malware payload (Mirai)", "value": "74a41aaeb9ed879ba3bd83f0df416e3eb24f62b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466458, "uuid": "92fa6937-6687-4e69-8f81-004f4ede9c36", "comment": "Malware payload (Mirai)", "value": "36f9b7d99db6dbd2fe630228db87a31b6657c066d4cd4e54f3aaaa92938010c0642569478a2c15555772a4b3b4f186ce", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466458, "uuid": "e7fa1340-796c-4617-b0e2-29b5d2c4aa3c", "value": "T19004E91AAF510FBBD86FDD3705E8071135CC945722A93B3A3678C928F54A94B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466458, "uuid": "56e37039-5015-4c27-a9f1-a000c280eb04", "value": "3072:ZEo8/X/RRp7jj11XGMajswXvt+B42mLPPH3jFYp9UyXDj9I:6/vZjRtGMajswXUB42mj/CUyXDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466458, "uuid": "61dfc236-44a8-4b0f-b097-d88fb2308f5e", "value": 189712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466458, "uuid": "de054baa-0e1a-4bfa-bc41-04a14a629376", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466458, "uuid": "f2fe81c8-322a-457b-ab9a-86f6b7a69159", "value": "vlxx.mpsl-20240418-1854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acdb386-fd43-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713417514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417514, "uuid": "c48f28df-1e7b-4abe-8c15-61e4740f2774", "comment": "Malware payload", "value": "f456a7fd78b0dd10acb421279b377a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417514, "uuid": "74b935a2-0762-4afc-85a9-01a98de8a568", "comment": "Malware payload", "value": "5d9a5c61f0ef143449fa486e4582ddaf6039de6ef285237e9aeb820abff63b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417514, "uuid": "ecd5f9e7-d0cc-4ccf-8758-0962c0dfc1f2", "comment": "Malware payload", "value": "72bf459006eb21941bb95a26bbfe295dd0112a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417514, "uuid": "68c27e76-9ccb-4761-b64a-32c42ffd85e8", "comment": "Malware payload", "value": "eb0cc62208e4cb2e24e0e6499e6c1132ca5bc53398cfdf577eca5abccf1c6661fef5f99544405c9005a2b9123764bdd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417514, "uuid": "b60b5f65-5bc5-43cd-b3d4-f74061c6920c", "value": "T1C1D42375A3158F39C1895B3FAEE41B6123B5F7239C059EB939B10D0BC70BB58AC3614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417514, "uuid": "a791e1ca-9155-4792-b486-5fa1a17b6fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417514, "uuid": "6027a368-f347-490d-aeb7-bb0b316afa8a", "value": "12288:yDIoaj/5eh148RQedp5bu9TlLfUTdwq1pdUWPBBT:Fti4c5vbuhZUTdFrPP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713417514, "uuid": "ec351a75-da4b-4d40-9424-39d3e377127d", "value": 649728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713417514, "uuid": "3779b546-b343-40ba-a1f1-0ae153cb1442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417514, "uuid": "f391270a-b491-430a-9bda-c7f8e9603fe6", "value": "SecuriteInfo.com.Variant.MSILHeracles.77820.8707.3938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2324473b-fd65-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713432131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432131, "uuid": "5ab8d656-e4ae-4985-a44f-3bb6edf0ed2e", "comment": "Malware payload (AgentTesla)", "value": "e311a56ea4ce34afa77b8f5290604c33", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432131, "uuid": "581137cb-e144-4e03-9145-739e1addfc30", "comment": "Malware payload (AgentTesla)", "value": "5e8af6bd3e7166efdcb8e65ce8b6fb997b77f5bdebfca4a897ed7d78f474615e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432131, "uuid": "6936527c-f496-470f-b8bc-ee173c4852ba", "comment": "Malware payload (AgentTesla)", "value": "cd2b0082221a55036b73be9cfd582fc2748163f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432131, "uuid": "cf2f9e62-530c-4160-964c-a2724892a7d4", "comment": "Malware payload (AgentTesla)", "value": "00f4926b7a3b62041885efefb85a62a5033422838e01cb73413075517215408b1a02d7096abe92c129a18819cc34410b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432131, "uuid": "7786edc3-7af4-4916-a637-abe2a7dfa022", "value": "T13C05230AFAA3037D4EACE59BD2567EC48CD4204A5E7F3E331C48357E3567D169B69060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432131, "uuid": "f9bdc7c1-4c6d-40af-a0ca-b8a58f3f21bd", "value": "12288:UZWIhBUr0vYD6/qMZmqJLIUtPKeKW2UQMBpH3GjwgmOUvU2CpNJvPx2FnWXVXt/o:UZxhoqZdf5eW1qT7mU2cJv52EF1Ot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432131, "uuid": "add8018a-a91c-40e3-b9d6-b481efe70319", "value": 862298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432131, "uuid": "c67a94e1-ec49-4782-89a9-56222b3482b5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432131, "uuid": "77b35046-ffd7-452e-b21f-42aa04f1a088", "value": "BKG#SGN2106728.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfde8fe6-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459050, "uuid": "11baad11-064e-43d1-bb1d-f68a6c9030d2", "comment": "Malware payload (Mirai)", "value": "440cc74d12d4985b69c2b3b4dd143b70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459050, "uuid": "d5a0599e-25d7-4989-99b3-2b6216d6e7ce", "comment": "Malware payload (Mirai)", "value": "5ee322f77626d12e65a0f31ec9059404de78db5d5cecd17f2fe6f2bfcceefb29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459050, "uuid": "e0539a4f-5ec9-4466-b273-73113a34c2bc", "comment": "Malware payload (Mirai)", "value": "3ff6043282c56aaa042d32cb169a23563fc2df9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459050, "uuid": "76e7f2e4-407f-41d2-a0a8-3d7d30bbb0a9", "comment": "Malware payload (Mirai)", "value": "6c0ebc3bcd13d4adb46e7c8d9c038dc2077775fcef00820f46be5ef901eb3d97bd572e67f961a58920cf4f2f89a5e7f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459050, "uuid": "730e5145-bc61-4a96-ada9-debb46165520", "value": "T1DC238D66CC751E98D2688274F0309F7E9B23D912E6872EEDD49782368443E8DF9493F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459050, "uuid": "0407aa6f-88c8-44e2-8490-9b7a872e459a", "value": "768:hhDgNX0szucke2Fpz8+Y0hNEGx5vZE54xJZoQ1MCkcMIxP:hJqX0s6cGFpz8+Ych5hEEUAMCkuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459050, "uuid": "346d7772-c2b1-4d22-9c38-a85dabc66185", "value": 46564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459050, "uuid": "81252598-71e5-451e-a88b-c7daaf1bb29d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459050, "uuid": "8cafe639-cc59-4b5a-82f6-81ef4575e238", "value": "440cc74d12d4985b69c2b3b4dd143b70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a07be16-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1713467093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467093, "uuid": "85081c57-0f0d-4728-be93-8785eff328bd", "comment": "Malware payload (DBatLoader)", "value": "d3ebda3a1052cc478a684f4ef7d03f53", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467093, "uuid": "35495067-f07d-4298-ae9a-ddeef64c020f", "comment": "Malware payload (DBatLoader)", "value": "5fec8b78ee503ab0e7c16a49503f194cdf8c8fdf517e93b435d6bda46cf32c4b", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467093, "uuid": "0e7b1971-92c7-4614-ad5a-fd43c4dc2d3e", "comment": "Malware payload (DBatLoader)", "value": "aee0865f4ddd7ba6129b3806c05e0440addfe675", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467093, "uuid": "9b2e131c-3689-47f0-98e0-13d036e1a0ad", "comment": "Malware payload (DBatLoader)", "value": "77ad423680098d75ff75b52c9569d8c33dfb3db89ef544b9e6bce6de9114c0a1c67d4b7f2ce68f00b9087d3b298475f5", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467093, "uuid": "7b9daba6-84b4-4e46-a17e-8817823f006a", "value": "T13764D051BB408606E455573549F34BAAA325FC416F934B0F325CF72E3EB03E16E2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467093, "uuid": "02a3d76f-04d8-47f6-bcc4-646db82fe111", "value": "6144:vVunJhmZ+RwPONXoRjDhIcp0fDlavx+fgLt0d65ivSbVmLc+31QNI8dsX07LfOLk:v4Jh83bVGANI8dsXMfOdLft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467093, "uuid": "9dc9c6fd-1724-4a9b-a944-bdad5e6db13c", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467093, "uuid": "45192f13-97ef-4fbe-b29e-fb6e7955a7e1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467093, "uuid": "5c4df597-fcec-4a78-b75f-f8a02c525601", "value": "2020.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1832e93e-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472486, "uuid": "a0ecdc31-2f5c-4b1a-8272-8d43bf48524c", "comment": "Malware payload (AgentTesla)", "value": "b802d641ee396d64e3a34ee64b4ef4c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472486, "uuid": "434b9dd4-ff53-4c00-9cb0-6fd51dfc7799", "comment": "Malware payload (AgentTesla)", "value": "6089c5be68bdbefa9f1e5689a79711fa0233665614a3c7053ade99bc6b475f02", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472486, "uuid": "4530aa99-dc33-4ea6-a933-1d86af13c51b", "comment": "Malware payload (AgentTesla)", "value": "814d215333b4b307ae34f95f427c2e4d86674a6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472486, "uuid": "64b2ebcd-c4b4-4f6d-8aeb-b01db789be93", "comment": "Malware payload (AgentTesla)", "value": "24aa51d063d5de5adbbd94f24ed6d9ed05a8541687814302d5b8b61541f3ad4eb7e5766778e85f9daa557514ff0de8ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472486, "uuid": "8ceb3159-218b-4815-933a-3056240bfd2c", "value": "T1FAF423EC542CB5ED665FC990A0FB245CD0ED969F320BAAD5AA8C94F0DC91FA248D8107", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472486, "uuid": "01acbea8-d5c0-4274-931d-9e7b96d20ff8", "value": "12288:UGDb2iiRtIt4JmVUNZdNk4pa5nRRqgPAl+ORkYTIjWWE8Q/wUkZyIfoYBeqjgAZG:UGDbytuON/NkKSRRFAldN2/E8QKZjLju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472486, "uuid": "d152dab6-3f88-4583-b1fb-18451978d54d", "value": 753893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472486, "uuid": "303ec077-c4fc-42b4-86d0-a0daf788ea41", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472486, "uuid": "e6bfd7ce-ba95-4b3d-aec9-65c43efd2864", "value": "Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ee194b8-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434701, "uuid": "9a8d32a5-8051-4e8c-b50c-1fc15bc2c0ec", "comment": "Malware payload (AgentTesla)", "value": "c0667e4391fe11e7fa80f4d22264f0d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434701, "uuid": "35c45725-4a9e-4705-a4fe-5ee2f6b7c56e", "comment": "Malware payload (AgentTesla)", "value": "6099df8aebe136d10351276364effa1cf48028095dff2b4b5bd745aa1cc576ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434701, "uuid": "46ca58fb-70aa-46cd-a97a-61f15b2e904a", "comment": "Malware payload (AgentTesla)", "value": "c40e392714bbf7515e0a104434af9f8de5c6962c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434701, "uuid": "80815ac4-d258-438d-ab1b-f47a20ddb62a", "comment": "Malware payload (AgentTesla)", "value": "9ace2e7dfae3f631236a296c2d7237eff7fdec1b066084350f59f55ca10b71dde3c762f0b6d64db8af68834a7e6b5cd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434701, "uuid": "c27e285a-9bae-4b02-a94a-b64bd55fcd5b", "value": "T1EB259D0273D1C036FFABA2739B6AB24156BD79254123852F13981DB9BD701B2273E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434701, "uuid": "79edb86c-2da4-412a-adf4-c43f0c8c2e9e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434701, "uuid": "8fc9ba33-1f96-4a49-b5fa-26f9730b1d2f", "value": "24576:QAHnh+eWsN3skA4RV1Hom2KXMmHaCAg0CyQ5:Hh+ZkldoPK8YaCKCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434701, "uuid": "1b54e361-647e-4ad7-ac22-796a4caa6efe", "value": 1033728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434701, "uuid": "6d5664c9-c6bc-4d1f-a085-302b0272c546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434701, "uuid": "76cc6753-089c-4f03-a355-379aeb9780a9", "value": "##DHL# BL, lista de empaque y factura comercial_7876576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee2888d-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439184, "uuid": "4d283118-db1e-4e35-907c-ecb843ab65a8", "comment": "Malware payload (Mirai)", "value": "0a41d28dccc24982e42b72be123edcb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439184, "uuid": "800ee35e-4f85-4177-8fe7-8fe93aba24d0", "comment": "Malware payload (Mirai)", "value": "60d175490b08631b22426b23e7919005ec97d5afd9250df1c56af76994f2dd44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439184, "uuid": "dc30ec8c-e3cc-4012-bbf7-69f1918c3e40", "comment": "Malware payload (Mirai)", "value": "0facabcc3a56a214dcc7e01759597819c5cdbc92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439184, "uuid": "3852cfb2-7971-4bd9-a19d-88b03d684c71", "comment": "Malware payload (Mirai)", "value": "e07652ae89e5f2fae73bdf6f31f4bc81dd15bc9494e2474a548f3299fb519cf21de5a2296ff16e37bc45d7c7e5b40019", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439184, "uuid": "794ec2f2-fa23-481f-8589-ba9d71edd61f", "value": "T18E83B40ABF600EFBE86BCD3705E81B05248DA41A21E93F757934D928FA5A15F09E3C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439184, "uuid": "6e2c0375-152b-4062-b158-4263b1cc8231", "value": "1536:O2kPQeZVlRwBG9MzavUbYHLu43Nlb7Z/kHZ:ObZVnSG9y8Uyt6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439184, "uuid": "fbf807fb-ccf1-4da0-8505-833aedffde71", "value": 80768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439184, "uuid": "cbb48c32-b6ae-42fd-bcfe-bec3d7d213d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439184, "uuid": "5c437913-04ae-41d0-b797-6deb91da6aa9", "value": "0a41d28dccc24982e42b72be123edcb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c52a86-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713425106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425106, "uuid": "b799fb7e-8adc-49e4-9b98-ee52e076670c", "comment": "Malware payload (RemcosRAT)", "value": "f08f508e797fa19d89a8a4688019fd99", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425106, "uuid": "7517bff2-e312-4f04-b5a2-b1f41a3dc177", "comment": "Malware payload (RemcosRAT)", "value": "610119f52d69e8132b0130740836426d0b25fe5300ee4e12f2c51d1e36fec546", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425106, "uuid": "0770fbb1-72d2-48ce-ba53-4253368792ca", "comment": "Malware payload (RemcosRAT)", "value": "32de77ff5689fbc68f64aa9cfd4405cc2686fd85", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425106, "uuid": "5a404f8c-838d-4f5e-9a82-d6f8f99ba537", "comment": "Malware payload (RemcosRAT)", "value": "750cb3827878628e1070a52c44b7b08b7c34aedaf6831dada1f37872369911d5605c67100516cbf4362aa02262006ed5", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425106, "uuid": "3067486b-c3b3-4df0-9924-9b54af3d187d", "value": "T170145BA0CEC9223C4F471BEAFC650561C9FC8169462610BDF9CD676D6103A6CE3FEA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425106, "uuid": "f5ed32e7-6e7c-44c0-9a77-baf135ad82c4", "value": "3072:2MC8jqTKK8ccABOwbDS2y2zJETxUuoHh3uSH/OY6C1HwvBpVs2RtBZo5mFSarDYM:QTR8ccABOwbDA2zJETxVu1NH/vsd7tBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425106, "uuid": "c79a5eb0-c11b-4022-ad84-c31bfddaf285", "value": 192185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425106, "uuid": "de7d5d62-bca8-4fc3-9bef-e55c40f26e17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425106, "uuid": "453bd5ad-1bfd-48ea-b7ed-72b914c05de4", "value": "EFEMACPedido0180040240418.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11768b5-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1713457710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457710, "uuid": "b62e16de-1d2d-4fae-bd34-9b3c9897af8d", "comment": "Malware payload (Kaiji)", "value": "e7c6bf75f4dc4a49bbab55fa7d0cc3c8", "object_relation": "md5", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457710, "uuid": "e6e94333-e983-4782-bc4c-f7f6f7a2fcb6", "comment": "Malware payload (Kaiji)", "value": "61c86757beb13fc92099432f0e2381114ddd1ef64911f74be02ac3265dd864ea", "object_relation": "sha256", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457710, "uuid": "1a4e3f6d-ae93-4e62-93d5-5e409cd67070", "comment": "Malware payload (Kaiji)", "value": "e2cab9d930479949b71eb4e7e619b137cbf43813", "object_relation": "sha1", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457710, "uuid": "2c39f08d-caa4-4919-aed4-49e8595b1268", "comment": "Malware payload (Kaiji)", "value": "db355e75a10fdf44f37afe6476ac304becac7eba66834dfa78dd9eed8460b6f8cce7ae7b87fe0a38312b08fa22b6499b", "object_relation": "sha3-384", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457710, "uuid": "269f71a2-fcc9-4ff0-98c3-9140c5d0aff8", "value": "T17F360812AEC26B76C6CC037442FFA75662907F0856D51B2313B8DAA8395773DEF0688D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457710, "uuid": "64357965-0140-4901-88cd-37e2577cfc95", "value": "98304:Z9mVusEEQ4kVIb0IamIIkmrIGDeII8jOSPoR:bu8VIb0IamIIkmrIGDeII8HoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457710, "uuid": "7afb6c12-32f7-496b-9508-9fa350543690", "value": 5171075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457710, "uuid": "b6f55f4c-c0d1-45ac-a2d7-f1dd7077caa7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457710, "uuid": "4c80ce3e-a43c-468f-87fc-f8c8e3ec030c", "value": "61c86757beb13fc92099432f0e2381114ddd1ef64911f74be02ac3265dd864ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c670c6d-fdc5-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713473486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473486, "uuid": "977656e9-48f1-4f39-b9d9-8f3fede87c07", "comment": "Malware payload (Amadey)", "value": "a599e020f718cf8c8f2c4cbc4dd53a20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473486, "uuid": "af36f857-d4f6-4d2c-a8c1-d61e1cd0432b", "comment": "Malware payload (Amadey)", "value": "624f4d882c679941ae0fbedd47554d2dd8419c3d5e6492d020b004719c164974", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473486, "uuid": "b2a4f681-5c80-4807-866d-c2a9f2b798da", "comment": "Malware payload (Amadey)", "value": "204471dfbe8595643042f780f6a41e11af6933d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473486, "uuid": "455af5d8-7661-4a65-987b-e061ea629910", "comment": "Malware payload (Amadey)", "value": "fee2d48352eee4c59a2b2c335133be586f0fc35733e5a80c385aab5a184083175763bec62688e5c37da56dd3d8227e63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473486, "uuid": "0e45fd02-7532-4008-99e7-beca0201f6c8", "value": "T1FDE54A92AE0472CFD49E2B74943FCDA2595D07B9472108D3AC6964BABDF3CC121B6D38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473486, "uuid": "0d8d14b8-a67e-4d0b-8e24-ec9f4fbecfe1", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473486, "uuid": "4c813978-b6ce-45af-9d39-f9206f9a9dd4", "value": "49152:O7yhKtnwpmRei5FHEdkjqM6tUi2jIILqdYhfdIAcax:O7yhKqEeizHEdkuM6tUhTOU6ANx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713473486, "uuid": "90289e33-8cf8-4aec-ae67-25094c954ac1", "value": 3034624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713473486, "uuid": "8cc23f7b-4639-4158-b4e0-645fddaba68e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473486, "uuid": "47bc2b08-1f05-4bb4-ba1e-bf40d658ef7c", "value": "a599e020f718cf8c8f2c4cbc4dd53a20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83e3ec7-fd39-11ee-a120-42010a9c002e", "comment": "Malware payload (NetSupport)", "timestamp": 1713413537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713413537, "uuid": "23f4ef19-24ec-41d6-a2e2-18e3385694fe", "comment": "Malware payload (NetSupport)", "value": "75171771c15c9d0df9941e0d138723ff", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713413537, "uuid": "60ee4549-e5a6-4201-88c1-823be218c80d", "comment": "Malware payload (NetSupport)", "value": "638d8ea8c1627cc6df799188b1d55e4ea8d381003677ff67f455e9465c1a26a3", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713413537, "uuid": "eaa3cb82-066c-46f2-b931-bed13ee2a766", "comment": "Malware payload (NetSupport)", "value": "19d2d173ef667be1be19b9ddab4e274f5f969e90", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713413537, "uuid": "053ad224-675c-4a94-8adb-5cdb4a8f3277", "comment": "Malware payload (NetSupport)", "value": "886290a2a9db3083335b73e5b4a0ed7680f9a6ff5891adbcede897c6c4975babc8123966f5979fccfe2b0cce12949936", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713413537, "uuid": "e8910645-e82e-41f3-b6c0-c95bff16ff4b", "value": "T16466334A87324371E23194BC91911E2305F07B79A2BFF8495DBE5CDBEC7A061A587BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713413537, "uuid": "f4a530cc-3f92-4ccb-9e46-67d0d7279667", "value": "196608:Z8oDmWKq7cLCuSllE71V/YxQtw44B2yZIgrM:6nyW2Otw4hyuWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713413537, "uuid": "7b6f00c7-e9f3-4880-af47-e0eec1388fa2", "value": 6969492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713413537, "uuid": "8c0d1ce1-c13a-4458-bf03-33430672b864", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713413537, "uuid": "e10a90cf-f88d-4abf-a83a-7ab2ce2a34ef", "value": "BB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab25b08-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416655, "uuid": "e6ab2287-f19c-4664-be41-5e3fcac3eee2", "comment": "Malware payload (Mirai)", "value": "6c0a66a5756f828655e7ed7e790fb5ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416655, "uuid": "c227e2ae-c325-44b0-a8e0-f808b1a12eea", "comment": "Malware payload (Mirai)", "value": "63ecdecdcc952038ee960c502bc2c9afa9b5a305fb9787690834284437357747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416655, "uuid": "9d6810bc-7ed6-4e8e-af12-8c4b8466a06a", "comment": "Malware payload (Mirai)", "value": "88d72f7c7fa3165f29fdd9f2b66a20007f9221d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416655, "uuid": "fb3c71e6-e610-47bf-8b69-733d38c06e6f", "comment": "Malware payload (Mirai)", "value": "ce52f33a11f8b9fc48ffaf970359b6d715369ed124e94fd41150ba7d4f89b20c1239dd10908392d3a3031a79dedaf36b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416655, "uuid": "40b5d057-d17c-4f6c-a6bc-d3d604d0ca29", "value": "T1D7833CC5F402DD7DFCCBE67A48160E18A57172D40A930B2667A7FEB7BE62158390ACC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416655, "uuid": "6c114509-ad84-427f-b7ab-496df92b96fd", "value": "1536:3JDU5XSbj56dg0fR3E87Ia4KQeuacWjcW0JcWcBfA8HHrJhOmcqa7XS:+XSbj56K0Z4KQeuacWjcW0JcWcBo8HH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416655, "uuid": "408549d7-d129-45b7-8ca2-2a7c0cfa52d3", "value": 83616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416655, "uuid": "a30488ff-5449-4b5a-bb7f-3bd2c9ec6b21", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416655, "uuid": "8240a602-cd70-4d59-85b0-e9ead0207805", "value": "6c0a66a5756f828655e7ed7e790fb5ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c264ac-fd5c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713428596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428596, "uuid": "cc22d713-ccae-4b61-ac1f-2393e0f2fd6d", "comment": "Malware payload (AgentTesla)", "value": "3b0ba737216a38496c5e0ab682bb9b52", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428596, "uuid": "0503c8ec-4d85-411d-a502-72292a59aa60", "comment": "Malware payload (AgentTesla)", "value": "64195c728bdc619d467b51b6139de1541f7a65b5abc1c7c7f8e0d29051b53a3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428596, "uuid": "04148f76-b3a2-4818-94c5-e15b96254123", "comment": "Malware payload (AgentTesla)", "value": "1bd43473939ca81ab5e82cbd4600de646680fda0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428596, "uuid": "9bd19f21-1c0d-45b6-bec8-fcfeafa70bef", "comment": "Malware payload (AgentTesla)", "value": "cd4940a8e0f70813dc62afbd059e727f5449f4a91ed4c5ebda1af92a4fe282dfd1673095fcfcbab05abf399f70e6949f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428596, "uuid": "29d9f412-2007-443c-8ab8-c40901fb2700", "value": "T14045E3BC98BD693BD825C6B58FE98823F090D97FB811982A54D763554393B8330CB53E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428596, "uuid": "367c517f-ada9-422c-b104-a89223c91493", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428596, "uuid": "5a0d439b-0eeb-42f3-894a-842f5457b1e0", "value": "12288:+S1/p1cTi3/Z4q4abCuh25q6wOojhxp4Vt0iYXIRUKN6DOJvhRdLOCrTvcZof6XZ:51hz3/ZQ+Wc6RUhDM0/joRoCrQZof8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713428596, "uuid": "a24d65a0-6559-43c5-855c-4734c83e799f", "value": 1220096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713428596, "uuid": "acee6346-769f-41c2-849a-00bf2105ddb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428596, "uuid": "68549849-b1eb-41bd-988e-2bd41e18b2b0", "value": "I-IN-6757165752-DEL983527_20240416074318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d15f7c-fd64-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713431790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431790, "uuid": "3f51b25e-9c9e-430d-aef2-ed3bb79a53e6", "comment": "Malware payload (AgentTesla)", "value": "4bde497149d69bd21bce08c8dd20cbe6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431790, "uuid": "422e06bd-bd61-423e-a159-661257b58840", "comment": "Malware payload (AgentTesla)", "value": "646da2f80123a9ae67c58d474c19609900b5816941164677dc24238316b512e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431790, "uuid": "089356fe-4db1-4273-a3ef-2f2ee3d4b82e", "comment": "Malware payload (AgentTesla)", "value": "51b7b2a217a8ee771ba08cddb9afc94c9d57ddbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431790, "uuid": "16403605-1650-411d-9be8-8fc06fca5326", "comment": "Malware payload (AgentTesla)", "value": "088ff63e3799a64a88cca4c4a8ca5c2a8049b74d398a147a1ac87d278647890e5bd91553f9a35317f5930549d095ba84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431790, "uuid": "672a6e9d-63ec-4f20-8446-28a78f9e20ef", "value": "T14F25E23D1CBD2A3B9075D2A9CFE98567F040D47B3A11AD7A88D383958346A9379C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431790, "uuid": "c6f9bdd6-b0b1-4d4e-8c61-41ac0abd54dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431790, "uuid": "f291b5ba-981c-479b-b231-f9cb09f4649a", "value": "12288:yYEuIzHyxF+p8AkFrenbnx1BCHrqZKgnZdHYDsQDl0mFVWooGorRLxg7SD9cZ6m/:XE1zSypl0glPkMX0D2mFVW3+Aco2mE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431790, "uuid": "4607129e-cc1d-495a-9427-4a8a31931145", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431790, "uuid": "de7a1672-1174-49eb-86ed-448e805932aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431790, "uuid": "5bdb5b0c-f35f-4956-8193-2d84625ab7a8", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f5e04a-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713459062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459062, "uuid": "333c10c6-43a2-467a-818f-0f8498eb4217", "comment": "Malware payload", "value": "4dee4e7fec123b7dda5f90f0d494e441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459062, "uuid": "5fdd68c6-b9c5-421f-963f-7dba8f7eebe3", "comment": "Malware payload", "value": "647a03a4a2c8bd449f90925bf7ff2dc68087c2f62b945746b78cc410dfa631c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459062, "uuid": "875bf62a-e060-4be5-bd3e-f8817989d019", "comment": "Malware payload", "value": "716d919cf578b53e6a70083d17e9faf882d79d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459062, "uuid": "04327176-7997-4017-83a8-9e38a8a3c369", "comment": "Malware payload", "value": "54e0a9cd98f973ef6d6f9faa04ad7b974a4872dd5d9cf6265d489915c1c509e9b79605d43f2f6a13c0849e9bf1130faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459062, "uuid": "ea2563c7-3666-4299-9b6d-b22dfe6fa123", "value": "T1D1D6CF16E2F900E8D5BAD0BCCA5B5517E7B23819173097DB56648A292F37FE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459062, "uuid": "28501ed7-2acf-428b-a39e-e288bf8d77d5", "value": "812a40e5a1126fda94bd0c4fa515be09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459062, "uuid": "e1c40ab1-d4f3-4dcb-8d8c-7c4235970d38", "value": "196608:PGxdrcaaJetS1VtyAG9XB1F92PnOUlvn5E4HG/oaGi1NDNLuOYsLuXhdV:ebUJeUVQ9ZB1F9mOUlv57m/IgNDZuYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459062, "uuid": "7b4ed8b0-92fc-425f-8705-6194c45f76fc", "value": 13759991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459062, "uuid": "82ff3ed2-eb18-4f1d-b9c7-78b0af970240", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459062, "uuid": "08edb51d-0368-4ebe-b83e-a9730a55593a", "value": "SecuriteInfo.com.Variant.Ser.Tedy.6095.11049.295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612aaef2-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425363, "uuid": "81bddcd9-0afb-4553-b504-93ab4369ec7d", "comment": "Malware payload (Gafgyt)", "value": "026ee7118458a6912bc7424cb9c58a23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425363, "uuid": "3cb85172-4913-47d9-b3be-56e36bd4650e", "comment": "Malware payload (Gafgyt)", "value": "66620dd7bcd472912a93b9c541e646d75e677ae66b67d11c57a51d25ffada041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425363, "uuid": "a01215f7-8ff7-4de9-b6be-3b650a831bd4", "comment": "Malware payload (Gafgyt)", "value": "d21c423b93cd9e134ae6c1c27bd9cdef3049496d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425363, "uuid": "dac79cbc-891d-4724-bd35-d2e4a5213b28", "comment": "Malware payload (Gafgyt)", "value": "c1034d81fe2a7fb943e382b07b3ba8d811b71a17ba7b4bcb2b8eac680736bce8b1e85a5fd960e99b4e90dd51e51e6164", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425363, "uuid": "df09f1fa-851a-4f81-95a3-f9d80f92b0d6", "value": "T1E7244C24E5404B57C2E323F9AA8E428E3B3247E573D773154A389BB03FC2B9A1D75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425363, "uuid": "3f883af3-839a-479a-9011-fec463b25bb0", "value": "6144:FZzyacCwXJ4DbpW0vF5hbL6nWgV7Ocgym0wfB5RyAn:FZzyacCwXJ4gS5hbLi3gym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425363, "uuid": "522afe01-ee96-4001-8d01-f7ba40dc1b1c", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425363, "uuid": "9694b743-dcd1-4293-baa5-56b21de18606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425363, "uuid": "15831eee-4696-4332-b876-53d9b9b92c21", "value": "026ee7118458a6912bc7424cb9c58a23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c402e4-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713470686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470686, "uuid": "02bca38d-f9e9-44d8-99ab-db19ea7893bb", "comment": "Malware payload (njrat)", "value": "723480351d4946b6b8dd3e953a4ab4a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470686, "uuid": "b5b384f3-91c8-4947-96d0-6a236a62231b", "comment": "Malware payload (njrat)", "value": "66969ca6880e2ff107b78ea8a8ea31900912a8e3c910c336134f8cf78cc39a75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470686, "uuid": "ddf81d86-7dc3-46d7-a273-6b509fb69cfc", "comment": "Malware payload (njrat)", "value": "c58cf420e9555cfc916843437d73965394887f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470686, "uuid": "2989b65a-f109-44d8-9f5e-c2e6d5cf35f7", "comment": "Malware payload (njrat)", "value": "9c002888c60a15ceb65abe796b036ef80325429fd97c0a81842e26f18ac2b15a31cae7aef7a8411c8c32c533f74f6dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470686, "uuid": "52dd63e9-3e82-4da8-8f6e-dd4ba3c7786f", "value": "T14BE208067BF98215C6BC5AF88CB313214772E3838532EB6F5CDC88CA4B676D04655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470686, "uuid": "67fbfc95-0faf-430a-999d-784da78aceb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470686, "uuid": "b0b4ee68-2ecf-4717-b7ee-1106597b16b7", "value": "384:w0bUe5XB4e0XfOVcsw0Q0mS03AWTxtTUFQqzFxObbR:1T9Bu26555dPbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470686, "uuid": "7d015747-0c6d-4fa6-afef-649834fbadee", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470686, "uuid": "c5e4e16d-4735-4269-a69a-41471a714abc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470686, "uuid": "700bcbf0-c074-4383-98b6-9151697edd38", "value": "x7RZVIWaDKb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "048a43e5-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472453, "uuid": "53739a9a-1516-4629-9990-ffd896e3d7a9", "comment": "Malware payload (AgentTesla)", "value": "9cdd3a15f343c761f88fc1e50a77ace9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472453, "uuid": "a33a4b5f-5197-469a-9081-db979712b898", "comment": "Malware payload (AgentTesla)", "value": "693bacb040743a3445b938984f6984219c056dd60252fbdfda7e0f1a780bf8a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472453, "uuid": "e96b4163-95a5-4784-a188-3d7ad5d20dd3", "comment": "Malware payload (AgentTesla)", "value": "40306f4f50921b86b1bb3454983fe5908494cd90", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472453, "uuid": "aeae6815-a86c-4640-9b85-8abc2f8cd7ae", "comment": "Malware payload (AgentTesla)", "value": "f4ebf91ac0ccb7bb2d92bf2f62f9f4a3d006d81373d4b36b1c6d5f385d3e0197f799a9a66d6923e8d28a8e7ee7381c57", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472453, "uuid": "f1e67e25-47bf-4c73-ac33-03129c4b3432", "value": "T1C10533731C5D15C9F0A33AB2075C411CC8B79A1E11EE9B058BDE98FAB9C74904A3EDB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472453, "uuid": "23af7417-cffd-48d2-9db8-dd86943df222", "value": "24576:jDVjyWwahzCvq2/4oVKNwvNoB0cHYm6mJU8W6rqcrWP:jdPCp/4ocGvNYCVmJU8Jr3iP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472453, "uuid": "ff8b423f-3fbd-4130-8705-8139f69675ba", "value": 834612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472453, "uuid": "9dff8ade-2e66-4f07-b17a-dc4ef2332c1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472453, "uuid": "b51ef5cc-9faa-4d92-875f-15a03dec78d7", "value": "e-dekont_html.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167719c1-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416648, "uuid": "06a8bc3d-e373-4696-acf2-8a7df433c216", "comment": "Malware payload (Mirai)", "value": "435242e313fd57bac10a862e7477bc07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416648, "uuid": "ffcafb46-0eb4-4875-ace0-4d1b8c79e7ca", "comment": "Malware payload (Mirai)", "value": "69875edcd2f32d006b5c3a2c73fec2c7672632a603b6b0de5c5c18c748aa8b0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416648, "uuid": "caadd0f1-bbc8-4295-a4f2-04c9cfac097d", "comment": "Malware payload (Mirai)", "value": "b2f399831bc32ecafe89f3298808167141c76042", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416648, "uuid": "74ba9c26-5f65-4c0f-9636-2657becb5395", "comment": "Malware payload (Mirai)", "value": "1c0a692196d7cba9f8d16d65bb50bdbfddd4f97a402e8d735e83a80536a9b7a11773e81758202cd7be1c7a9999b4d468", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416648, "uuid": "103b6097-610f-4fa8-a1e0-38a7639e03c3", "value": "T19A13E1E668E8BD81CDE89C78A68E67E51F91B1417389D63671A18C880F2DA4C74C94B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416648, "uuid": "a60d304d-cbdd-432a-84d0-d8846f893adf", "value": "768:dqCDkRxeGVeVke8QCTBWl4XMYSGl2U2D04/TMrWNedxaKQX:UmGTBM4uGUdTVUxFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416648, "uuid": "7602e735-a86d-441b-a072-50f85f4e5841", "value": 44648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416648, "uuid": "beae617a-acd2-4042-9c52-0a9b2dfd4608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416648, "uuid": "d8df28bc-cea1-4c30-8556-5c84b250a0fc", "value": "435242e313fd57bac10a862e7477bc07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c480698f-fd3d-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713415222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415222, "uuid": "348c7027-1d45-4c20-a057-3df48cc55843", "comment": "Malware payload (Stealc)", "value": "501d81449db6ea038b3587abbb03c650", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415222, "uuid": "95599601-25d0-4e22-8bb2-bb2ad7a5b40a", "comment": "Malware payload (Stealc)", "value": "6990b050ea013f9b45df9fc7b3db7e1e6e25631de7761e1f7f2f72501535af50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415222, "uuid": "b75bfd3c-8516-4c08-87bf-d4ded140009d", "comment": "Malware payload (Stealc)", "value": "7595f03834fa065581cebb52e0bdad5b80b51d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415222, "uuid": "ea746e55-a14c-4013-b0d9-d051fbe5b619", "comment": "Malware payload (Stealc)", "value": "8446cdcd299fcb0f8cea5ed5bdc85a75025cf8b08aab85f54d37763095ce8025fbf697ba9d5f778342c591e6ec0a3608", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415222, "uuid": "c9359317-4e29-4705-a263-7c6c36a0e3e4", "value": "T1C5745B0363F17C63E53247729E6E86E4366DF9604E596B3B63189E0F08B10A1D6B3739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415222, "uuid": "28053ff9-03cd-413e-ac0c-53adb9c8370d", "value": "65be91c3b2a0d3e7469e85b784deac5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415222, "uuid": "3cd1e430-2e9f-4196-801a-ec29abe1e902", "value": "3072:mdm38qGuPwLNjKoXgHtoFo+OMqvUOwq+2M47zXvRgnmSnV3ulBdss5YlgQ6wh6kF:UcCjdQoFokuNM8bvRQ7cdQgKoUOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713415222, "uuid": "965c69a1-47a3-46f1-ae47-e76715a96e16", "value": 358400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713415222, "uuid": "5f5f417a-e473-43d8-8ab4-d70a73e255f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415222, "uuid": "b91926eb-ed4c-4ef1-96c1-2ff49f90fb31", "value": "501d81449db6ea038b3587abbb03c650.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01016fcd-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713450542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450542, "uuid": "73097bb9-f2fc-47ed-8441-1147369b2364", "comment": "Malware payload (RemcosRAT)", "value": "f2f68348f362c4e57a14b9c05e2e8e9f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450542, "uuid": "8ac8945a-5960-4f93-963c-5cef8d19f57e", "comment": "Malware payload (RemcosRAT)", "value": "6a2bece56fe02b45d810a7bee948a695a546fa20d6a41059881e4f5cd8d3c1a8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450542, "uuid": "aa324218-b704-44c2-bf81-bdac2b93be2f", "comment": "Malware payload (RemcosRAT)", "value": "4a7ea1d1dc020f606a71ec2dc180797c4399b226", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450542, "uuid": "8341099e-fc73-4fdd-8d86-2b0023f9c43d", "comment": "Malware payload (RemcosRAT)", "value": "6293dd37e3894ce290637dc1d7d51d92e55376a77ce758b2fa3b307768cdbd0cda485c3a96620bece1be6918b0d9bd04", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450542, "uuid": "896d6777-f5e4-4bd7-98d2-2ddc9324887a", "value": "T1E673E229E70F0955DF95A67B434B4B4A49FCB33DB28140A179BC873437ADC2E462287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450542, "uuid": "c3b8b090-0a44-4091-b5a7-d2bb833d0487", "value": "1536:9istY3tmRjSnQZdvPHLXEc5J1jQ1bL+jmfkOXAC3qrsGYX3wmPC+tJJROtgIrsJH:9irtmRyOvPHLXB5J1jQ1bL+jukW3qrod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450542, "uuid": "daa450d9-872f-4553-84f5-8f631b722247", "value": 75211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450542, "uuid": "6aa5968d-872e-478e-8eca-8ba609e277f3", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450542, "uuid": "ca3ef524-f051-4889-9564-d41eda86b447", "value": "SecuriteInfo.com.Exploit.ShellCode.69.31966.31539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabfd12c-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713431151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431151, "uuid": "fec6b7a4-cf16-4da6-9f9f-4c12cfd6a3ad", "comment": "Malware payload (GuLoader)", "value": "0016f2865499e4080f403a65258516fe", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431151, "uuid": "5fe3da48-1079-48d4-a048-7061151b0ef0", "comment": "Malware payload (GuLoader)", "value": "6a91fae55013fb14f272afabc5353218afbaa8958d319283c3f51eaaf200484c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431151, "uuid": "7955c8c2-bda5-42c0-987f-1726149b6ce5", "comment": "Malware payload (GuLoader)", "value": "65faff9633d47431dea53af5057ba4728b7e8e76", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431151, "uuid": "eea0f29b-7b57-4b8f-b56c-c089b04b6cd2", "comment": "Malware payload (GuLoader)", "value": "4f71d4ab22a6cb1f51add568d16dce66d6fed1d692a6bd29760ce17e91795382fd691a469854c964a2988f2dc6731192", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431151, "uuid": "6d69aa09-b272-4954-8042-a8dbac6dba11", "value": "T1E13429F0CFCA26398F4B2EDAAD64445289F88195021228BDE6D907EDB243D5CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431151, "uuid": "e1382d0e-4ae0-4bc8-a4f8-7f48486f5275", "value": "6144:FIEeg2kae621pGqbWt0JPvk+r+usYBbnPZnqtFVyNLFViFHV/O3CLLBtE3/3Ue:nWqv6uVK+3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431151, "uuid": "dcbda72d-4ce9-40d5-ba57-5cfdbc26ec1d", "value": 234285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431151, "uuid": "56af1b24-4101-4376-a22d-915abf0de77e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431151, "uuid": "a72cc4bb-28ad-42f3-bfe7-13b2c6009b0c", "value": "DHL-9384915702.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c718f3db-fd50-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713423387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423387, "uuid": "5885acc7-fcfe-4028-a66f-e2e9c14118eb", "comment": "Malware payload (AgentTesla)", "value": "6a5bae0e89bfa56e15b6654ef89f5fb8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423387, "uuid": "2abcc246-8920-4a3d-8b05-83adb60e2079", "comment": "Malware payload (AgentTesla)", "value": "6ae256533d1ffa18d81da6ba75400092ecd8c01c38c6a4a114fc895d781847ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423387, "uuid": "996256fe-6262-4604-88d1-793025e59ddd", "comment": "Malware payload (AgentTesla)", "value": "3cfd716f520ee2999b94dc47e2897b68ccee2e93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423387, "uuid": "44e9692f-4dec-4403-913c-7b92a25f726c", "comment": "Malware payload (AgentTesla)", "value": "c49ff22fa34892e30334205bc40539c8d6e0df7dd4843fb1712444a94d450088a7680c436f6e9788317672f25ad4dbb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423387, "uuid": "35e775b0-2d9a-4b05-a1de-04fb6e8fc94f", "value": "T1C5E433C13E72DBB2FCB4449F66BD251920C339AD9B98C68C612A97D4C0D18BC325767B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423387, "uuid": "c136d68e-82ee-47f8-b917-92a16ab47e41", "value": "12288:fd+hLgK/HdfXe50FpNc6Hi5cB4l4pvlt2Xtufogk6B02q/:fdygKfZe50FprH/q4p9tMkfhwj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423387, "uuid": "48d625a7-1ec7-4671-85e4-b6b57c60fa16", "value": 703689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423387, "uuid": "60cddca5-651f-4eb9-9038-3d3a4749adbf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423387, "uuid": "46692b58-e244-4908-93ec-dc6e1f17c5c7", "value": "Purchase Order PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77ce332-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1713459063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459063, "uuid": "ebafd704-3e77-40bf-ab9a-469a4aea934d", "comment": "Malware payload (DCRat)", "value": "2758e553732310d8b606fca67a1096c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459063, "uuid": "c9186bfe-b016-4115-a4e4-f48c59908e1f", "comment": "Malware payload (DCRat)", "value": "6b67056d00eba4d6b69f1f07ebd8defa0f20f701cf24c98dfb1e45354c2498e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459063, "uuid": "037bebc0-6829-49d8-b8b6-ca3a88229994", "comment": "Malware payload (DCRat)", "value": "a8cc98951406fda4689d7ac169f6bbde524c9bb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459063, "uuid": "5bec2356-3d94-4ca1-b56f-a99b8a5a6544", "comment": "Malware payload (DCRat)", "value": "9fc86d847fa211d07666f1efb8f7563437f705f3e2101f22cc6b61dea4fdd613332913102363027d3842d6cfff4aaf43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459063, "uuid": "4ce187e9-215d-4c6e-b175-56d8359b9489", "value": "T164C539342EEA602AF173AF7D9AE07596E95EBBA33703585D10B103C60723A42DDD163D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459063, "uuid": "667d6d48-76be-4f0b-8ce9-da3ab9e88746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459063, "uuid": "89c9dd06-256e-405c-acb6-864de5e0d84f", "value": "49152:56ZORYA76HRujfVdY/gVcq6xISv6YqCD7UiA3:Ecz7aRKdxVcqU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459063, "uuid": "cfb85c7c-fe99-4213-8ba2-723014ae2c18", "value": 2525696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459063, "uuid": "ab824e4a-ef58-4406-b47b-619e8873c4c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459063, "uuid": "2ceb9768-1f69-465d-a247-85b62c2c118c", "value": "2758e553732310d8b606fca67a1096c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2909f866-fd4e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713422263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422263, "uuid": "78c01072-909b-4723-85a8-30665450b3ec", "comment": "Malware payload (Mirai)", "value": "344202a75c93c712af47bf0c865b38f4", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422263, "uuid": "8a35cbf5-90e4-456d-9926-909a3dc52392", "comment": "Malware payload (Mirai)", "value": "6b8ef346df6c002aaba3bcf91bed0ce8078a76e4600bcf86c08a6eef80d4c77a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422263, "uuid": "5b0a84fc-9d93-4385-8af6-c56255675fc5", "comment": "Malware payload (Mirai)", "value": "175026bcd9a6a8904ebd4cd29d16a315e984fa60", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422263, "uuid": "5bcb80fa-c896-4d42-b061-8720bf1ebfc6", "comment": "Malware payload (Mirai)", "value": "d2ad90ec76bad5c8265b29417dff33faf5376a2a040f6355f9c0756cf6cdebcf6aa81c01825d26f421f6a993e244e2dc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422263, "uuid": "0cb6e73b-0398-4167-9b3f-6da085a4f267", "value": "T19FF35C07B5C1C8FEC899C2B44F9AE236DA72F41D5134B1AF37D4EA261E4EE205B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422263, "uuid": "1f06997d-6454-410d-ac8e-c978a69f4738", "value": "3072:Nbtfg7S5bj+fIM7fENFhk2cRY4QUsQM/xmFd8ch:NbpYS0YEeNUmzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422263, "uuid": "2c00d34f-e2cf-4c84-812c-f047f11dc867", "value": 159752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422263, "uuid": "84c7b395-a59a-45d3-a789-4d9bc1ddbdeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422263, "uuid": "3cd9b139-1b5d-4a96-adb4-8c1b49765f0b", "value": "344202a75c93c712af47bf0c865b38f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e7fed6-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470598, "uuid": "d6db6dc5-9801-413f-bcb6-5bb19e470e2d", "comment": "Malware payload", "value": "a7c183bac25e11c6686103b3bb7d5b63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470598, "uuid": "0948b244-d752-4f30-a750-2f517707c239", "comment": "Malware payload", "value": "6c62df69793a93864f977b5a35467d54d3ff8742eaeae64cee97ad888f9b121f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470598, "uuid": "287d3a89-6e77-48a4-90f2-ebcaf06bcc67", "comment": "Malware payload", "value": "1c86d951e498a6a9d6eef21264971d8e812bb4a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470598, "uuid": "3addf726-c92e-402a-9857-237327b9a983", "comment": "Malware payload", "value": "bd207dd1b92296d25a85a11985e214fa5fc3471f14f2c736db71d11229b539d3dbf6588679a5f1c3c101485a6f463372", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470598, "uuid": "62a3d31a-8232-4d97-b360-838a451dcdbc", "value": "T1C6E34905D7408B57C1E2277AFACB424933339B54A3DB33099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470598, "uuid": "f7ad5e98-2e94-4d15-a4c7-3526d3712427", "value": "3072:it8iFDKEfFN+Fa+1sWCh7rz0JH/WbUMbmQwfCMQiGW:g8iFDLf/+FaNrh7rz0JH/Wb5mQwfCDi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470598, "uuid": "a3a6d138-ac95-4255-9dde-2c6f897ec418", "value": 150077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470598, "uuid": "761468b8-75b9-4273-b4c7-91124969cb1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470598, "uuid": "1d621452-8f77-4937-b81d-8955bdf6f8d2", "value": "a7c183bac25e11c6686103b3bb7d5b63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e987168f-fdb8-11ee-a120-42010a9c002e", "comment": "Malware payload (Babadeda)", "timestamp": 1713468112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468112, "uuid": "9e87edb5-e1f5-4854-821e-d0172dc4cf5f", "comment": "Malware payload (Babadeda)", "value": "8b6a377f9a67d5482a8eba5708f45bb2", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468112, "uuid": "d5b20deb-7390-4fee-b63f-083e75a6d7af", "comment": "Malware payload (Babadeda)", "value": "6ca11c8b6442db97c02f3b0f73db61f58c96d52e8a880e33abee5b10807d993f", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468112, "uuid": "18284e37-d313-4970-be86-436a9f996cbf", "comment": "Malware payload (Babadeda)", "value": "7197436525e568606850ee5e033c43aea1c3bc91", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468112, "uuid": "b5272403-cdb2-4856-ad08-4b2c65a03e83", "comment": "Malware payload (Babadeda)", "value": "2416814f5d206a8d6bdd3949019c8dbd55ed2d045f3a8b62a6cb1a4d6a0475b444eb18f290a32d0aea32ab518aa4396e", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468112, "uuid": "364deb6d-30a2-41e7-8e51-b42deb957e08", "value": "T1B2B38D41F2E242F7EAF2053100A6712F973663389764E8EBC75C2D529913AD1A73D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468112, "uuid": "8649eeb5-7b26-4ecb-9d3c-9f1d4ef4a94e", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468112, "uuid": "2936440b-60e1-40cd-be7a-613ae22b5078", "value": "3072:v7DhdC6kzWypvaQ0FxyNTBfqMXERseQF8:vBlkZvaF4NTBSAesPF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713468112, "uuid": "7230b98b-d61f-452c-b58a-4e103e550378", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713468112, "uuid": "61ba3cb3-4882-4781-bd9d-b69e38d02c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468112, "uuid": "2d180d24-f32d-4f24-9767-edb83f2e9054", "value": "ADZP 20 Complex.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83adc601-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439165, "uuid": "5b26c3e1-c6cb-430c-aaad-bba7ee631bde", "comment": "Malware payload (Mirai)", "value": "dec4a6cdf3f930f8ea5b0a71f4aff8a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439165, "uuid": "adfbdb9a-43d2-4735-b663-94875b545784", "comment": "Malware payload (Mirai)", "value": "6d6d6b292341c31d1236c59509f210d5226176c9481f5161ccadabe33ec023f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439165, "uuid": "4c11a298-2976-4243-b4f6-49c014cf608f", "comment": "Malware payload (Mirai)", "value": "182302886f7eb9b55cea034302c4957b6d5a2507", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439165, "uuid": "d394931e-7bcb-4a5a-a230-534ae0f0864f", "comment": "Malware payload (Mirai)", "value": "a488cda05ee736c1e4bfa1e115d31bf1eaeb2a580707e323ec994e9c2e79bb6c6dedd5d85694b19dd79cbb3e82cba3af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439165, "uuid": "fd022d42-8918-4318-94a9-70503691b09e", "value": "T10E338D71CC782D48E69C82B4B5709F7EAB53A501D5871EBC946B9626A003FDCF94D2F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439165, "uuid": "fab3427c-2d59-4d22-bdbe-5321ab392ffd", "value": "768:3AxXceNpbZ0cVSHwi/7q0eJlgPYZt54v5OHRoBKCCCTDMIxZ:3UMeNpbicVFi/7qDQPet2wmBdCCTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439165, "uuid": "c069df65-8a91-41d4-b6d1-af93f4bbfe0b", "value": 51260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439165, "uuid": "b0ea435c-d15e-47c2-921d-02195c030d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439165, "uuid": "17163da0-5c69-43a4-86aa-f5fa75bcbd97", "value": "dec4a6cdf3f930f8ea5b0a71f4aff8a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31532ddf-fd6a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434303, "uuid": "a7cc626d-2fae-4dde-8f64-36483b13fdef", "comment": "Malware payload (AgentTesla)", "value": "c3a54973d6ef3ed9542098850f650a2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434303, "uuid": "822f9d00-280d-4664-be15-d152fa408e8e", "comment": "Malware payload (AgentTesla)", "value": "6d909c4b3ed30f3efc9ea429f85507ea4208131ac19687fc6c0c56ee77bd0e77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434303, "uuid": "3563772b-0673-460a-a274-0115c4450cc3", "comment": "Malware payload (AgentTesla)", "value": "ed705db8008c1b636bf4fd20abea95e32b1f5ebd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434303, "uuid": "e4f349e9-00b0-4abd-986c-69eb23984158", "comment": "Malware payload (AgentTesla)", "value": "afc3ba7506eb2a8ea3a3326fe3b9562317eadc09cdec3da9044da5d5c1e0e34870c441f2be0a12a328062e96f0391109", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434303, "uuid": "e077f906-3985-4a01-a440-b8e1efd1ddfd", "value": "T1A0E423DD25F83734F5AB90BC5AC1A2246E45154C6CC90AB842E4CDE2FBEE77131F684A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434303, "uuid": "9df0390a-859b-47a4-a2c3-1e0a94d6ba64", "value": "12288:g7dL5AaTDrK2eCq4wmSpU9v5Ju3MFbqrrMecnOnSgqKw3l4A3jDq:0d9AT2QpU5T/ecn24NWAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434303, "uuid": "31ab8127-87bf-416a-8d51-6701f74a6b82", "value": 703791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434303, "uuid": "16be42a9-0e51-4228-9394-65c4e468446a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434303, "uuid": "37571f84-2dfd-4ad4-bad8-13eb445513bb", "value": "invoice AI240190.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac61cf2-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433943, "uuid": "72cef5b7-6deb-4d97-a006-b11384cf3a1d", "comment": "Malware payload (GuLoader)", "value": "f0dbfdecf5c3592ad57142aacce0cef6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433943, "uuid": "71a426ff-6ba7-475e-8aea-4745984a9493", "comment": "Malware payload (GuLoader)", "value": "6e997c43b1194c56f2d2f56c1c8f0bc79266fe692b0218060d5f9de74ac42825", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433943, "uuid": "732335c3-213c-4f41-98ea-57c877281531", "comment": "Malware payload (GuLoader)", "value": "361a32c1e91d4d59be392c93a321930f1b0f5642", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433943, "uuid": "3adf450a-822c-4c51-b4cf-32327a19d380", "comment": "Malware payload (GuLoader)", "value": "a4c6606bd7ff18153d553cf2640813ba7f22c1075d58fcdb92435a4ddb38f0c1192872ca3e694fd6411e0d964c7a979a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433943, "uuid": "c54018bc-5578-4573-8b0e-eb07c87e94d3", "value": "T1652408F0CF0B36199F5B3EDAAC6445928AF58195051638B5AAD807EDB283C2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433943, "uuid": "a7432db6-038d-43e0-8c97-9aa589d15130", "value": "6144:xYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfINf0:62dO1wNvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433943, "uuid": "52ee19e4-5275-46a2-b945-8b6a7331ad23", "value": 211392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433943, "uuid": "2a7374b6-b399-4524-90ca-5d7b1a7c9ce3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433943, "uuid": "32c2b918-a861-4535-ba4e-0b986c2047ff", "value": "justificante.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be17b505-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470616, "uuid": "029fd5d2-c417-4823-8ba1-e66cbf472f3e", "comment": "Malware payload", "value": "54b8db31075f1059c7df95eee17b075c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470616, "uuid": "16344d46-a65c-42c2-9902-b18f3dd51a79", "comment": "Malware payload", "value": "6ff4e9b6524645d909ddc272937351312209fd239dc9cdd79c04300ed0c44ddd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470616, "uuid": "ec64aa18-a60e-44fe-a1db-8b2a49bf7c75", "comment": "Malware payload", "value": "02f13c5b0f59f6194a84e10b30d09f50b897820e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470616, "uuid": "d7ce9bef-f5bf-4bac-a8e9-06d4659f6a76", "comment": "Malware payload", "value": "3b185523d282ecfa9e0f58c665a31330dd9632f22b00c99ceb74a876a6ed7b6075b1e00525134846ad30da07fb5dc6b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470616, "uuid": "c56bfabf-355c-4999-90ea-0673940175cd", "value": "T16A93398785719EB3C042AA7925FB89740713A8225B0F1F68612D9BF8070BDDDFC9E725", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470616, "uuid": "9d206850-caf5-4b93-b44a-4e6dad5ee555", "value": "1536:TeDM+Vlabe0Ff5soS4yfafRdfmoDs2tSYVm+:Tj+Vlab/DDfRdm0s28YVm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470616, "uuid": "81d9ec90-9595-4533-9ab2-a51214d9430d", "value": 96317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470616, "uuid": "7dfdbbce-16bb-4596-ad04-519129e33179", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470616, "uuid": "219e46b0-40d8-4787-bcc5-0fae98e94880", "value": "54b8db31075f1059c7df95eee17b075c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edcdaa2-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425011, "uuid": "ea24c70f-0a28-4920-be9e-5721dd005baf", "comment": "Malware payload (Gafgyt)", "value": "414f9143b0f3033fe262e2d4cb8e9e38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425011, "uuid": "32fc0c71-8176-4797-9795-c3c53b40e437", "comment": "Malware payload (Gafgyt)", "value": "7070a3c4e6e4d7b792e94ecff02f4b7c1e1fa6f29a84c0104ffca38020e86633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425011, "uuid": "da226b5b-ee6f-4565-85ea-503e75b1b4e5", "comment": "Malware payload (Gafgyt)", "value": "efa718869feab8d2d322bc3db4e1cd806bdf3c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425011, "uuid": "2e3b0d61-a010-4878-83aa-ea39e0bfd27c", "comment": "Malware payload (Gafgyt)", "value": "fffdd90f06b490ae6528486b4313461f33335e0716075f798a0b791b7aabf5e60089624c5dc62fd13d1daad3c32a43e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425011, "uuid": "701e1041-50ed-4620-ab04-3693bad00ec8", "value": "T1FF430253B672CDF3E3628F7A67F9C766ED62A33441AC22C248E64D3C19C1D4291AD017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425011, "uuid": "3fb1db27-e7e3-4aad-b8dd-731a5a9dded1", "value": "768:/UOhP06bvxbtw489xodAGcM6iBfVyoqY0rFyfSEBS0UIa2iLxiexkfVJymqxeyFG:/vFlltwl9xhGvDBQVYaWrbapuV9kehzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425011, "uuid": "c3ae73cb-00a0-4c84-ae43-5c57098eb46a", "value": 58032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425011, "uuid": "e9aa3c77-a11f-48ad-97ee-c95878cb8b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425011, "uuid": "eb909ea5-9b19-4d9c-bf01-eed690864c9a", "value": "414f9143b0f3033fe262e2d4cb8e9e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d1afed-fd6a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434275, "uuid": "808a2de9-6b3b-4cd4-93a2-bad46a5e6375", "comment": "Malware payload (AgentTesla)", "value": "02c468dab798e0e6bab01d840656a82b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434275, "uuid": "2b772d09-7a7c-496d-bc80-0e09f1956c4a", "comment": "Malware payload (AgentTesla)", "value": "71f24d2bdc7bc70947a17e6eaf6550333244ad8cc1e604be8640980ea031b507", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434275, "uuid": "cfc08d1c-d1ce-4c5f-b83c-62847e668b21", "comment": "Malware payload (AgentTesla)", "value": "ded241846767c42dcfe3b77817d95794c12d45ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434275, "uuid": "4d7720a9-4db4-40e1-8468-33822cc06360", "comment": "Malware payload (AgentTesla)", "value": "5a164f6b4be70c4df7f3ae9f6b37ce3e2450f136a5a70c0762a8f3abf02b0147967f904145634bac82ea2b7c026ed784", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434275, "uuid": "eec191f9-3629-413f-9757-a478dcf688ce", "value": "T1F1F42225369E8B6AE9FA1FFE1030164093F2B52B2061D30D5DDA50CF49F27846B25F9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434275, "uuid": "7962d8a8-285a-4cab-a35d-d1d0f4cbd63d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434275, "uuid": "36a7463d-35a3-4ef5-ab0f-cd1338ca7c09", "value": "12288:ZQK/pbM4RwwAbS4uUvLHE6xdBMKvBedHae1kRupQqhQz67H/SVYT:ZQiM4iS4uUvvf/EHaFRq7fSVYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434275, "uuid": "957f52b1-7fd4-41c2-855c-618c32f74400", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434275, "uuid": "9693b1a1-5618-4460-8251-2021b6dc1dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434275, "uuid": "28482288-6b58-4799-8c5c-f01d9650a502", "value": "p silp AI240190.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a955d7-fd5e-11ee-a120-42010a9c002e", "comment": "Malware payload (Quakbot)", "timestamp": 1713429312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713429312, "uuid": "eae8d227-9456-4f97-9a00-5109c77d2efb", "comment": "Malware payload (Quakbot)", "value": "31b1a881401e0ba0cad4c56f1e32c48e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713429312, "uuid": "7ef6bbb0-dc54-4945-943f-64d8863b663e", "comment": "Malware payload (Quakbot)", "value": "7215d9421e0a6d1a7cfde3f6d742670550fed009585ab35b53cbb845f63c5f74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713429312, "uuid": "b443bfbb-6e44-41f9-9988-0fbb4757a025", "comment": "Malware payload (Quakbot)", "value": "19e491a4c69de056c77d05ba671870818d4f7f80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713429312, "uuid": "cd5b9c38-ace1-45b9-a7bb-eaac4868c87d", "comment": "Malware payload (Quakbot)", "value": "f5b425d7aebad63c382848ce065ccdc048196f432737d2b49179e18c5540c71aadee1e2000c657656ebe9ac064ba1aa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713429312, "uuid": "1a15faa2-29a8-48c2-8e16-8cbb3ceeca3c", "value": "T13BB4AE01B8D08032C57234710279D7798EBEB4700A556ACF57DA1DBBAF70AD0AB2676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713429312, "uuid": "5b4be52e-4c6f-4c87-8054-a30d58ed8569", "value": "14e3d57d9f86b144f92a9d94ef2c3bb8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713429312, "uuid": "9ae0c0f7-faae-425e-b2c5-0dc352a91366", "value": "6144:7TjAuWlcEz3grAQFAaQe0j+TE7xrJmRPnZJUdFwnKjMFtsBzlgnySHpgB:fjAuWlJ0AQqe0j+WuaFMKjMfmSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713429312, "uuid": "8945f1d5-24dc-4c2b-bab9-11c263c43e07", "value": 535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713429312, "uuid": "eddb8b3d-4a5d-45d6-a9d6-bd021e458fa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713429312, "uuid": "fca02424-6dca-49ec-812f-1c1948d30bdb", "value": "qd_x86.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4137d522-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434759, "uuid": "7227c372-d992-4a8f-8891-416764aab2fb", "comment": "Malware payload (AgentTesla)", "value": "9f030e31b0857f2ec2ce9b4f55e3e899", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434759, "uuid": "57907b28-ccc4-450f-8997-76a52498a00b", "comment": "Malware payload (AgentTesla)", "value": "73011f0c9b094760e6263a007cf3f41445900f83269674f21df1b18af4f7b529", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434759, "uuid": "452bbdcc-d5af-44e5-a158-5520de3eceee", "comment": "Malware payload (AgentTesla)", "value": "5f0d7849d715326a4b2154b1ec678c821292e3e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434759, "uuid": "67697481-6097-4bd3-ac3f-d573d3bcd46a", "comment": "Malware payload (AgentTesla)", "value": "b1ecdc4828de499bbe6cec48a3b2fdf30194a16b460450e3ef8823c11e344d75f28981c971dba72f4c9aa964476cff49", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434759, "uuid": "961197b1-b44d-4c87-803c-60d0fe22fb3d", "value": "T12E74E1D5251C9922E22C25B508F10AC6077CB7169EA55620DCFF2FC8AA5312FF2D1DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434759, "uuid": "a03bb05f-a685-4a98-b6cf-138f7c8753d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434759, "uuid": "ddb7265f-aba0-480c-bf7f-672f251cb8f8", "value": "6144:c4MCFXiCFV0ihUUUUUUUUUUUUUUrUUTUUUUUUUUUUUUUUUUUUUUUUUUUUUUUiOjc:L1FXHFV0ihUUUUUUUUUUUUUUrUUTUUUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434759, "uuid": "6692fce1-7466-4066-b8f0-e160836aec4c", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434759, "uuid": "df20f235-9201-4565-ba3c-cb9a95cb985f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434759, "uuid": "ffb03d2a-73b9-4e90-9069-d922f07f1d33", "value": "hesaphareketi_1.SCR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d783a254-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470659, "uuid": "e12ba457-5472-4704-89d3-c57d31fd8a85", "comment": "Malware payload (Mirai)", "value": "c1fcf05483a03bc5a3012e069724d1e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470659, "uuid": "1ac8a434-356f-414d-a3df-d58134de4586", "comment": "Malware payload (Mirai)", "value": "73af0bdf6ce0adb12c0c2c6c226098b48b9dfba63027fe0dc318a122b4ad7d75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470659, "uuid": "42ce9872-f26b-4662-830c-56abe39ed8ee", "comment": "Malware payload (Mirai)", "value": "707a9abca09ecaaddf1ff808929b15bd68159fa2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470659, "uuid": "57dbabd5-7103-4b22-a303-5945e3767ea8", "comment": "Malware payload (Mirai)", "value": "844dfba6912194339c4a327ef45151046f58f09077cb580a53e6af392c2a6353f9141f7cc11942be9369a07bf04cffa7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470659, "uuid": "e6bf8f95-e82c-4c98-881c-eec612cc2966", "value": "T148C3425B6E108B2CF76C973446FB6D24834923E72AE2D949D19FDA001E7132D6C0FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470659, "uuid": "3a3e25dd-00c0-431b-8eb3-1dfa812e449b", "value": "3072:hk8453O6NfdKgrU37sNxnLTxzLUVlDFb1l6WwqMh:X4539NfdKgrUS0Fb1l6WwFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470659, "uuid": "8389c535-8d55-4244-83f3-78e5ab865af3", "value": 120296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470659, "uuid": "a28ce88c-29fa-4b6d-ad67-541dd75963f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470659, "uuid": "45c9c0a2-0fe9-44f9-9dd9-b6c0bbb402f9", "value": "c1fcf05483a03bc5a3012e069724d1e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d81a8ad-fdb3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713465649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713465649, "uuid": "19a1485b-2810-4aec-a028-17c2e6b2a97f", "comment": "Malware payload", "value": "815b3c88950fd572bb4bfef96d2ca23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713465649, "uuid": "3e8af357-249d-4d29-b41f-8d5b44169e3e", "comment": "Malware payload", "value": "7409250e8be3bdcdaa756faff2150b13677ae066e42cefa52844c87451f6f60d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713465649, "uuid": "8ea9dfdb-e658-4d64-b3e8-bf9fcb2a2868", "comment": "Malware payload", "value": "87a6b0efce37403fa173bc044de42b1e2447726c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713465649, "uuid": "aa59c8bc-2dfc-4d21-880e-31d0ed596238", "comment": "Malware payload", "value": "df701c326bfbbcc95a7bcbcb79b060c4d53fff3eee5591c6ca04265903199bcedc14ea3d849b1c6726cf71fa71ae57d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713465649, "uuid": "9a9050b2-8edc-4afa-ae61-4fcdb096f161", "value": "T1B4B733A837E31039E014963DD997DA685DF8FDA62EE0B8C05FF2DA0C5DF86852A30D54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713465649, "uuid": "1bd9236b-aee5-47df-8aef-7e9641b5fabf", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713465649, "uuid": "69b258e0-a464-4096-aff6-955726bb75dd", "value": "786432:U+YuuCjUh/w5h814TkA6FHmJjeHpoIezaWH5BWBvKyOZs4/FIK6OS:QvCjUhUe14/F4oId2BASyEs4/FL6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713465649, "uuid": "5838d31a-dc62-4b30-b5b3-d62f29d599b2", "value": 48506864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713465649, "uuid": "40e773a9-17e9-441a-a579-39b051a0b232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713465649, "uuid": "20e75c40-fb60-48da-bfe4-c0b804771da7", "value": "CalendlySetupLastVersion(1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb43229-fd88-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713447502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447502, "uuid": "64c9bd18-29df-4e84-8d04-c6ea1b138352", "comment": "Malware payload (RemcosRAT)", "value": "e93e1296b7e4688e847b299faed3bef2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447502, "uuid": "66fe5558-abc6-4114-8686-380916972977", "comment": "Malware payload (RemcosRAT)", "value": "78a74e42bcf0d0df7cb482f178307235d60fbf59754456c2f742c4510dc83697", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447502, "uuid": "2f12297a-4265-4630-8734-6b11fb441994", "comment": "Malware payload (RemcosRAT)", "value": "b3a6d46e8b062e47efd38e88d85d10125cff102d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447502, "uuid": "aae52496-6e9e-481f-b52b-de3dbe29af35", "comment": "Malware payload (RemcosRAT)", "value": "2239c13b58cc8b70e4bfc6c06c22a0676d52c2e2f820280f053389051f7f866f6132dda875f0c761d04b9535150e5ec8", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447502, "uuid": "a6c9fd88-f586-4a85-9a41-07563b3efb03", "value": "T15413F8D1C9D612284A4A2767DD530B334DE8431E73235E75BBAD828D21438AC93BF7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447502, "uuid": "8b5bbf7e-54e4-44fd-b5d0-23a87d818082", "value": "768:Ha5MtHHJjzte49JZvrkudqaki7XyrWCWvcN59xwYyZ:HLtFzMaZv5QOrZCdPwY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713447502, "uuid": "8d15cf3e-4b95-422d-a67d-a4f92b0b5a1a", "value": 43437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713447502, "uuid": "610a36da-51a8-423e-ad1b-1cbfcae9f398", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447502, "uuid": "274b2b6a-0f81-4d37-9761-c19544cfb227", "value": "RFQ.NO. S70-23Q-1474-CS-P.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891aa6af-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713467092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467092, "uuid": "e2246bc6-4148-417e-966a-1a0c1e01daf0", "comment": "Malware payload", "value": "34289ef09df5968d45e9198b23d303cf", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467092, "uuid": "e82f00d3-72c4-44ea-bead-6a689157894c", "comment": "Malware payload", "value": "7a68fab530f7bee9a2caa6857bf619f77527a9e8be117bd205836f4824b63155", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467092, "uuid": "f598c6f6-f0e9-4902-a8aa-f39e8edc775b", "comment": "Malware payload", "value": "596e26b93e8e35c7abc655e1e55330fc17c80ce9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467092, "uuid": "ed3e6fb5-246d-4df1-b617-ed483b9e42b3", "comment": "Malware payload", "value": "4dd53ed3f2d7f822bd6904813965f999d8a03e524435cf9d9c74fac792125083240813f00664554e529cdf7dad1655c3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467092, "uuid": "5f94887e-11a6-41cd-b0ac-c2ceb9b58dac", "value": "T1E2E4E05AE7829E27C977433A54E343B93326DC014B138B4B2184BB2C7EF27551F1B69A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467092, "uuid": "f27230e6-ee8f-427f-93ad-006067c207d1", "value": "12288:hGp9y86twoD3yfdfNX3ZEcK0qMAc00Nb6e5ecs24QKLI:49y9twoDif1NZ3/BAc00sUTKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467092, "uuid": "afcec9ba-a7bb-4011-8b55-728b448bc51e", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467092, "uuid": "400944f2-8510-4304-932d-d4d57f6f35b1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467092, "uuid": "a521bc40-7774-4788-b967-94b4c10ac6fc", "value": "IMRR R0743R SAQ2024754193 Samsung - Low Voltage Cell Issue v20240418.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df272cb5-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439319, "uuid": "c7cfe6fc-7562-4bd3-a51f-6e82d55a2713", "comment": "Malware payload (Mirai)", "value": "199a8a74054143787e1f4d9e9b1a5321", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439319, "uuid": "1d35f44d-e100-4a12-a65e-eb548b9f0c1a", "comment": "Malware payload (Mirai)", "value": "7aa6268000d4845520c959ee316c678c6d18704ebccb221866cec19078d3d01e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439319, "uuid": "0dd6359f-ae1a-4877-8ea0-6eea756e6264", "comment": "Malware payload (Mirai)", "value": "896b71606dce1bf19114b41e0e9840ede04d8c7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439319, "uuid": "e0420554-42f7-40cc-8735-804cbd4262bc", "comment": "Malware payload (Mirai)", "value": "7d9bdbaedd46a3d6c339c07d4016b72a6881693ca4cd96f1c51fee726b95e2ce8f4e317c6c28c4c8845ea6980d449ac3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439319, "uuid": "6621f194-fa6f-42d8-ad3d-1d1298f0b167", "value": "T14904861E6A228F7DF6AC873047B74E20976D23D617E1D684E1ACC5105F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439319, "uuid": "4d52a0b7-1ccd-4b8b-9701-8ce810c350ec", "value": "1536:8f/8ANwxlq37wW+aff238a4EonKya16QmXVMOUtPO3L3Y5kdDsg/EjCUr7bx77hb:8XFNylePtoMMtFkNseUv8OCwjlR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439319, "uuid": "452b1914-d3e4-482e-8dd4-866197bc9a42", "value": 189712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439319, "uuid": "0b6fb419-0eb6-4e2b-8ba9-79273cfec21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439319, "uuid": "f8bd32c7-8046-4c12-9a4a-a7a6e62eeab0", "value": "vlxx.mips-20240418-1121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ffc8ce-fd51-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713423679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423679, "uuid": "468b6758-dee6-4124-b6ed-a91f8484b09d", "comment": "Malware payload", "value": "a7fbc4d9748e336d0b6b6614ed5ad2be", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423679, "uuid": "4db8b407-6479-4ddd-8fe7-70644753ba58", "comment": "Malware payload", "value": "7d0219bf768041ecb8839a7b7cb27d0bde31b141996516d2e80748a3e4e999c1", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423679, "uuid": "a32a1037-3ec9-4217-8cde-2ba196c1ae7b", "comment": "Malware payload", "value": "63bdd7cc1c9e7803d769f169787a8b6987fa9433", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423679, "uuid": "455766ab-dfc1-45a6-975b-65679448c12d", "comment": "Malware payload", "value": "1ec3f0d250e2ebd64322c57aa2d38feaa2a70f3c9d059e5b0b06fa2a78d6e78c06fb6546ec6936b84751ecad806c32ec", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423679, "uuid": "fa8b5e3f-e711-4d96-bf92-33377fd65376", "value": "T192E4331110DCBF0FB38766027A61BA42B96D86013F597BA8D9B170F4809D1BDB4222FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423679, "uuid": "84382257-8815-4d5a-9448-78ceb4dfa789", "value": "12288:LybfGfdbA4xFvIgGKrSACMC2J7W2LYCTu3Lg4bzVuu9dfiydLXt:LybVwxTGKrxCMC2J7W2LYCa3Lg6Vuc6M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423679, "uuid": "f64ae7fd-16ce-428d-aaa8-c34cc95a04b3", "value": 707559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423679, "uuid": "5d028b37-43c6-4df9-bee8-c48c2abf6be3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423679, "uuid": "89ac960b-74fd-4c47-bd2f-49d104970cb4", "value": "Due Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a684f72b-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713471006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471006, "uuid": "9f39eb21-aa50-457c-927b-e4fa0ac75a4e", "comment": "Malware payload (Mirai)", "value": "7dca39066597a4dc093b6d31a65ae4e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471006, "uuid": "a795a468-a786-473a-bc84-a2167a274875", "comment": "Malware payload (Mirai)", "value": "7d34f68e05ff02c35610806b8138d2e2c3bd7a2168b2e9c4335af1c38a2ad6a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471006, "uuid": "5b0bbc10-a9dd-498e-8ffe-fb70daa68a0e", "comment": "Malware payload (Mirai)", "value": "50a2113d43f547708893487b29e3cc1eef568ab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471006, "uuid": "5be7d55b-2293-4b7d-97f1-25cd3d151c24", "comment": "Malware payload (Mirai)", "value": "a6776abfa9de0f23db303416178207eb2840975a5a269800295f2e20b9f17cb51e1457fe128dc5b4a5936a35ea502ab6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471006, "uuid": "45feb519-9fb1-458c-a4d6-13b1776b1774", "value": "T186235CC9E643D4F5EC1B06742537FB379A36F42D016EEB53C358E922AD52A40E627388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471006, "uuid": "8fa146ff-278f-468c-94e5-857ec43f0d4d", "value": "768:kFsCAjAHYeH0OVnC/I3JcXKcgVgQ9E27PVFrvFb+INmUaD4y8Bj/Ms3IU:kFsCAjAHFHNVnLZ+gV5W0D+INm9D4PLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713471006, "uuid": "4de35ff9-4981-4b6f-b983-56be38e5b848", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713471006, "uuid": "a2f10cb9-66f6-45b0-ad0d-75766f0cbc6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471006, "uuid": "de22daff-607a-459f-9c7c-b22013b971bd", "value": "7dca39066597a4dc093b6d31a65ae4e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfeb08b-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459045, "uuid": "0835a285-7aff-4961-8e59-de50d6ef0001", "comment": "Malware payload (Mirai)", "value": "64c501bdb9f5a3933d45400b3e45af25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459045, "uuid": "1175e669-6fe1-4ef9-ac6e-1537f26fffa3", "comment": "Malware payload (Mirai)", "value": "7dfb6de21c20e538dd5d32f327f74f5d817118fa8496a5603734f813d0627750", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459045, "uuid": "060f31cc-50f4-4e2f-b02c-5af96f9b9061", "comment": "Malware payload (Mirai)", "value": "a25658d8c445dde935f377e961fca2278873107c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459045, "uuid": "be683a75-3fe7-4d1e-bbd7-97a531a39a66", "comment": "Malware payload (Mirai)", "value": "e5a6037fe7278c555546b8255323545aad102c2d7ed3c3092ba627f3efcd40eea88f7b217ff6e3e9b969059a2ea9f6a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459045, "uuid": "073b5877-17c9-4118-8dcc-1d3cf47c011b", "value": "T1E404885E6E228F7DF668873447B78E25976823DA27E1D644E1ACC1101F2039E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459045, "uuid": "80274220-7f0d-4222-9475-289e51dcbe77", "value": "1536:gF2ivn3vfjrFwzvK4DNNJBSBSO1WGxe8GWsfNyJTfxIhTiO0RmH31Q:gzv/yjZNJBSBSuW4GWTXITkRmH3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459045, "uuid": "417e9884-1f42-460e-95a1-1a9c2c93d77a", "value": 173764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459045, "uuid": "be598cae-5c88-4f84-a3ce-127d42dfc84e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459045, "uuid": "d6404757-58c0-4c47-82bf-2ec32bde9c89", "value": "64c501bdb9f5a3933d45400b3e45af25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f7f63e-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470626, "uuid": "48fd5a2c-787f-4095-8797-07170c7a25a5", "comment": "Malware payload (Mirai)", "value": "c5dd37d7b6c682b3ddee376d7363c2fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470626, "uuid": "5300e00d-53e7-4e3e-9dfa-45996219eaa8", "comment": "Malware payload (Mirai)", "value": "7f151ccbd3495662b456ccfc2ddd8f7d5e64675941c9683875d545cd08aa8bfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470626, "uuid": "6828b8ee-8a5a-42b5-a3a5-37842bebb8b1", "comment": "Malware payload (Mirai)", "value": "d9cc1edfe60a83d227740e607d865884efba58b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470626, "uuid": "615793db-54d7-400c-8e96-29717f274199", "comment": "Malware payload (Mirai)", "value": "c8edd9c3165dfffc5f7fa77d7069acd0308ccc708f01446e670cb22be56c0a7d27370e28348e50a02590f42f55673c6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470626, "uuid": "dc4190fd-7fab-4fd3-bd21-da74d31e85df", "value": "T1DED36C576A437ABCF2A300F8D69367ED29B319281F4E91F27881653BEB701C94279F50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470626, "uuid": "2b677b1b-68b8-4d0f-9db0-aba4745e1531", "value": "3072:vc/++pPDxRKZlCcE07AvaH4jKHWWgrVqq:P2mHE0U+2bVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470626, "uuid": "94cc331b-a27f-4df0-8b23-29e68e419a3b", "value": 132660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470626, "uuid": "d8c940dd-621f-43b1-9acd-328b7d371806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470626, "uuid": "1189da8d-e406-4588-97eb-85b04b5195fe", "value": "c5dd37d7b6c682b3ddee376d7363c2fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64beeeab-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713467031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467031, "uuid": "b17398d7-f34d-4a25-a4e5-a22dd2ee00c4", "comment": "Malware payload (RemcosRAT)", "value": "5734e6a07be159df58b947596cad09dd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467031, "uuid": "c3596940-8ab8-48a6-b1a1-8268b6a76319", "comment": "Malware payload (RemcosRAT)", "value": "7f5ffd39a86f314a261131081bc9557a9f755222ac164bef9a2ee32a6c7b6cd3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467031, "uuid": "5ce5e0bb-8dfe-4a89-893b-218f5285e188", "comment": "Malware payload (RemcosRAT)", "value": "ee9358bab004d5c4e986172bbd0e1af6c85f6663", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467031, "uuid": "b363ac3b-d485-4ec4-b0b8-10be87a828f3", "comment": "Malware payload (RemcosRAT)", "value": "031fdea58edaad0a0669ed617606ab10991fc043d51ed59de463746eb2c6738e3c902090b3b23028adb8a244319ec2cb", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467031, "uuid": "ff1073bb-08b0-495b-aecf-3053b8f1f642", "value": "T1B21306D9CAE61A1C8A470A67ED5306334DA8415D77334AB1BBED874D104389C86BF7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467031, "uuid": "1049bc2a-8a8c-40e3-b86b-0e4393261583", "value": "768:la5Mt7HMMhtM029ceFAyg0od10q1ZsaaNWVr96XtlyE:lLtFh1DeFAH0ofxKkWtl3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467031, "uuid": "d9546163-1586-440a-acbe-89dd6c39d723", "value": 43744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467031, "uuid": "f8c6e75a-235f-4e3c-b38b-228c7591107b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467031, "uuid": "1a71b5bc-3f45-4a5f-bc1d-2842fe8e171f", "value": "dhl_doc_awb_shipping_invoice_18_04_2024_000000000000024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a3fddf-fdc6-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713474010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713474010, "uuid": "fd46ae23-1c65-4067-8817-7f0bf87a34d9", "comment": "Malware payload (Loki)", "value": "3113c2a7b30c1cb350e8950b4222b0c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713474010, "uuid": "7f8c7a02-67ad-42fc-beb1-f3746f165c3c", "comment": "Malware payload (Loki)", "value": "7ff1d7dd5684cd38bea4a227bf49d4ceff1de7d2f66a556ccc6ce1a382640fc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713474010, "uuid": "fa50afae-61ee-44ee-bd76-ca10dc6eacd4", "comment": "Malware payload (Loki)", "value": "2fe0c50dd095a738788693e147c0b9d883554d2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713474010, "uuid": "9900ba6d-5afb-490c-bdbe-199a4aa071fc", "comment": "Malware payload (Loki)", "value": "b746805907be6e8e0c2112e33e5c4cc7f1e06b7696193f238d1ab05c4f72ef6eeb95b382378c760e5b850cda14831a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713474010, "uuid": "70731468-80fd-4ec3-8cf0-8e35b46bd338", "value": "T1C274AEAC726072EFC85BD472DEA82D68EB51747B931B5203A41706ADEE4C897CF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713474010, "uuid": "fcee1c45-fc6a-4d10-a903-822fb82291c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713474010, "uuid": "484bc984-fbd0-4ffe-aecd-598e6116a19c", "value": "6144:MHM3730X5T4avIrevXJZzkhq8R8ahdMSM9C/JWJu0GTY8odnR1j3hfbJHtFy7tcQ:p3cT4Ed3YQG8SM9LJV3dnRLbJHtFy7tJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713474010, "uuid": "18c71a8f-bcbb-4712-9fc9-6185f8622a88", "value": 369664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713474010, "uuid": "3ff0e6e9-aa8a-4f30-9fce-bfc2ef4484b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713474010, "uuid": "9b8b530e-8087-4ce6-ab60-815cbd63a7a0", "value": "3113c2a7b30c1cb350e8950b4222b0c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcba61dd-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713450965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450965, "uuid": "33ab55ab-3a8d-4047-ad84-b6a51248eb7e", "comment": "Malware payload (AgentTesla)", "value": "4d56c38b4db31a34eff64177ac2ad3c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450965, "uuid": "f95ad265-c70e-47ec-89f4-fcbe51165231", "comment": "Malware payload (AgentTesla)", "value": "810a3b5d6ccef845c2a9a66e9d7552be62f2e9085ed96fbecf1eddc5c29cb170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450965, "uuid": "c54835d2-43f1-4b70-8ad4-15222dbd4dd9", "comment": "Malware payload (AgentTesla)", "value": "976f0647fbbcf0b36e0176b821dd217c25909425", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450965, "uuid": "a8ce7136-ec43-4b5a-8474-2e5c83a641cd", "comment": "Malware payload (AgentTesla)", "value": "cc9e2e025d56d440175e963652df1709642c8582a08ef5b94abcc1855b11de4930f7850125e32cd92c4c0d4dfc7be3ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450965, "uuid": "51718377-0f1d-4f08-a6ec-db04f2c0dcf4", "value": "T14735223E9FFAAE19E1D113B78B46333065A0C9B211DF79DF48190F4835901C5D93B86A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450965, "uuid": "cbb295c2-a8d9-4917-928b-4fc0e98d8083", "value": "24576:Q+7a/myPFgjHG/p1jCoUWR6ux0AO5oEPXr2:7Qmyumn4uPUr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450965, "uuid": "14a01fd2-7ba2-4054-b667-3f9fa3017812", "value": 1161198, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450965, "uuid": "1df6683d-d980-41af-a38f-d803936ec2cc", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450965, "uuid": "4690740d-5def-47ab-beae-e4b8516458b2", "value": "DHL Receipt 004673321.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8a122b-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713434778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434778, "uuid": "db689e1f-e2b8-4e64-847d-fc099ea58901", "comment": "Malware payload (GuLoader)", "value": "d8e8da20535c7928e416af72d69cc817", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434778, "uuid": "99c61d8f-5b8c-4575-af48-ac27971d3d21", "comment": "Malware payload (GuLoader)", "value": "814c44267d5b05f72b1d8a0a2f9d165515d109383cf9061688c59bc59709f57f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434778, "uuid": "a7fcc885-bc8b-4fef-b440-16430507e52a", "comment": "Malware payload (GuLoader)", "value": "2e6151a12a6ecafdb2943166e1c11417eeebcf7f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434778, "uuid": "fc3c4761-45c8-4d19-83cf-9b94cf0f7524", "comment": "Malware payload (GuLoader)", "value": "1c91264c48fa6f120b133d5e4d1e64f6950f173934fd316742775c18c43a1a3a9218585628baca62b901584ba56c22ae", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434778, "uuid": "e09a1618-c95b-45a0-a11e-1193644b1d25", "value": "T1EC946C60EE68066A0D4B279AFC911E92C5BCC219462710B6FEDD074E610B5ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434778, "uuid": "1fa89294-82f5-4534-94af-9b43e86d618b", "value": "6144:ltrc0iH9QXg0Im+aUGFvWtBVkmFtNqsgBt8FD3PG7BXMVbc:lFidQ0lBzzTc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434778, "uuid": "9ba57d1e-d480-49df-bc27-f24564818b51", "value": 413149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434778, "uuid": "a00ba3f3-86f1-48e9-9848-0eb40897e6f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434778, "uuid": "3d6662e8-0f20-4fe5-b7c2-30a291327d91", "value": "doc_awb_shipping_invoice_17_04_2024_000000000000024.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b64cdb8-fd6a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434239, "uuid": "16cced65-c9f8-4514-b91c-e421c8cf55f8", "comment": "Malware payload (AgentTesla)", "value": "c89b66b5d26a71d274f0776fbfcef047", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434239, "uuid": "02ea9b08-c755-4578-b9a7-e2dcdd59f491", "comment": "Malware payload (AgentTesla)", "value": "816702b08dc2467c8a89c7bb6e175afebbf78ea0b4a9c0a73c1aef62d63ec5d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434239, "uuid": "3e636241-f912-4378-a001-7d5342bb77b4", "comment": "Malware payload (AgentTesla)", "value": "5c4c8e9f16c8d22d0f3e4228365b802d6dd44b98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434239, "uuid": "77efa5ee-0cc9-4d5b-84d1-ab3b087682fb", "comment": "Malware payload (AgentTesla)", "value": "490cc28f78ca3153ee747c4133da7974dd74090128d60885260341b17818389bbbffd6a4b7fc570b93328fa3b465ddf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434239, "uuid": "515b3f6f-4640-4c26-8952-4146643c8b00", "value": "T1872408F0CF0B36199F5B3EDAAC6485924AF94195051638B5AAD807EDB283C2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434239, "uuid": "81165728-45cc-4987-a402-d0e8a3ff4d38", "value": "6144:PYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfhnQp:c2dOpWf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434239, "uuid": "9ea0f7b0-081a-48b0-aabf-44aae13c1064", "value": 211553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434239, "uuid": "d6b083c5-423a-4559-bf30-87fa72265218", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434239, "uuid": "7cf58de7-6a0e-442d-9202-d08f09f03c2c", "value": "Documentos adjuntos.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d46f844-fd56-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425813, "uuid": "8b9cbdfc-5199-473c-a923-b36128a996d8", "comment": "Malware payload (Mirai)", "value": "4613f631c60d02d83c66d2df674ed027", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425813, "uuid": "1b642bf4-542b-45b8-986b-4775f2b93395", "comment": "Malware payload (Mirai)", "value": "816d18dbb48908539abbc2c45223394d714e7fe971d3fb95d6bd45c9f08bfa4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425813, "uuid": "a425e04a-9799-48c4-9646-bd4c8f50a1ff", "comment": "Malware payload (Mirai)", "value": "9df730f36b9465b9f31b397a1703441b4a2b5060", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425813, "uuid": "66304bac-e0c0-41e8-a792-3178ecfd18b9", "comment": "Malware payload (Mirai)", "value": "1fb33ea8e90388abe9d3de61e2ee555c2afda2908516d0f29c88f28b6115114c4961ab752da22a9888cedf25de1d7b69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425813, "uuid": "3f833460-8364-4a76-a837-895d8164cf44", "value": "T13263F1500F08A905F6908BBDD734285D664F1A76C3AE70EB69C4D89C6EF3646CF7C18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425813, "uuid": "8ac67b3f-e7e1-476f-8ee3-9f57e6d5fe2d", "value": "1536:VK+hhL8huM80tAZTBBCfqAA0YDjkdk7d2uQAnMXXJApL4MvF3LWJNY+vfi/Av:vwp80tqNBCI0YDjA3uDn2XJALahvq/Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425813, "uuid": "9887ba2f-96e6-463e-8674-ba5776892381", "value": 67504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425813, "uuid": "5b4396b5-2ef0-4f37-a462-39cf3eacd3d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425813, "uuid": "884ca6f4-62c2-48ba-a837-a88c8d2a9352", "value": "4613f631c60d02d83c66d2df674ed027", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3bdcf2-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713434755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434755, "uuid": "e2e55fb9-b22a-4dee-96f0-3f655834bcef", "comment": "Malware payload (Formbook)", "value": "ad400a4c8af415892429acb5886a5ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434755, "uuid": "089aa12b-080e-4711-9f2a-3cb83259e24a", "comment": "Malware payload (Formbook)", "value": "81f6e3ff9cc821300e30acd628d0579793806ebfb89941d04f9bc33998f9a851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434755, "uuid": "aed1e5cd-15e6-4ed3-8f89-82f350d90ca6", "comment": "Malware payload (Formbook)", "value": "bd6c023606236c1ccb74863680ca5e74029d3526", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434755, "uuid": "cc3fbdb1-52e1-4456-89d6-ed22f2e61b61", "comment": "Malware payload (Formbook)", "value": "902b79feb3532272a274ea31eb629efcb071a8c763402bb1041460552b091643d75d9ea8947c8fa229815c4a08d5c382", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434755, "uuid": "1a70d013-a805-4d17-9478-edb44f7958e7", "value": "T10825D13C1CBD1A3B9075C2A9CFE98567F050D47B3912AD7A98D383A58346A9379C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434755, "uuid": "98b6460f-9f7a-4db4-a19c-7d86c8c64c11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434755, "uuid": "20a29521-cbac-43cc-9fe3-2390da505e4a", "value": "12288:eYsoBukMEbli8FwgY3zpQ43W/2bsJQG6JETe6dMM9DsMORFYNL8jWiqt+uIfHKdO:3sKlCgGU2QBoETe6u2DiRGJDiq4fHK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434755, "uuid": "f80be15e-ece0-4210-8f52-4a42db481e0c", "value": 987136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434755, "uuid": "a42655a8-3ca8-47ca-aebd-1d2e4926c69d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434755, "uuid": "806c6f9b-b91a-4364-b31a-0a1dfbe3e85b", "value": "Ola\u011fan\u00fcst\u00fc \u00f6deme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500448a5-fd85-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713445950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445950, "uuid": "f304f17c-96a3-4500-920b-24ccf35b20d6", "comment": "Malware payload (AgentTesla)", "value": "2d6113951e16a4336fe1bd44a12134a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445950, "uuid": "435e18f9-f874-4f44-8ba2-faca6e402cec", "comment": "Malware payload (AgentTesla)", "value": "81fdcde8fbe4d7ad27f94d3bf8b8276aecf45ae7017e6385c6a5f3e472465dac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445950, "uuid": "c92640c9-432a-4e74-b50e-58a00f58907c", "comment": "Malware payload (AgentTesla)", "value": "653e90cfc6e1d07cb6e1da4e1fb8f70ec64fb429", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445950, "uuid": "6fe2c659-9284-49ca-8139-d6fc765fd296", "comment": "Malware payload (AgentTesla)", "value": "cdd321f204c6797bb09e32d50c72666f5b1490ca30f83147c46e23b819c2a672ac2b0cfb0b20356f4dd96106729f7c01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445950, "uuid": "fd58aac1-c73b-4b1a-a604-70cc8e0c2c2b", "value": "T10525E23D1CBD2A3B91B9C6AACFE98467F140D47B3911AD3698D383954346A9339C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445950, "uuid": "cf6e0c6d-886d-4675-851f-2453caaf8a01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445950, "uuid": "866c609d-66a5-41a0-a1b2-b14a4fa1e1c0", "value": "24576:Q94WQZsG8QsWnBeCO4R631r74+aJS8/lsq3hEk2Ku:7ye9MsS8/aqak2Ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713445950, "uuid": "24a6b641-d704-49bf-ad1d-880c78c962c1", "value": 1039360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713445950, "uuid": "94eeef98-e01f-4de3-b178-0135c276f0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445950, "uuid": "81a06c93-8059-4ef6-a5f2-102d40fe1d15", "value": "PURCHASE ORDER -HDPESD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64120282-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425368, "uuid": "6a1d5c6b-7dd7-4cbc-ba94-6a9c5ea90677", "comment": "Malware payload (Mirai)", "value": "4405797eb4c6856bd58836f13280a65d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425368, "uuid": "bc99e8db-2091-4e46-9f9b-f8958f49e3d0", "comment": "Malware payload (Mirai)", "value": "8212be07d4b570ed81041da478b1c6317cc915a60f36c70b93c09ee7ca529eab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425368, "uuid": "b8b2af4c-0828-4a74-9626-0177660e64f4", "comment": "Malware payload (Mirai)", "value": "f173d2017ec179b6200e0d8eb3a29ed2e018fb20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425368, "uuid": "85388b5a-8f53-4082-8028-377c2555cdf2", "comment": "Malware payload (Mirai)", "value": "c7a2519e6cd5f51ded2673fc93d3f3c96f1a93d3bd233be3e5e0b4607316f7a2fa165184180a83ca1a7122b338cadf42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425368, "uuid": "defc4cf8-6236-493b-bf61-4fa5dbef21b6", "value": "T1A323F2D693F4530CE5AA22B342AEE90D2C9291587C881ADCCBC0357A5807B076D61F5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425368, "uuid": "93b6c493-7ece-485f-ac80-03275fbced1e", "value": "768:rwePqwFHUprLsQtgn8k5Qp8pJFdrmR+vgfAZcYGu8HuGLkOytMnbcuyD7UHQRj5:keigUprZihQpKJLrmR+v9Zbj8HJ5ytMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425368, "uuid": "1c7fe00d-33c7-4f97-a8b7-56134b07aef2", "value": 47532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425368, "uuid": "d886c6f7-6200-4323-86e0-3f36f09f181a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425368, "uuid": "daa925fc-c946-4803-a4f3-5e2126a9ed03", "value": "4405797eb4c6856bd58836f13280a65d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94401243-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470976, "uuid": "70ef184d-e2ec-4203-8606-3ecacf84211a", "comment": "Malware payload (Mirai)", "value": "1f76afece9223e099364629863d1df70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470976, "uuid": "15287820-6ec8-4ff1-9c60-63cd73aba177", "comment": "Malware payload (Mirai)", "value": "822bdf93d925aca0608818368a019177581edd792af3955bd66aebcc1701652f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470976, "uuid": "ab4f9eee-d8e7-4332-b989-16b870aa7405", "comment": "Malware payload (Mirai)", "value": "9fc8a594fc31537b8922d63ea0ca291eef2e5cc9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470976, "uuid": "e11093f8-2d97-4bd1-8f45-bf77f241a72f", "comment": "Malware payload (Mirai)", "value": "20e3ac309b8359af62d8058d4a1aba893721f8037b986f4462f51f7ed0467568d9f67afa69b8530474f3b45781aa1151", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470976, "uuid": "cb47566e-139c-424f-ab74-73b52f55598c", "value": "T1BA633C42FA828A16C6C563BBFA0E46CD772A67DCD2DF72439D106F5233C792E0A67141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470976, "uuid": "196967be-15f7-4513-9b43-b5a999ad642d", "value": "1536:CS3zkJL54XBAqMuffkwABldBEf8ApVMeZwUwcFp9a961tw:CSDiWRAqMEMdBEtMgfpFp9a96/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470976, "uuid": "47c23459-9bfc-47b7-8310-396f7a17ada0", "value": 66712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470976, "uuid": "d07abfbc-a68c-4be0-a540-413972fed861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470976, "uuid": "e79c2305-58fd-413c-8b39-e0f2add1f685", "value": "1f76afece9223e099364629863d1df70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbc6fd6-fdb4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466428, "uuid": "fc402120-f436-4f35-8468-db855b8a995c", "comment": "Malware payload (Mirai)", "value": "40789549fd7cf08e89fb0a23f6365729", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466428, "uuid": "fe082160-81ed-4ab3-b2a5-92f8814e7632", "comment": "Malware payload (Mirai)", "value": "8249dac0b97e91488114e9bf2df88a95f5dd675618e85ec7e8c7bf4000a96594", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466428, "uuid": "5066cced-e14b-46ae-9dfb-ad88d76a5378", "comment": "Malware payload (Mirai)", "value": "cb4a12bf5de760037aa0061ff69ef070c9c3fce7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466428, "uuid": "464d5d62-9356-430b-9499-25bfc672d4c0", "comment": "Malware payload (Mirai)", "value": "120119406783296f4093789567a412ccc63edb27d188124211f46a62050f2fbe1d33d376a2dc9032f22e0f494fad75d3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466428, "uuid": "0b495202-2f4f-4d61-9730-74a6f981b401", "value": "T194D32944F9814F17C6C212BBFB5D428D772A17E8D2EA71039D206FA1378B96B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466428, "uuid": "63eb76c3-0c41-499c-bf66-872e82e0155e", "value": "3072:EsLFj0HZd8QDiy3G3vemtFBsJBLsuYbcj6dZ7Bje:3j0HEQDW3veYsJdsu05BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466428, "uuid": "f1c22f80-467a-4a12-a020-7d5d9e812ff0", "value": 137448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466428, "uuid": "3f5c67fb-3f97-44e6-b050-0a30b292e02e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466428, "uuid": "94db962d-e996-4163-a8fe-05cc0122a92b", "value": "vlxx.arm-20240418-1853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22492550-fd4e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713422251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422251, "uuid": "f39baf80-af8d-419e-b79e-fd5c924d246f", "comment": "Malware payload (Mirai)", "value": "07d09365d501e7c78e284849e5c8248e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422251, "uuid": "40ee9605-302b-4e5d-af9c-24f81397309e", "comment": "Malware payload (Mirai)", "value": "82af318def27b1047bb368a4620e1893e010b079ec00fe01bca7888b35becbfa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422251, "uuid": "3e6f5aac-d718-4c6f-b108-2ed1c99abf00", "comment": "Malware payload (Mirai)", "value": "5d1f655f3162511283dd2612f9248399fb3bab87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422251, "uuid": "85171211-28f5-41d4-bf9f-66471ac20a6d", "comment": "Malware payload (Mirai)", "value": "e803afb7558ca13d0703f5b57959086d9d6b037fe752f7f10d3d44285d0d00f66e2cc7ab3e1d5758359d05419c00c235", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422251, "uuid": "0e66e61e-d020-4872-bf1a-69408de0cba6", "value": "T13414D71AAB510FFBD86FCE3702E90B0535CCA55722A42B3A3674C528F54A54F5AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422251, "uuid": "7b1789c6-48d1-4848-84aa-49c840fb9a55", "value": "3072:S+dkhCZs7uR7PbaFL1ebk3VgJTmSuOb1:S+dkhVuR3aFgsQTWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422251, "uuid": "06b3339b-9585-4a64-83ea-af23d377c415", "value": 207460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422251, "uuid": "b4675556-d4e3-46c0-9b48-eb7400e27250", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422251, "uuid": "db86c5e9-1446-4c33-8c10-39328e9bd222", "value": "07d09365d501e7c78e284849e5c8248e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0c7efc9-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkTortilla)", "timestamp": 1713472420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472420, "uuid": "8e43d981-2825-4ac5-a6ca-45272b95e186", "comment": "Malware payload (DarkTortilla)", "value": "bb365d6b7cc40a740a03ffafc56555a8", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472420, "uuid": "508ebb58-3752-45c5-9bb6-f02019bd6889", "comment": "Malware payload (DarkTortilla)", "value": "82d326f98e0f8d143e7bc11ce8c465bcf79b2c34d4368f7ebe326fae200b5199", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472420, "uuid": "776135ee-977e-4330-aa37-50942148d802", "comment": "Malware payload (DarkTortilla)", "value": "3132c62beaa5d5d6c83ae5eda22b1c0d7b992b02", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472420, "uuid": "8474ab83-fb92-48d4-82bb-bcb5439111b1", "comment": "Malware payload (DarkTortilla)", "value": "2eb42ee54ad9250ee4c8f80d362446c6566d6b54b8313bca56459e6082ebbbc986d9bcfd49322f0a8f5a76a351322463", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472420, "uuid": "7ce20668-ccaf-464c-875d-27e98ba3bd96", "value": "T1D305E0DB23D86904E0FEBB71B53168C186F4A9DB8D51CB0B1984DEBC37B62418DD53A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472420, "uuid": "6df7e33f-0c31-47bd-b95f-de2d42cf7089", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472420, "uuid": "2c194d48-da26-4ca7-b87c-5ad881c3909a", "value": "12288:3C7T0f4jNZgnOdGCj4dX0EYLgZrxZeQzrjKEddyDZ9xdgc+WD+:SHHNmOzj4d9c8rtz/dwDtdgT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472420, "uuid": "bca52e6c-d5b9-40e7-96ba-68f32ca46d84", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472420, "uuid": "e187d7a1-7593-4d9d-9de8-a171d994ca02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472420, "uuid": "68e28e5c-57b8-4862-9046-bdc9594b1ca5", "value": "DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80baafaa-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433577, "uuid": "63652c16-e450-44da-af6c-e8ad3eb8b697", "comment": "Malware payload (Formbook)", "value": "75fd7827bbf0b22f48275d5882af458f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433577, "uuid": "73d1bcb0-303f-40c1-8cb3-4a2ed3d62a5f", "comment": "Malware payload (Formbook)", "value": "8300db91a37cce4dc00aed55b51bd5e469d53b82c67fc662d3eff93c7e341405", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433577, "uuid": "a884fa38-52a7-4e20-b832-994bb2f45547", "comment": "Malware payload (Formbook)", "value": "022d003d140510e5e9396a4ab4e51b7014d6750e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433577, "uuid": "adf352d1-2e5a-4669-b3eb-3fdf5e070c20", "comment": "Malware payload (Formbook)", "value": "e87d82a0f3973b660fd84324777365b5970fc194876c38886e77084b9f784fb82286ae15689849fdfe3adc99cf220857", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433577, "uuid": "c38bfee0-cca1-46e0-b5c6-61167b35ae09", "value": "T1E0E4235BBEC47B02D7E2B275325554064BB293CA1006DBE22CF2B5C49FD27904FD6A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433577, "uuid": "28688917-fb16-4e67-9586-6b8b5bead7ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433577, "uuid": "34fb5e8f-9482-492c-b029-716575912831", "value": "12288:MC13iwoQ/EbwkF+mgKD/2cwJPxNQAzUc84oKq15R4K4ljdHkR:N1Swo+gFOcwJpNQbFv4KUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433577, "uuid": "37f4096e-a476-4c05-baad-256ab97ec435", "value": 696840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433577, "uuid": "b0c9ce5d-4290-42df-8286-6bd2fb46063d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433577, "uuid": "7b43d45e-c09e-43e5-8421-95307d0c4105", "value": "75fd7827bbf0b22f48275d5882af458f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabac755-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713431124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431124, "uuid": "5fddb787-db23-4c1f-9f01-8b8e93332f00", "comment": "Malware payload (GuLoader)", "value": "c782d407c65fb588872ca0d46bf40d75", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431124, "uuid": "46c015d8-8405-48c7-8042-6ad2f2eed8a9", "comment": "Malware payload (GuLoader)", "value": "83d1ada429755f86e1468a30957b910641d112d83f44390bcfa38d5c9210d244", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431124, "uuid": "e7852363-0526-4aaf-bc48-8e3f7afe0366", "comment": "Malware payload (GuLoader)", "value": "3618270c1dadde1fd9b0b9c9a93148317f814628", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431124, "uuid": "13f2f736-79d8-4670-88fa-5bf01614928a", "comment": "Malware payload (GuLoader)", "value": "9b5600d858e4591cb172a35e66deb4af6b9009f9c621ecd013e1a6e34af2717f2fe30bb631357389ffd508bd349384f7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431124, "uuid": "c35f1081-45ab-4536-b23e-e8321d5c4497", "value": "T1352418F0CF0B36199F5B3EDAAC6445928AF44195011638B5AAD817EDB283D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431124, "uuid": "ed2fbe04-7998-4a78-9ef2-11e2a37f45f2", "value": "6144:AYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf7Pqz:Z2dObjan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431124, "uuid": "d113d17f-bc15-4039-86ea-a22c7d9ae158", "value": 215851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431124, "uuid": "92a3b3b1-0c7d-45b0-abc6-c3848eb5de02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431124, "uuid": "e723cd66-6c76-4086-8c8f-92af6447a20f", "value": "FACTURA24021151 - BP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683e6300-fd7c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713442126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713442126, "uuid": "7f7d209c-6b9a-467e-a54e-7884749fbc81", "comment": "Malware payload", "value": "7f63fc297d19ddea382356a4581c3db5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713442126, "uuid": "d3c5e729-e9e2-40cd-9bc5-77676947b82b", "comment": "Malware payload", "value": "83ec57a9cc9449d4ffe8c4eae5a898113a11ca1e1b10d171450f255e3bf748db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713442126, "uuid": "6306d984-455b-4ecc-9243-fbec93f8e6c3", "comment": "Malware payload", "value": "6414c8ddb038926e6249e8c46f9b66ce62537f88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713442126, "uuid": "d5caa48c-79ef-475e-99bd-a162a6d6a742", "comment": "Malware payload", "value": "b3f3b194906cbf58bcd85ea8bbe14bb57aa3ad22385f85364930fa34cabcad865cba33aa90ce336e45cfbc444081f3a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713442126, "uuid": "b793f324-1fcb-4294-82b6-506cafff73b4", "value": "T1BF073396B3550CC1E46AAA3BEC90C61266B1F0264BD7E3C72FF41F410D676E2AE36750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713442126, "uuid": "f8a26072-03f8-4ca6-9482-e34a42e6597c", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713442126, "uuid": "a5496868-3058-4203-99d8-288b61f6b92f", "value": "393216:Y+z4eN00n40gFETDfDgWP+I+uAuc64ZDW8Q3+d9W4G:YBeCpFETb0m+GAhTW8QOd9Wt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713442126, "uuid": "3114fcaa-dfe4-4f00-8f73-dd9ff35d95e0", "value": 17417845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713442126, "uuid": "58159c0a-1a6c-4e77-9c43-ad205382060f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713442126, "uuid": "df229761-ed3f-4dd3-bb3d-70785d483c33", "value": "Sp\u251c\u0434ti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a393c10-fd56-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425808, "uuid": "f42c99dd-f25b-40da-aa3e-4e4f985fa8d6", "comment": "Malware payload (Mirai)", "value": "24736e8f0e51be6d768e20591adde1ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425808, "uuid": "b94cf0ec-0302-4d78-b2a7-463bb6106d97", "comment": "Malware payload (Mirai)", "value": "844ee6c620e121eb13856b910fbde2694ab7309d69b97ccbc355c01ca90404b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425808, "uuid": "2a73a04c-70f1-4e8a-ae87-d3b0d07c0953", "comment": "Malware payload (Mirai)", "value": "e57ca5cf2b641b230c944e2c0480090c771e3e15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425808, "uuid": "740aa159-1b38-4b94-81a8-b9d6b678949d", "comment": "Malware payload (Mirai)", "value": "103a297337764bfd5f5605dcc2746e333f3108b47e5941f520176a23bece0d1610e2c0b68f01bbc11b3f52e733278b7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425808, "uuid": "efce72f1-1c65-4845-88e3-d13793495067", "value": "T142244285BFA13FFFD81ECD334295DA05129C4A0A5298AF7B2A74D508F68B10E59D3D8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425808, "uuid": "07330be4-f745-48ae-955e-855e425296e2", "value": "1536:QgRjvJFJmvwR0NBkDU3chkJg3mDYToKt4lbDrFqEaw8ksrYe/U4+2eYw0El0Jr:P9vj0vwR0NBy1QYssksdd+2eY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425808, "uuid": "861bd0f2-ae1d-4e90-a077-06e219fefcc4", "value": 217512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425808, "uuid": "6fd3f30d-4c2f-4396-b611-8343ac5bfc5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425808, "uuid": "5ecf8851-b1f7-4fc0-bfe0-12229eaa15b4", "value": "24736e8f0e51be6d768e20591adde1ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c8fb0a-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713433698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433698, "uuid": "3d9a7519-df87-44fd-952a-cf36079af8b0", "comment": "Malware payload (AgentTesla)", "value": "631c2878bc6bce3abe2189566ba31c1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433698, "uuid": "c31ae54b-8d3c-4893-9097-638ead048a55", "comment": "Malware payload (AgentTesla)", "value": "8547ac038654770220eba19ab7603d0b754bc901d64b21924e5a14785207c682", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433698, "uuid": "ad1eef3e-5578-464e-8403-4c98d11b7581", "comment": "Malware payload (AgentTesla)", "value": "5ee4dcc6dfcd323f4aa647bf07c7f7ee97bff23c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433698, "uuid": "ddf0d863-c498-4f09-89f6-a5e796a3bdf8", "comment": "Malware payload (AgentTesla)", "value": "84f6e8f21c0615948f6433d1342e3110011b35c8e2db602a154b542220e94679a891670a4b306eb5ec86c43c37fbb464", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433698, "uuid": "87eda151-8b61-40cc-b6a6-5c7ebdb62ffb", "value": "T1BE2418F08F0B36199F5B3EDAAC6445924AF58195012638B5AAD807EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433698, "uuid": "7ab3cd18-88be-4987-a808-e3bc3432c845", "value": "6144:4YBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfKgqb:h2dOyac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433698, "uuid": "684de63c-5fc7-4838-b8ff-be2b3e31da0f", "value": 210954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433698, "uuid": "91edc4bc-8f17-4564-be3d-019ef355f18d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433698, "uuid": "ecba70bd-27cb-4ecb-9cd2-7edb6641a7ee", "value": "Klkket.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca794ea2-fd50-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713423393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423393, "uuid": "6b135cdc-06f8-4932-bbb9-e510bf2cafd3", "comment": "Malware payload (AgentTesla)", "value": "41b141362972c5b724fea74dbf61e3fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423393, "uuid": "6a5f24e3-bedc-414f-8839-22306344fa3b", "comment": "Malware payload (AgentTesla)", "value": "8603455eb5ecb4d3668419c43db4504edfc8e1edcaa5f065d78325ed7a8d86c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423393, "uuid": "26e0dfd0-ab85-466e-886f-5b2140286a8d", "comment": "Malware payload (AgentTesla)", "value": "5e20a5dc5c80daa00ca05b9ce8a08a19c3b8b263", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423393, "uuid": "08321ef1-cf0c-49b0-b144-e752147fe404", "comment": "Malware payload (AgentTesla)", "value": "3303819b00c155eed41ce6317fac04d5d7358bfc003a1eb7d35842ed8f9bdfe115e68b1cbc492ca507d9cb579183e19b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423393, "uuid": "cc6a0dbd-e7de-4396-951e-6c22d44ec6a8", "value": "T187F4232536BE9B36D8792BF701790540A3F068AB1423E24D8EC155DD8EA2785EF847F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423393, "uuid": "f567418a-bf74-4eae-aa18-b4ad0f1f8ab6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423393, "uuid": "c686389a-9129-40a2-b9e3-0617bda0de47", "value": "12288:fIWK/pbMSRwwAF8cw+y6FCzhgPwgHnY7+yAVI0NSkmgj2qqnMQljSzZkWm19t:QWiMSg8W9PwgjyAVIcbmgj2aQlmzSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423393, "uuid": "6d3696f4-c27a-4d4b-8808-ced93dd295bc", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423393, "uuid": "2fe5475a-8dd7-48d6-83e9-fbd2fc989b63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423393, "uuid": "47334f1a-dbdb-4b56-bcbf-d61e1ea89583", "value": "Purchase Order PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd70870-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425358, "uuid": "de936376-e517-4ce1-b29c-996d7bd5c3fc", "comment": "Malware payload (Mirai)", "value": "a8d013187a753f5cc48cdb272c776f9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425358, "uuid": "2ab709fb-7a5c-430f-a06c-0d372d6ec2ec", "comment": "Malware payload (Mirai)", "value": "87457bb32f84b446a8690c042959b89ed31f090d9fdabe3211e34bf14e6c21b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425358, "uuid": "22f084c4-5685-449e-98eb-0c9f5571e003", "comment": "Malware payload (Mirai)", "value": "e7e8f58525414afda05c11d802822c8e5fd01d35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425358, "uuid": "459f16f7-a783-4281-871d-d44b051d9e86", "comment": "Malware payload (Mirai)", "value": "218249773ab63744b65060f23c67e61588c8437acee65446754c7024e0409def9dcc49f91ee88e9e1b8d2f8d48fcebcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425358, "uuid": "9db43f15-4c4b-4895-b4af-0e08f9bfbdc0", "value": "T14AB38CC5E283D4F6E84715B06036E73BAE36D07A2119FA46C37C9D31F8C6501A627BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425358, "uuid": "013a1d43-abb1-41d1-84bb-b1c5ce57dd83", "value": "3072:O1iOep8X1gMhg4VqkODjb9sG/H0USyA/r91kk:O1iOep8X1gMhg4VRMt9URz91k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425358, "uuid": "3cbb7345-0afc-42f9-a459-437b7e4d1d0d", "value": 108676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425358, "uuid": "c519c1aa-c74f-462c-be80-5b7e85285d82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425358, "uuid": "6aaab4b8-6b41-4eb6-b121-a08fb3d666aa", "value": "a8d013187a753f5cc48cdb272c776f9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51eb460-fd32-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713410552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713410552, "uuid": "d7113ba1-8c69-4f25-ab59-d037104b2874", "comment": "Malware payload", "value": "6a4f246a181decbf79baa551f7ac30cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713410552, "uuid": "153f8259-ea6e-4708-b05f-51ddfbb845a5", "comment": "Malware payload", "value": "87df205452e0a45ce91752b2a3445f2aac510ac86496176dd53ffd7f4c49f483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713410552, "uuid": "c728e126-2c0d-4b19-9fb3-3e017d18ae9d", "comment": "Malware payload", "value": "836b1426f19783493dc0a14d4e6df1dc6f11d71c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713410552, "uuid": "e25b9fcb-ee57-4241-85fd-db2b3f6e21b5", "comment": "Malware payload", "value": "ee3a2b26b46e1ec7b136e377b92d71e53a35326e4794028a11e54e06d9b3092769fd3ee1ca834f41896524467ac5856d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713410552, "uuid": "8f79e4ef-bb7e-4713-b3c5-09e37fbc013d", "value": "T1E395B2076B3B4A9EC530C4BE973A11E3D45DBD0CD028B9B58DC44A417F52FA09A7A7E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713410552, "uuid": "9bb767cc-f359-46fa-a1c6-ed1f1beff047", "value": "596334ebd2e6f461f61a2c1820eaadcc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713410552, "uuid": "901e55c3-1c04-40d7-815e-edd98ad6a646", "value": "24576:mepPgSXXd19gHSo2R1saXkaxidAXrw/hASIe4EVh9Bruskku4cWKlLM:mwYfcsa0vWJE3XvkWKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713410552, "uuid": "45320ce6-8b2d-4d04-acf5-d3e451692f57", "value": 1959424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713410552, "uuid": "3f907862-a748-4dbf-908e-11e92dd14ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713410552, "uuid": "b9d34733-b714-47ce-ae0b-c3ca0c71d847", "value": "SecuriteInfo.com.Win64.TrojanX-gen.20093.17447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96baf550-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439197, "uuid": "f74051b2-3c9b-4329-b769-ef532e51a774", "comment": "Malware payload (Mirai)", "value": "2d89525d47aee101a49e9c08aa863495", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439197, "uuid": "e8669e09-6b4f-4b65-b19b-b10083b0bc62", "comment": "Malware payload (Mirai)", "value": "8829dd3267d606224292ccb5efc1bb0c0dd36829f75e9b06cc6e5319acac4bd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439197, "uuid": "d2e8686c-42bd-40a5-945f-0b050c5c948e", "comment": "Malware payload (Mirai)", "value": "3bbb26660b9acaa67bfe9537914505f7eede3b8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439197, "uuid": "18ae2144-1cdc-4f1a-9105-a4d7b7232189", "comment": "Malware payload (Mirai)", "value": "3b803a638d74a0da19dbbd1b59bda739d9e457ef3c22659341108d9c4c1df1f223815936a3640b6acbc59246f81b5328", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439197, "uuid": "1649c58f-a44a-4e5e-91df-79c6d7e04484", "value": "T1D6435CDAB500AD7CF80BE77A81074901F131B3A658532E337B62BDB7AD321944977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439197, "uuid": "10524bdd-115f-4e09-a4f6-ebccb1736342", "value": "1536:AzdMjj1IfmYdnr7HSCp88wBPAgtSw63BFr8:4aj1Iumnr7HJKBrS1/o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439197, "uuid": "35dce885-b76d-4e49-baf9-135aa7b9b031", "value": 56108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439197, "uuid": "c4a6dc4f-d9c7-483a-ae3e-7cf0a470125a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439197, "uuid": "b5ff0201-f419-4ecd-b2e7-d0d564a05599", "value": "2d89525d47aee101a49e9c08aa863495", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79b10692-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713424975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424975, "uuid": "d823921e-0da3-46ca-b8f5-07377aa7e445", "comment": "Malware payload (Mirai)", "value": "0fa749066aef43ba3e452e8e9a9106ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424975, "uuid": "1fadea1b-b529-4c33-ab60-450ddf3df374", "comment": "Malware payload (Mirai)", "value": "884c254dca65f123b0e509355db90f4b16799586904c4bc31cbba31043745f58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424975, "uuid": "ca3b0fac-cb4c-4f91-9963-f073b3962a1c", "comment": "Malware payload (Mirai)", "value": "317434a59da93a1c3386df7bd6c255a2e5053ac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424975, "uuid": "d6152bd7-3e86-4dfa-9181-c5f92006f302", "comment": "Malware payload (Mirai)", "value": "870ba49d585703a22eb81c929bd785c00bc740279be841ee45ddebc169540616c615099c24bcc1de8cc601c260812986", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424975, "uuid": "58bbecb3-b59a-44ee-b0f6-f46cd28633a9", "value": "T1AC6302F860B5E814CAFE993D12AB83F9D9B1748033C08BD65324EC95FF75606B44C5A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424975, "uuid": "e63bbcc3-37a6-45aa-a681-6229ae4f85f1", "value": "1536:uSg3e/Ugbv314tjBhH7/yhQ91Y2ws2V8djpT+1dnXzi/4:e3Ybv3qtjXH2mc2wHV8JB+1Ja4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424975, "uuid": "40401ac2-23e1-4637-ae45-8674477ccca5", "value": 67268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424975, "uuid": "5f374851-8503-424f-b5eb-b39ec7fd3e6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424975, "uuid": "91b1c17e-2bf5-4376-9b97-443e1aeeabc4", "value": "0fa749066aef43ba3e452e8e9a9106ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193a6275-fd43-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713417512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417512, "uuid": "7b8619ad-a91f-49a1-b2b4-7a42863e4b6a", "comment": "Malware payload (AgentTesla)", "value": "f84da9f6698d2eb1981c6a21ac03e3fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417512, "uuid": "a151561f-7d65-4ba3-a9b4-c5232dbf87fe", "comment": "Malware payload (AgentTesla)", "value": "88989d52aae6ee018cab2afb8bfd712a29177ee9e20365d6b228a25828c25ee8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417512, "uuid": "54f6d3b7-1d54-472e-b490-1e3ad39c77d5", "comment": "Malware payload (AgentTesla)", "value": "6559b84832ecf4edb88cd97dc0adc774e84e49d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417512, "uuid": "5cc872ed-d74d-4176-a32b-11573435792c", "comment": "Malware payload (AgentTesla)", "value": "91f5ff1c035b76bd5b7909de68b201f1b6ac0240bc3d2e6e83f3b9517dfa3d05d0eb55798fc0beffa16c65dc6080d002", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417512, "uuid": "de7e3cd4-01a3-4bd6-80d9-e89fb0429757", "value": "T1D7F4232129AD8731E8BD1FFE0465630053BA35672530E38DADE731DE4CA27819F25B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417512, "uuid": "a3bf9568-e991-411e-b9d4-08613c6d1c9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417512, "uuid": "8f82689f-67b5-490a-8c62-723a7dbbb148", "value": "12288:TnfK/pbMxuGgHiuYIiaUSPGFny613x6cYTEWWIPe+/tW3QU7NoLEiOfBds3lPSH1:zfiMNgCfMUSPGg6SXJfPe+/tCNoLEicX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713417512, "uuid": "914d1c6d-9364-423c-b919-28a24682f9f5", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713417512, "uuid": "f262a933-c3b5-4d55-b008-5099d676d6e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417512, "uuid": "5ba30bc9-219b-4551-b4eb-c71bfe1d6592", "value": "SecuriteInfo.com.Win32.PWSX-gen.13503.2707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8cb437-fdb9-11ee-a120-42010a9c002e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1713468309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468309, "uuid": "21dc97a3-3559-4ed9-b66a-318fa1716d4d", "comment": "Malware payload (RemcosRAT)", "value": "29af19382bdeadee6d93b98f354e703d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468309, "uuid": "4e4c3b66-0a91-4433-a8c5-0e6dc27c8adc", "comment": "Malware payload (RemcosRAT)", "value": "8a005601e52341e8aff3c95cf30f4ede6b874d2b7e6ffdb9afda9425733fc5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468309, "uuid": "3cc2a055-3010-425a-97bb-82b6521a2116", "comment": "Malware payload (RemcosRAT)", "value": "3d38885812aa0c910025d86e05287600c745f5c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713468309, "uuid": "81ec90d9-f5cd-4cb2-8ec1-e538f20b456a", "comment": "Malware payload (RemcosRAT)", "value": "610d6b322be97f2870eac69ec6fadf25c1e8f3c688030d657d2f9a671e6d6a1ec4a4d30459a5591f859e006e58ea9ef4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468309, "uuid": "5fe1d5bc-a39c-48cf-a405-dadfceb84827", "value": "T1E1A5AEAED264D02AE332463C6747E3D889FD6DE2681CD70739683184CF756A0760BAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468309, "uuid": "2428c35d-25dd-44b8-acc0-cc026ae1c277", "value": "3693314404800418c83d1170338a8d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468309, "uuid": "22ff6f27-26e1-4c74-b004-01b0572bf18a", "value": "49152:3ARQYxxZrm0UZu0LCi2wcc/Z9L7KtQDSxxZrmh7:3Uxu0UQ0LCccaZ9LU7xuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713468309, "uuid": "3cfe287f-3314-49b9-8da6-2927ffbb5288", "value": 2200064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713468309, "uuid": "d8719878-4474-4e71-9433-a7381f491640", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713468309, "uuid": "a024e1b3-0612-47b8-8270-aee208074001", "value": "29af19382bdeadee6d93b98f354e703d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b2469b-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439303, "uuid": "0aa7a251-d696-4115-8fb4-760ae1e19a7a", "comment": "Malware payload (Mirai)", "value": "313311a54ecc1b2894a8197fef55c3cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439303, "uuid": "4401f516-3de4-4e19-bfd7-01b90ff3b212", "comment": "Malware payload (Mirai)", "value": "8c24710b9a73570bfe4bec3c477ca121a01ceeef41047cae263e86a388cc3be5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439303, "uuid": "0084a976-b281-46d4-8081-e81ae5d0e19c", "comment": "Malware payload (Mirai)", "value": "a28688d08dfe864fdcce446ea48c5c50949970d6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439303, "uuid": "9adb4ee6-f578-4090-9a5d-508a4eb94316", "comment": "Malware payload (Mirai)", "value": "a21cd049a748f92e7d64d2b3cf55e04a03ec3b0f6571601416a85d903218d843508489c85c4b91300a14decc6d1913eb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439303, "uuid": "6ee2bf91-0f98-4afb-8952-98e6f5e1e027", "value": "T181D32944F9814F17C6C212BBFB5D428D772A17E8D2EA71039D206FA1378B96B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439303, "uuid": "8937113e-dbc1-4bd5-8efd-1c03296a1737", "value": "3072:EsLFj0HZd8QDiy3G3vemtFBsJBLsuYbcj6dZ7BjS:3j0HEQDW3veYsJdsu05BW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439303, "uuid": "4b2700d7-14dc-434d-b29b-ac37451eb231", "value": 137448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439303, "uuid": "f8239ad3-fc6d-4d7c-bcfb-a347450fff16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439303, "uuid": "5e9705d6-0e4f-4c32-97ad-eae1f9e98edb", "value": "vlxx.arm-20240418-1121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccde97ee-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470641, "uuid": "419c6ced-08a0-4889-a6d4-dfd898d891c4", "comment": "Malware payload", "value": "b97b1c98df1136c69402fcd867606e62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470641, "uuid": "7ee3af56-1831-4f26-8df7-55b241485fcd", "comment": "Malware payload", "value": "8ca3ec2d976b3acce299ddce2dd87b27be989cd168c6d82703904a828c47368f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470641, "uuid": "38166a8f-d768-4a53-b642-11183d74c73b", "comment": "Malware payload", "value": "3c6d8e070765701b8fbf88dea0309b87c418f2e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470641, "uuid": "40a6f327-d7aa-43c9-9b61-0c997d9aa634", "comment": "Malware payload", "value": "f5474c1e2a4d041f5c1bb52945a22ed674fe2bd9aaa79753d00b8f806e7a288aceef00e0d63f088cb9038d3e9d22441e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470641, "uuid": "e47b734e-f0a8-4e8b-85ac-65599b329368", "value": "T142E34905D7408B57C1E2277AEBDB424933339B54A3D733099A38ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470641, "uuid": "b78d799d-b1ec-4d1f-b66b-0f0c9482d7a5", "value": "3072:ut8iFDKEfFN+Fa+1sWCh7n1erM/9pUMbmQwfCMQiGW:s8iFDLf/+FaNrh7nsrM/9p5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470641, "uuid": "267004d3-76b6-4659-b9b5-18c42d88f117", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470641, "uuid": "caed3a53-998b-46cc-b5f6-de41616cda98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470641, "uuid": "e64c3701-7847-484f-8065-a0256e080843", "value": "b97b1c98df1136c69402fcd867606e62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46789085-fd64-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713431761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431761, "uuid": "1d5a25e2-5b86-4949-822e-156402a01751", "comment": "Malware payload (Formbook)", "value": "3b35eb02919cc28d6faea03c96519504", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431761, "uuid": "843b68e9-ae06-46b2-993e-b3213c9860d2", "comment": "Malware payload (Formbook)", "value": "8f44b390ba295e14b6a18221d7d74acbc1ad2b4440db3380364e9b7964f43670", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431761, "uuid": "ee57ba76-072b-4d8b-ab3e-d7fe0de80b40", "comment": "Malware payload (Formbook)", "value": "66588cd5d127e83379de633e178b288fe3fad794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431761, "uuid": "3ef6918f-e973-4443-a664-4fb5a9c81fe1", "comment": "Malware payload (Formbook)", "value": "b2fafa689f74eeb62db6fd43f4abe86dd8b75801fd0a16e3e4b95d5ca7377abb1d6e54a81598aeb95bedc7d9220312a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431761, "uuid": "617179c9-0ead-4116-acc7-a7790666cb2a", "value": "T13AF4232136A4D751E4BE0FFD0C746290D3B536321462F38C8ED791CE8AA77425B52AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431761, "uuid": "8f571663-bde6-4201-b60c-a33cfd1348db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431761, "uuid": "fbbab609-f00a-4dc1-a81e-890e45e46146", "value": "12288:hCK/pbMrRwwAFua+bT/gUDSXN057FQdMvMOKI4uko5QLaBKJAWnGtMm8WxTlEA3J:hCiMrgeX5S+5xeMp4xoQaWAWGtMm8WxP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431761, "uuid": "262ce9e4-5737-48c7-b077-b0fd745173a2", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431761, "uuid": "ae173791-623c-472a-bca1-e662ac277420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431761, "uuid": "bb386aa8-733e-4cd0-a51e-0a97680c3960", "value": "product11221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cceaf9b1-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713433705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433705, "uuid": "4b42d2de-5763-4b32-bb18-ac29ff8186ab", "comment": "Malware payload (AgentTesla)", "value": "5bfe1ebc62085d30143d7b98a6b3fc88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433705, "uuid": "1867c5f6-cdaf-417b-896a-3aa27b9f1182", "comment": "Malware payload (AgentTesla)", "value": "8f8706853d51e22e8696585ae4b19c82d2f59a42146dfadc93625e6c714a83bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433705, "uuid": "a171bf15-5055-42fb-a529-0bfef4970ca2", "comment": "Malware payload (AgentTesla)", "value": "1a45a88b8666655707971e9ae6a05f3ed62dc5dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433705, "uuid": "2ba8a166-9714-44aa-ab94-c26b009002f9", "comment": "Malware payload (AgentTesla)", "value": "f85a027e28b45da753f962c0141173fa6f2b8ce16a2e5bb6bbe205c4a2fe716eb8642bf726a396a180603707c40e1b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433705, "uuid": "f916957d-d1aa-421a-876c-627b660b101f", "value": "T1082408F0DF0B36199F5B3EDAAC6445924AF88195011638B5AAD807EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433705, "uuid": "20317dcb-8a69-48e2-88e1-d30c84bf63d3", "value": "6144:jYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfWuqY:g2dO2Brc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433705, "uuid": "ebf6162d-7581-4ae9-b62e-cef0eb202a63", "value": 211332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433705, "uuid": "45ca93dd-673e-4e48-b664-a4d9f1a41d8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433705, "uuid": "2abda997-3027-413a-9356-360ed24c626b", "value": "PEDIDO MILWAUKEE 00652024.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ccc704b-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425437, "uuid": "2d96b4c5-0679-4b8c-aecd-f6fc5318c9a3", "comment": "Malware payload (Gafgyt)", "value": "872b6841dd26f2a6cc9036f1032ace65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425437, "uuid": "cdedde88-7281-45ca-a6da-a12e494681a8", "comment": "Malware payload (Gafgyt)", "value": "8f9a9be436f6450ffe84c3ce8ea81996b5d2ce5c05deaeed2f71f50fa26cef29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425437, "uuid": "67ea75a3-63c4-4f63-9b91-c5c11df18ab4", "comment": "Malware payload (Gafgyt)", "value": "888381aee8acc5ded524d46762c9a7bf9d96bbb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425437, "uuid": "c57f9fcf-2669-4db3-9569-d6e134dc3ad8", "comment": "Malware payload (Gafgyt)", "value": "020b40c07fdee3c9f8e3f82cd6e31c4f5fbc032934039db085eeb7a4f74476de5311f67894eecc81a4b048f5047aac9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425437, "uuid": "2ea927d9-5fec-44cc-b8fe-9ac90727dbf2", "value": "T17004E53B67260B23C0E5407011E76633BDB5C7CA30B862D76BE06D9C6F2A9D43592BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425437, "uuid": "00a4beeb-f1ce-4dfd-8f7c-fc34460394b8", "value": "3072:rztMPFGnxxxlqjNM7CQMfKogWphapfzPtJPMPvZy1lfpDm4wABHo9n:rznxwmmtBgWpha5z1JIvZyFDm4wABHoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425437, "uuid": "99daaa16-324a-4d9d-acb7-c4b49d273537", "value": 186316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425437, "uuid": "13f69ee3-34f0-4c2d-b6c4-80385a9a8ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425437, "uuid": "074aaf2d-ecc6-4fc3-aeb5-1ecd842a8aeb", "value": "872b6841dd26f2a6cc9036f1032ace65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d80d33a-fd3b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713414190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414190, "uuid": "2999ed64-5433-44db-83e5-0f8d43e5ec75", "comment": "Malware payload", "value": "8745c960022bcefff65c91a47374a169", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414190, "uuid": "4f7e7f53-b8ee-4dfb-8f98-bb2f32ddeec0", "comment": "Malware payload", "value": "8fd4a4dcbe8b649c8c8cec213352c6da213caaefffc76450efee498e51f63cda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414190, "uuid": "261b597e-b70f-4718-9480-265b4578fb6a", "comment": "Malware payload", "value": "e503dd1b85b17ba61e468890d11f3259e9437b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414190, "uuid": "95c1046b-fd71-4805-b888-5081ff0b8208", "comment": "Malware payload", "value": "e41df18fa0ea5871f942809d2dda7dc110d64cce7e54baac36ece0ec3c3c157ca9adb51af9fc4c9516e49e2a857b8f1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414190, "uuid": "d5b3832c-025e-4b8a-ab49-c96bc8c23803", "value": "T1E9F49E1275D1C072C2732130AAB9EB7156ADFC324A354687B3883A696F742F26E34777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414190, "uuid": "2f073560-89c0-4b77-acbb-2ee003bdd5bd", "value": "213e0a4928f644955b6c40c3acf835d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414190, "uuid": "4c2dfc88-51bf-4152-8230-427ddd8a0cbc", "value": "12288:QNp51L0Z775xs2qnf8PtVXJSLKlK4pKJe5d0nocsxa3k48118t/HY4EErtkTd2h9:WJL0Z/mnet60yocssl8gY4hkTd2hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713414190, "uuid": "fb1fdfbd-bf9b-458b-81dd-d3e1790b1422", "value": 790064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713414190, "uuid": "9c40e55d-fe52-42d2-8500-0d997ebe446d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414190, "uuid": "50d2fa95-e043-4928-93bc-0858f05dd7f3", "value": "SecuriteInfo.com.Trojan.Siggen21.62491.4036.26173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c7e4a7f-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425463, "uuid": "fc17ce9f-1ca4-4854-b1b3-72498b226ae5", "comment": "Malware payload (Mirai)", "value": "9a7767dc42968a69399a63b3e1f152de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425463, "uuid": "0eacf215-e842-4809-af82-57b96b44eeb6", "comment": "Malware payload (Mirai)", "value": "9047c176c693503674546c028deb96006b939de9f87adcecf30294cd0afe9a1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425463, "uuid": "30b27a93-84d9-4b9f-9509-cc2b80b12b7a", "comment": "Malware payload (Mirai)", "value": "c11d44abe6775a62a93f248d5f22a53cca3c6041", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425463, "uuid": "c81aeed9-1fd0-42ba-b196-baa3c136d4eb", "comment": "Malware payload (Mirai)", "value": "f21edfeb2969e42d953a5bee423c95c842da0791f54a23426a8429f797ba5a64b3cb0f758beb6715dfa43d98538e7219", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425463, "uuid": "7e4a9fbe-47c7-4680-ae6b-c5fb9e3144cc", "value": "T103237C76C56AAED4D8488174AC35EE741B93F00983A72EFB1AC584B9404FF78F6093E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425463, "uuid": "1f4933e1-17dc-4509-8dad-6b1662cf7389", "value": "768:Sa7eo4I0edaGHV5wt1FHMHGxOc/LoipLEoCcoA5bpKQz:Sa7wJW15wtFEc/LZpLEo4AjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425463, "uuid": "e24cdb66-dced-404d-a599-f76df6d75fc5", "value": 48980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425463, "uuid": "0e4e127d-b046-4d68-b43d-7d8f0c9e6f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425463, "uuid": "e6f158e9-da75-4dd9-bf40-2514f0b009c9", "value": "9a7767dc42968a69399a63b3e1f152de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabc1bc7-fd25-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713405005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405005, "uuid": "ea760edc-cb16-4603-a012-5de327bd2856", "comment": "Malware payload (Mirai)", "value": "2ee9003241bf69886f48e653f483cc7f", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405005, "uuid": "8f04b7bb-13e7-4cff-83c3-83812c967887", "comment": "Malware payload (Mirai)", "value": "9147282b77d7164a7e41fba802f3f6d1d4a73c435f25a4827d7f61ceb2d658dc", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405005, "uuid": "510d4b7d-791d-4f9a-91cc-5041b21fd341", "comment": "Malware payload (Mirai)", "value": "f17c5945e28d2c48f741e8f896dd57e6ac816f9d", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405005, "uuid": "c9ff9f6d-82a6-4cf3-966b-57ee3c6089a9", "comment": "Malware payload (Mirai)", "value": "58523016b0f8f12e8fc01ee9262ab03a69e1824b30416a55a28f51abda2c12d6a6a0dfa786a2f3152afd72d9d38b33b9", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405005, "uuid": "511e54b6-fcdd-43d3-b9de-647edfcc36bc", "value": "T16FF35C07B5C1C8FEC899C2B44F9AE236DA72F41D5134B1AF37D4EA261E4EE205B2D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405005, "uuid": "6a03a43e-fbb8-49d1-b1aa-19d675379fb8", "value": "3072:NbufE7S5bj+fIM7fENFhk2cRY4QUsQM/xmFd8ch:Nb6MS0YEeNUmzK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713405005, "uuid": "819bd014-be61-4362-9459-56a2d5a23a0a", "value": 159752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713405005, "uuid": "80a2eb57-18d3-4218-a290-bc1b58c1e7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405005, "uuid": "6b6cd83b-6406-45e2-af27-137b41379965", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f607673-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713457492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457492, "uuid": "ab82bdc3-59eb-42d1-ba51-cadd307c0810", "comment": "Malware payload (AgentTesla)", "value": "f060b9400a263bea044a7789ec1d85d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457492, "uuid": "d72c0f8b-7d73-4a85-84e2-af81c6c00c9b", "comment": "Malware payload (AgentTesla)", "value": "921ace6c0f27813fa370b65bcaee79824a4e31920dbdfec7652103c60e84cd23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457492, "uuid": "5dc84877-a122-4373-a5f7-755033723333", "comment": "Malware payload (AgentTesla)", "value": "3e939ea522e4356fbdc15c7e0119366a6369e0c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457492, "uuid": "65be5c3b-a857-467e-a687-bcb1e32479bf", "comment": "Malware payload (AgentTesla)", "value": "ab8d355ead05b208cb35d139ee2c8815030b2ab59a4e316a0c3f6a9e1bdd9d0dc71f3bb8ac99735d0b0a8c82f4526440", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457492, "uuid": "0b351681-49fa-4163-88a8-95acd8291169", "value": "T194E423C5B2B4DB33C38D4D70A163860C2772D9C67611E7FE259A85BB2BF2B2055A0D63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457492, "uuid": "002a26e4-340f-4db0-8564-949b59d4231e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457492, "uuid": "ff955cb7-810c-4830-9203-d9e05dcd53c9", "value": "12288:fH7A3U2WtXkF/gAiCTLY10rcTu0Gm6NHeMdwG+q7Ln2oMIzw4CGDw92kR:UE2OSIUTE14cZ6dp3n2opw/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457492, "uuid": "8776049f-579a-4bcc-8236-0f60c0fcface", "value": 695304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457492, "uuid": "96449572-d8e4-44cc-869f-6b60fdf447b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457492, "uuid": "05261259-f661-4dd3-9dd3-d5c9e4a5e428", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a4b917-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713467114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467114, "uuid": "7807f90a-7349-4e52-a191-ed35b19883c8", "comment": "Malware payload", "value": "5911ffb2e28d06f74c025336a4533440", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467114, "uuid": "f35bd422-d9a7-4acc-9ca7-88f72429e724", "comment": "Malware payload", "value": "934495cf8709d715987ceeb52730438e9fde89955cef793541bc7ffb0845cd0f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467114, "uuid": "24348758-6c23-43bb-9276-d7be8da9a3f5", "comment": "Malware payload", "value": "14769835111811a744f58f8aa479872f11a7fb16", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467114, "uuid": "83df2e7b-e577-41b2-902b-326e34bbaaf5", "comment": "Malware payload", "value": "74b9a83da2424b7b9dd84cd3cb0641df57b5532b4bb40ae72e715ab48e7584408ea8901d4c810c34188200f9c5b2d14e", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467114, "uuid": "125e10b3-383b-402a-b1eb-0ab7af878ae6", "value": "T187118EA2A6E15A16D2E201775A7293E08F35B351F503E72E9440D14E28E484DDCB9B0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467114, "uuid": "1effe0f2-337e-4455-bdd6-9a942cf5019b", "value": "12:8+IvU6s+RL1KXS3I3U7Gj2Sy6MH7JqxlDmIfc2PGnz+76bLlpgkIioVI3VJH7Jmj:8+IvNKXSBm2HbUx4I02Pi+Uz+I3fdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467114, "uuid": "90c012bd-6293-4960-8b3b-6180cd7513cb", "value": 1017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467114, "uuid": "a621f346-f07b-453f-9a9e-eb704dd75d23", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467114, "uuid": "04829ff2-08d9-4bdd-a8c7-d6518f9688dc", "value": "parcel-label_photo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887c252a-fd5d-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1713428865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428865, "uuid": "70f08f2f-d225-401e-929d-d4db2a932bbe", "comment": "Malware payload (RiseProStealer)", "value": "265d5b8b9f603f0f5ef62f2c27449607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428865, "uuid": "bb6fc027-d18d-4630-a510-c264fa5716ce", "comment": "Malware payload (RiseProStealer)", "value": "948d096a3931a22f116b93ffeefb3a374834d8eb578620c0ffc83f3e468eed81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428865, "uuid": "4248bb25-de2c-40d5-aac2-e93df8ee8685", "comment": "Malware payload (RiseProStealer)", "value": "39576d6d8388dea489946141dbccf9cf5fe3a28f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428865, "uuid": "ba1fdccb-48ec-44cd-864e-f132f3367bfd", "comment": "Malware payload (RiseProStealer)", "value": "84112849565e678ca4d507648a86af7d7b64e3f114e9f900e9633fe7a1af06e17c91ae3da87913eb7328142b1525297c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428865, "uuid": "cdd58b4e-b61d-4a6a-af52-a86708dd4131", "value": "T1EF25010277D1A8B1EE734A325E79D6A46A3EFC218E143B7B2B9C1D1F04710A1D672772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428865, "uuid": "197770a0-859b-4857-8224-9099cea8bf80", "value": "3c62679fe3cea3c660b4a0b83c80e478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428865, "uuid": "c3e3c096-331c-4cce-8162-0ad945e4b3d3", "value": "12288:oekLV5eBOkw6Qhe4Yh5wV/uVJuEk6sP4lX8DbDK45dg/bdlh84LZ8Xt8quJsHmrE:on6rhau/OglUbD5yb5LLuXBuJsH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713428865, "uuid": "3552f64c-0131-4d14-8e2e-e4cc8aa00f4f", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713428865, "uuid": "1d3c159e-2972-431a-84b5-395db986fb0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428865, "uuid": "6a80b2e6-3229-4987-aa72-6a588a7a850a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f2ec0e-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433911, "uuid": "c06dd05c-4972-4065-8637-75417dc8edae", "comment": "Malware payload (Formbook)", "value": "272f0c8fedadc092062ad743782b1434", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433911, "uuid": "e50a61e3-df22-496f-9885-858b608444ce", "comment": "Malware payload (Formbook)", "value": "94d61fddb03aabe9c5ffe7ac30b1020023242a9e95ce23d05230b76e4d85f9a7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433911, "uuid": "6e0a98bb-28f9-4bdc-89ad-964bf94717d5", "comment": "Malware payload (Formbook)", "value": "e4502aa04ceb7b65e4bb7f6a7cecc1f36677e69d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433911, "uuid": "79be3891-89e1-46b3-9d91-2d84ef7d023a", "comment": "Malware payload (Formbook)", "value": "0e623aac4d13718de246a41efebde2b3a75b4bf6ec402cbdbd291bf0bc13ea823f2a11f378b494af3632c3b0aaa3b648", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433911, "uuid": "8cac41b5-5c0a-4fec-ad3b-d2a81ccdcb22", "value": "T107543AA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433911, "uuid": "5ce60da2-d0bd-4a8a-8162-4ba44c6cee1c", "value": "6144:L7dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOmR8NAKVwFO:fnS2ImeAFhRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433911, "uuid": "15e3531d-7e2d-4bf9-94b7-8795033488f0", "value": 285354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433911, "uuid": "9dc12930-ce85-4e94-a5c8-083b786dfce2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433911, "uuid": "220bffb5-c0f1-4a7c-a54c-e619847c9230", "value": "RFQ-16042024-2_2403872952 .pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0250569a-fd4c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713421339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421339, "uuid": "16c36325-d601-4977-8314-1b167f774cce", "comment": "Malware payload (AgentTesla)", "value": "9c251bb5726be9313f2487ef39b93253", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421339, "uuid": "f013e6d3-a498-4026-b896-311b35121f7e", "comment": "Malware payload (AgentTesla)", "value": "96917cf7bd76b25e67d9c71c36c8b3055fc8232bd7e522eff573e02011a7bc97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421339, "uuid": "6ff7d436-e516-449a-9fa2-031b10ddf3cc", "comment": "Malware payload (AgentTesla)", "value": "bc30cc8ed2f9dd993917f3ba6f089783b01cf8ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713421339, "uuid": "cdb563f6-8830-4774-8e5e-eed9e1516b68", "comment": "Malware payload (AgentTesla)", "value": "58dc75cff8c2f5d7ac586e382cd685a161fd9426d75f61eafdf6a009454381a410b8490acaee50e47523d2df943baa58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421339, "uuid": "d722282a-cec2-4d3f-87ae-77ebdc5a1221", "value": "T174741211470CA4FED72C16BC256F412B21E4D6AA700BE3C6AF68389FAD173A975336D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421339, "uuid": "6f12beaa-563d-4e48-b60c-a0c3e65f43ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421339, "uuid": "14e49ef4-af37-4af2-b91c-d53187e5b986", "value": "6144:Ozovoe3sqxBJY1yKDcd1XromQrPzna35y5Yvca1:Ozt1qS9YdkupWYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713421339, "uuid": "a4b53f32-f68d-434c-a5bb-2b412e894b54", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713421339, "uuid": "297f98d5-b424-4a8e-bdab-95c209939425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713421339, "uuid": "745a3dd5-3340-4bb5-82f3-4b3cd7421a64", "value": "p silp AI240190.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ba9060-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425421, "uuid": "a3ecde65-ad0b-432e-b7a6-8d4395841628", "comment": "Malware payload (Mirai)", "value": "435524efacb1795b81089ee8f43472a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425421, "uuid": "c0cc1e81-3552-4725-83e9-ae3967360638", "comment": "Malware payload (Mirai)", "value": "96e842da98b7f1596bcc1fb59132173f8c0dde2f6413cc7393e535d84dd6e0f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425421, "uuid": "0d39e0c6-de16-45c4-9dd4-53481028ff4b", "comment": "Malware payload (Mirai)", "value": "67328f73218f033afed8f8cb8a6361154503f7b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425421, "uuid": "b42d9771-f1ef-4fb2-a3c7-9ebc20f9ed46", "comment": "Malware payload (Mirai)", "value": "6e081734e606a04429f7f343fbd669952cc404fa141277424fd220942b9a7a34c4dd7b0ec82f9517ea5b53cd73c3765a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425421, "uuid": "0ab8e77d-c2db-496c-95d0-e121d504613f", "value": "T1C7332B42323C0E5FC5B35670253F96E083FBA96534E4BA88255F9B668A35D3B1089FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425421, "uuid": "9b47d7fe-6299-488d-a988-c34c5d666860", "value": "768:lMn8HKGGU7R5Y0SRRf/RH8T1vsmqzmiMhty0sG2usMmdTBof4X4/:L7mjaT1kmoY9pmdTwyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425421, "uuid": "1e1d82d6-9e0f-4227-b311-7a458b46a03b", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425421, "uuid": "8ceb932b-6d41-48e5-8d6a-879f06fc27de", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425421, "uuid": "18f06473-abb6-45eb-a2e2-b563c170e385", "value": "435524efacb1795b81089ee8f43472a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2faa0608-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470807, "uuid": "240a75bb-c2e6-4e7e-835f-c68f3f7a7612", "comment": "Malware payload", "value": "c87988e35ec34779191f42b6213fdec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470807, "uuid": "91eac808-23fe-4ec0-ade7-b98c14eddd93", "comment": "Malware payload", "value": "96f3ce153153f922fb18e4722b0348aee2c76022bcdee75fadab97023003fe10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470807, "uuid": "01915bf2-a1b6-4e93-b917-e5549efb6d46", "comment": "Malware payload", "value": "81036dcf6ea331243f2d512b8ac9611a95a18ea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470807, "uuid": "34e81726-9199-4511-ac89-6025d11d86a9", "comment": "Malware payload", "value": "4552d137b0ae926febce787b04853daa1a1efae0699d1d7c38246f731e0e6691bc5bbd716a46405571d9c8c6d469bd2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470807, "uuid": "98a9f1d2-cf54-4c1c-9b5a-7348d4027ad9", "value": "T13744AE41E3F1D1B7DAF2063000AA6D2EC7769D249754A8D7CF1839B1DA326D092792FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470807, "uuid": "fa8daa35-1d68-4460-ac8e-9c4bad6d0e4e", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470807, "uuid": "9bc5b1d0-1c71-4441-bdb4-7d4ef3413891", "value": "6144:sBlkZvaF4NTBjWXXn0tHeKMSF0o91TPoEQo:soSWNTRsOBMSF31TgW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470807, "uuid": "6fd56020-60e7-4c9e-a524-2535c3c2008b", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470807, "uuid": "828f6402-4a7a-492e-8e1b-5cd88ce7bfd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470807, "uuid": "a2dd6154-2fed-4fa6-8e78-881195e288a4", "value": "FMLN Ransomware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90db101-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470581, "uuid": "4f447118-7d08-40ce-a59d-5e0c3015049c", "comment": "Malware payload (Mirai)", "value": "3ac3f825b105590f27df06b03de88c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470581, "uuid": "42a6aaae-4d03-4a12-82a6-3a9e5eb8909d", "comment": "Malware payload (Mirai)", "value": "99231f7115dd49b7de112501ea760f9c5f82c109b6c30eba1564f9750bb2bf76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470581, "uuid": "5b556ad1-f2e7-41ff-9415-861a1dec0cc6", "comment": "Malware payload (Mirai)", "value": "677fe5ec5c553b959551d8fbe477cb61762b1637", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470581, "uuid": "dd6e4ead-9d95-4733-9b0a-3d865f98ec3d", "comment": "Malware payload (Mirai)", "value": "b722cdf14ecc3b5b96db37a98ff264fec92a5d480058090a8350a7a40e789ae57fdca9a4181b623764c12ad4eaa8809d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470581, "uuid": "5ed9ea78-6856-475d-b65d-8272d9cabb4e", "value": "T123B3B54DEA64AB29C7E332FFF65912CE322A0B9CB7EA7011DE310B5137C8E565935121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470581, "uuid": "8848a962-f244-4c3d-81a6-eeafd6527b37", "value": "3072:xjzRfyQrSC8Qj507ouTQcBOGovzaAFMxVr:xfX52BHBOGovzHF+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470581, "uuid": "0bf87c3d-7c44-42d4-a259-d5f65c24d197", "value": 116452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470581, "uuid": "1292faf2-e0b3-4a38-848f-cc2ce0d8cf4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470581, "uuid": "6e2b00fc-03af-4335-9ac7-3b4418a2e4ea", "value": "3ac3f825b105590f27df06b03de88c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc06e53-fd25-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713405007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405007, "uuid": "14e706d1-49ac-41d8-a2e2-a2c4a267225a", "comment": "Malware payload", "value": "e7b4850c359b3f0f0533ee006d8f94db", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405007, "uuid": "20ab67d9-8ca6-4e94-87bf-679f3921c72d", "comment": "Malware payload", "value": "9a1e3e788306a30291cab8bf763b78f65ab8c9fc728145ad65cde2ccd0e0c103", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405007, "uuid": "a674c1a8-0273-49f1-b791-d64d0564d91c", "comment": "Malware payload", "value": "bfd586e31122c1502f02db0161bc849490c39737", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405007, "uuid": "0f2bbc63-ac50-462c-adfa-a23df072c850", "comment": "Malware payload", "value": "25f9a8a89d12884e4a61fb66525404e01c71ad0aa59d6e33cf77dcfe92fb19055edada32620d885c4faec66bef715c66", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405007, "uuid": "38fa7861-a7c6-48ed-9616-f8bf4f316014", "value": "T1D0C1124A96D28D2BDCD1233D62DF4F6C7331E88666164727930C98A06E332D55E3374E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405007, "uuid": "ca650a8c-c8ad-4147-b0c0-15c0f1b29a0d", "value": "96:CAXuHBuYrTt/GRURVH/BZQ7zpkAveed0MSc:CSWBuUomVVy0MSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713405007, "uuid": "e1c9d023-4ffd-476e-b2a3-06b4fc49120f", "value": 5677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713405007, "uuid": "e02fbd24-ef1d-403f-9e34-a0f8e2630ed7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405007, "uuid": "040ab084-97b8-4b25-b587-8524ca40a397", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be531bc-fda4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459392, "uuid": "ea38d6ed-97da-4630-a432-620cde8dcbcb", "comment": "Malware payload (Mirai)", "value": "c4f71c7502f67b1ae047875bcd95f491", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459392, "uuid": "8f5bd157-942d-4baa-a598-ea62fdfe6373", "comment": "Malware payload (Mirai)", "value": "9a1fbb3f1d6b568898495316e593a94461d6aff63b112427032663c7618b6522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459392, "uuid": "96b00207-5524-4b4e-a2dd-891678e05f0f", "comment": "Malware payload (Mirai)", "value": "cb4bc785c4c901c3517d1421af147a04b875e39b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459392, "uuid": "9969fe4b-c25b-4060-8276-e649341db4a7", "comment": "Malware payload (Mirai)", "value": "153fad057dce3bad099b7fcd45b141c44ec94bc20d2a2a3093483ff2358d87ca20f692a9ea8a4256b0143d3bd943a339", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459392, "uuid": "9c3716f0-a4d2-4f7a-9e35-e3bebf7b6dd1", "value": "T1A8332B41772C0547D1A26EF0253B27E0E7FBAA9231E8B348390F975A84B1E37A446DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459392, "uuid": "08a3debb-4497-4857-adee-2bd65965dd15", "value": "768:1mlEX7IRI/WtsDIDYx3ZmrFpvfOS9AKBC3NpRKAK3MwzEjBtdPWQPMIxc:wGyNvDAJm5BWS9A7arI9tAoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459392, "uuid": "e7df218d-945f-469a-9360-db87b5ee35e6", "value": 50756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459392, "uuid": "d0dfa560-85f9-411d-b52a-82031cbff8fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459392, "uuid": "a37cfe94-6880-4c5b-aa8a-f4dc32610ba8", "value": "c4f71c7502f67b1ae047875bcd95f491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dacae02-fd65-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713432203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432203, "uuid": "06c8018d-ed63-4ed9-98b3-a4dcaab7e466", "comment": "Malware payload (AgentTesla)", "value": "841929b17d06d403c2e091131d94dc74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432203, "uuid": "5cf9d611-d731-4d05-bdf7-dc7bab761024", "comment": "Malware payload (AgentTesla)", "value": "9b58113a5cd1f82468370a2a42f7273d69139ff2cc609f7e3b98cf105a181524", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432203, "uuid": "d12119bf-93d0-4255-a3b0-99da218f8e99", "comment": "Malware payload (AgentTesla)", "value": "5424d400a35c218577bed7e5bbed0533e6f856a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432203, "uuid": "d4416052-f534-4575-8ba4-721e700b4fe0", "comment": "Malware payload (AgentTesla)", "value": "90db618638f709eff17621b3b74ce58aebb58a18d0e136a10189b51fa8c3fc074a74504e5cbee3abfda9e1d9bdada72b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432203, "uuid": "75da29f3-c215-4b76-9805-9fea86507195", "value": "T18D25E23D1CBD1A3B91B6C2AACFE98567F040D47B3911AD3698D383958346A9379C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432203, "uuid": "3eff5267-9583-4594-b111-084f5788bcde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432203, "uuid": "967d8840-4ad5-4023-85f0-3cfda4d639fc", "value": "12288:4qAYcVJWgIferJLOP2P+0BhPQCFRRHcTndZRRA32dz+OTK93PMxbZK9Nlm:jAYc62rRqCFBLFE7RI2dz+OTk3PMBZ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432203, "uuid": "2d934160-a28b-4fb2-9ddc-744f64ab68a5", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432203, "uuid": "c117fd69-149a-4d4e-abb1-f9d767ff5391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432203, "uuid": "58b210c2-2495-44f9-9dc0-6e630543f7a7", "value": "Doc via Dhl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed9ba5f-fd3b-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713414193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414193, "uuid": "9a135b7f-1631-4829-92f4-74da1e056d7e", "comment": "Malware payload (Loki)", "value": "4758a063f737c4cbd89a8ae27fe51f46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414193, "uuid": "6c7f8e10-9422-4aaa-aa8c-9783e36699f9", "comment": "Malware payload (Loki)", "value": "9b7d88f0ea7556298e0dee39226de3688d8df6d237bfdb6d7ecfa7a8dac85bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414193, "uuid": "5ebf021f-b830-4e16-bd5f-ab6143c33127", "comment": "Malware payload (Loki)", "value": "33a78c132bdfcdcb1d55d26770942f076ff3dec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414193, "uuid": "3f2525c5-4efd-4705-af74-c067e38d7571", "comment": "Malware payload (Loki)", "value": "524f896eff72da760140010285c971c8a8cd94f95911b5a6461263b0608d44f000ad1ca75da8f0c0779462d30d4d7b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414193, "uuid": "5a8f788d-e944-47a2-8dad-54d2593ab5d6", "value": "T18BD412207AA88750E478AFF518B61110E7B2B6621071D34D6EE990CF4AD6FC0E716BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414193, "uuid": "72bcea26-9997-4313-9be9-eb168a2b51e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414193, "uuid": "b179dd95-657c-453c-9d2e-0c04d4bd7587", "value": "12288:4LK/pbMIRwwAFTKySdcGBtF4V4AmlaBJe5YZ4VX2i3QkR:4LiMIgTKyCcYapBpS2i3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713414193, "uuid": "9e409df2-4555-4648-a91b-7db5033996a4", "value": 628232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713414193, "uuid": "33349e65-dea8-4319-a68e-3d2ad41e11bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414193, "uuid": "e4e3e4c3-8545-46de-ace4-78c3b9d503e1", "value": "SecuriteInfo.com.Win32.PWSX-gen.18165.6818", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81477df1-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713431001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431001, "uuid": "8ea44bfd-1892-4e67-8e70-0d93fa7240c2", "comment": "Malware payload (Formbook)", "value": "addc13066aacdb6cdb21ae368bce83d2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431001, "uuid": "0f3e194e-dbfe-450b-b857-b7e9799d5858", "comment": "Malware payload (Formbook)", "value": "9c8fb0ee8d5a21346a7e25567abd4155c543d90a213a40d79269d1c4d3b269be", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431001, "uuid": "c467b944-278f-4dae-97d9-90f3705bf3fa", "comment": "Malware payload (Formbook)", "value": "d4d509e48e946e01605df86bfebf8f4cbc4648f7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431001, "uuid": "f64b2d50-ba3f-43e5-8505-8afefa255ae3", "comment": "Malware payload (Formbook)", "value": "a68caa1ce65f9134c6a1e01dfc17b8654744c030d65e72bd880a7b3c314bfd417d24662d21c5828525af8c6e36127f9b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431001, "uuid": "2dbd6fb9-98d2-4153-860c-57fdfa4556fa", "value": "T12D543BA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431001, "uuid": "2bda1ade-6b93-46a7-b4b4-0ba4da6f7539", "value": "6144:LQdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOKv8vfuaF+j:EnS2Imw1lRpz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431001, "uuid": "ab1e3a4a-6b75-4147-b3e4-f127b1c7e569", "value": 285139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431001, "uuid": "040b8850-01b5-4753-b85d-fcff2ca26a2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431001, "uuid": "56139c09-5b80-45d8-8755-d3594ff59a23", "value": "Arrival Notice PUS_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d402e462-fd50-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713423409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423409, "uuid": "fca2bf72-b14a-401d-8dde-721603e6caea", "comment": "Malware payload (AgentTesla)", "value": "2013f018c60b9968b16c804ed05ba687", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423409, "uuid": "0d5b61ad-8fe1-4988-a828-43e9ce0e2f4f", "comment": "Malware payload (AgentTesla)", "value": "9d6ff255d54b38eda8e11c5c84dac187d4e191efeccab6965b4b26392ca84f43", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423409, "uuid": "5f0c3fa0-4f2c-4dd4-a7d1-de4539494331", "comment": "Malware payload (AgentTesla)", "value": "10f881d3c504617e9ff516cb9afb926edd0d65da", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423409, "uuid": "2d0acbf5-5268-4535-92a9-9ae44071befe", "comment": "Malware payload (AgentTesla)", "value": "a25d3520d3d5976f3120da9100a0fd8f832427b102bff6ae173d6e5786fd57682332ed1918f13e514aab4ebe7d3b6e17", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423409, "uuid": "b76f075e-b9c8-4f75-aa96-2c275743e355", "value": "T11C4423D8EA09C47D77A3AEF55161CB48B0F7B60507225122A43FF1B8B922B67E1D4C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423409, "uuid": "e68bd85e-6a6e-4e6e-b479-dbb29d0dda37", "value": "6144:wjesU7cpY8a7lRxesUp8gKb31dUqSW9BTfOdCi9D47d1/D6ipWZ:wFKcpxKlD68gKIFiy47dJTcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423409, "uuid": "a462a8f0-8f95-4e9b-bf07-9e22f406b136", "value": 271699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423409, "uuid": "dc3abe61-9260-4974-8a6b-d0be42be91c5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423409, "uuid": "0be9692d-f24b-474d-b2a3-8f8572a85ba5", "value": "Leoch-Purchase Order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c0433f-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713430820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430820, "uuid": "efe278c4-e466-4a52-974b-64eaa5f6155f", "comment": "Malware payload (Mirai)", "value": "143739220e3511a29f0622274c0ea575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430820, "uuid": "5fb61021-a00c-4387-b683-4857f28d6e6a", "comment": "Malware payload (Mirai)", "value": "9da63c8fbd118cb004ed3c04f0899c800cb752df178407a561661e14ef72a295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430820, "uuid": "6670ce90-e874-467f-aaca-3ad54f0ce465", "comment": "Malware payload (Mirai)", "value": "8a0f4450ac2b1fa9392203585630a13490bf75ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430820, "uuid": "2e49eb45-8f67-4712-b021-0d211e2e809c", "comment": "Malware payload (Mirai)", "value": "8a0b63f15d01de1bf968c9a0a6c56a81d3915923acf3ba6a4c4ba8bfdec550d88c00c1a7ed97d98074f63f5527411a8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430820, "uuid": "a3a13e73-cb75-4a7f-8796-26f26a386848", "value": "T1F1E2F1A0221569A3F1E02938DA7F4295EF6638F5E549B01D1E588350BAC65407FACF33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430820, "uuid": "ebf3c12e-65ee-4fb1-9c9a-42f3a6a70605", "value": "384:Kvv/RyiWJTT2zZp4gnFx54G3SjkICvxzKRpOA9gMQJ0DvwqxNAnjtd6ZYMBJAhdc:KvcZY4+IG3UBOtMMqIjtdmDa3C9j3UhM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430820, "uuid": "9e06be7f-d630-4591-af43-c6cb2359993f", "value": 33460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430820, "uuid": "08bab759-e769-497a-8ec1-53f1eb0898fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430820, "uuid": "e5658b1e-136b-4ab8-b7fb-4534cb173a12", "value": "143739220e3511a29f0622274c0ea575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46b5a04-fda3-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713459058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459058, "uuid": "e97915bf-b9e6-418f-8821-d86f80941882", "comment": "Malware payload (LummaStealer)", "value": "2627387eb5495186ee3850fdc0b2ebde", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459058, "uuid": "c9ac5f66-3280-4115-9380-67487f3716a9", "comment": "Malware payload (LummaStealer)", "value": "9e86e4796a51e2cae9487ec086aa2159b65a037808e70a0e7dbaf5a946a8801e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459058, "uuid": "b6b310fa-482c-4b0e-a0f2-dc3d8c6ea888", "comment": "Malware payload (LummaStealer)", "value": "8c062c24ad34332f8033a8cac193e4519d3d7534", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459058, "uuid": "78f3f6bc-3e7f-4b49-be6f-5cc012348ac9", "comment": "Malware payload (LummaStealer)", "value": "951f591aa6ed3f974c63d2589956563b3c4cb5452805bbdef8c66750cdb663ae227ae3e71669015dab2d7ee3f14b9c52", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459058, "uuid": "c32a2972-637a-4529-9777-e6bbbfe939b7", "value": "T172A62A47A99694E8C0A9D234856192A1BB21BC58CB313BE33B50FBB47F76BD05F78704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459058, "uuid": "e2e19e3f-bdb2-4a46-b28b-d5483950115c", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459058, "uuid": "f5d2912f-b31f-43b3-9205-7f6931941e06", "value": "49152:jJlStcFBY6j7b7zh0+6XM8i35UPSjVhw4LQOhXbjotS+BYsRKzOmXkcENi5Iq2rY:7SmFWivt8dYw406Lcg+BnY5REuB4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459058, "uuid": "c66b485b-f50f-4a7b-9749-5737d2f084ca", "value": 10361856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459058, "uuid": "fbb32c7e-5ca3-4b49-9af6-cf4c8a0e561b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459058, "uuid": "b13c4f2b-ca4c-447f-90c2-231de10f14b8", "value": "2627387eb5495186ee3850fdc0b2ebde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0626e7f9-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419198, "uuid": "f284c201-4107-4aee-92cc-0a4c46d4f387", "comment": "Malware payload (Mirai)", "value": "b925490f03913c77566629e3e2393e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419198, "uuid": "c0301069-d36a-4ebb-a566-d764b5386bd9", "comment": "Malware payload (Mirai)", "value": "9e8f0f96ec93cb215ed1a180047889840c9170eba97b82db775e5566531ae0f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419198, "uuid": "c8b09672-3df2-4665-bff6-4ea40e469b34", "comment": "Malware payload (Mirai)", "value": "aa41eb009b44b37394a48d285ce4073b44a4f1b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419198, "uuid": "dc53896b-828c-4e4e-897a-324a29477424", "comment": "Malware payload (Mirai)", "value": "01992aee559d59a6978834376735e949b09cd7ac45665da8530263546223291bdf1a910e025a10dec43705ce17ddf3ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419198, "uuid": "6852d56d-c979-4be5-a886-bc9462d0485c", "value": "T178042A46EA404B13C0D627B5F6DF42453333ABA497EB73069628ABF43F8679E4F22505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419198, "uuid": "1f1544b7-9017-4a4c-8cb2-a9c98ca12274", "value": "3072:HK/lcbNbBLbcBCkoajwdyqkk4/T/6EBpZu/hJjogM/RHWT+M:HK/MBLbEloajwdybkwRBzu/XMgM/RHWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419198, "uuid": "c4abd75f-2cd2-4a9d-90ed-d0fa2fd0ebe4", "value": 179805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419198, "uuid": "75a19fb0-3349-48a9-bcb7-fa6df426b031", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419198, "uuid": "0a505634-6c42-4805-8a4e-73271a2031ca", "value": "b925490f03913c77566629e3e2393e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178f28b2-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713434689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434689, "uuid": "d6a31cd5-9e56-4420-bda3-0b7b5a0683bf", "comment": "Malware payload (Loki)", "value": "0457d93e57c05e11cfba910594cd0a23", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434689, "uuid": "2a224b31-baa9-4174-80ff-8d8ac41bf8cf", "comment": "Malware payload (Loki)", "value": "a0d79cea0e610965b7244b1e248553be76a80dda18b210ec2479346d3b8c7416", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434689, "uuid": "e281ceed-2aaa-4ae2-be09-5470b5d89096", "comment": "Malware payload (Loki)", "value": "82506f45a0a9a17138efdd39a9fe11baf64bb1bd", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434689, "uuid": "c3672642-61f2-4994-8dac-e25cec0be902", "comment": "Malware payload (Loki)", "value": "53e30ea693c2828ce7aa2c5a3f75d309b5b130b767c8f9ae683ce1701147a052f7314e15cb1d9277fda45d93a260aa66", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434689, "uuid": "af83ddd0-a510-4a3a-8024-1e2395c60987", "value": "T131D41291FDA8B833CEE51AF71561A23147F361853924CBCE0FC5A0899AE3B1056D47AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434689, "uuid": "c6fe7fe5-0723-4524-9509-a290368f2f82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434689, "uuid": "643c9b84-d17a-4c42-bf97-002cb0ee2a16", "value": "12288:3GL21ILPzg2cWjoIBz7o/fWkLN8INGgp5d8OMXzefJthA6pBkR:WL21ILPzgrAF8BDt0mJ/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434689, "uuid": "9c834ad0-30f0-4b2c-a520-9c170c2da4b4", "value": 606216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434689, "uuid": "cdcd1e45-e0c5-4fcc-a231-468d3f9d20a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434689, "uuid": "eef1dbbc-8aa2-4930-a118-0a297a596538", "value": "DHL_Awb# 129448720998.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a78bad-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425015, "uuid": "dc2f085e-d884-4084-941a-459b86d96f48", "comment": "Malware payload (Mirai)", "value": "e7ece798665893ae13ca8aa5307ec2f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425015, "uuid": "e122aff8-752e-41d6-bea0-1df0fd546888", "comment": "Malware payload (Mirai)", "value": "a21079abdda8dff27911e89186228decf33f7799a2517ae198509e42e73cf441", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425015, "uuid": "d0efc13b-ae5e-4ea3-af31-0f8bbd6b4f4e", "comment": "Malware payload (Mirai)", "value": "db7d2f0a579c141b3c6aaaac3f5b163267dbc606", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425015, "uuid": "69e3a528-4348-429f-a0cb-b448ab8b7224", "comment": "Malware payload (Mirai)", "value": "e33749d48ddf5ed15494d3d48904928877ccf4c724672dfd630a5193275c4d60948815446a3c895d4921daa43e36770b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425015, "uuid": "c02bb14e-b3c0-4e42-aacc-2a37f779ba16", "value": "T111B31A86BC419B25C5E116BAFE1E52CD33131F78E3DA32029D15AF307BEA91A0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425015, "uuid": "bcd3aa7a-b892-49de-9f5d-cab4d4d83f12", "value": "1536:6GnpjmJExmRHgsG5zbSFchUvAWP62myrnBOCYJduTG/7wO0iMVkTRMfNM3WRcxLl:pjGx1d6NBtTRMf63lJByp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425015, "uuid": "e5fac776-4a26-4a16-a4ea-5259aabc4ee7", "value": 115656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425015, "uuid": "765fd845-4cac-4cb7-8973-c41dcdc2d978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425015, "uuid": "021bff56-79e5-49ab-a78c-1efd7ee32b8a", "value": "e7ece798665893ae13ca8aa5307ec2f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958fda1e-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713427599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427599, "uuid": "9a51c3a7-127b-46aa-a199-a34b607acb10", "comment": "Malware payload", "value": "5dfcc06c05b7c2f76fb32738540081ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427599, "uuid": "67828906-9bcd-47c7-8c19-5babd4922476", "comment": "Malware payload", "value": "a2709d0addd76607120189fc09f05180f16cbd53e9976732bab3c0f1a4f75f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427599, "uuid": "f6b059aa-d519-4e07-837a-f7f28141c92e", "comment": "Malware payload", "value": "e8fe6502f47bed0f6eb3e8048091e308fb5a9be1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427599, "uuid": "549d4a0e-7314-4e7b-b871-499e8d3051b5", "comment": "Malware payload", "value": "3e0bfa9f5bc28edd969adef6ba5d08e3e088d4a03f13727291399a482b8ab66301b72efebddeb8e8804b285d5b91f8c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427599, "uuid": "3dbe8397-3752-4893-bc15-87cd7126bc3b", "value": "T1C2346357EEC1B016DD3298BD96594B34B144EC3BB9E02313BEE4F21D5A3AA01DC472A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427599, "uuid": "10500597-8c4d-4664-803c-7ef5dcb68ba0", "value": "f10e4da994053bf80c20cee985b32e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427599, "uuid": "cf700709-0c80-4c0a-9cf9-60aeb3cad336", "value": "3072:LdwWsF1XDWLAlcYZM4n99drfQfnhfzf+TPZdi:LPs/fJj2hfzfuhc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427599, "uuid": "a8217949-56e9-4510-86e5-0fe550eefadc", "value": 233509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427599, "uuid": "7ee86706-eabe-44b7-a1ad-08a0a443cbad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427599, "uuid": "1cbdd6bd-dc74-4b07-b6b9-ccd81db7daa3", "value": "5dfcc06c05b7c2f76fb32738540081ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3759bfc-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470652, "uuid": "3f2b4258-ad73-41b0-9195-1e8f119ea514", "comment": "Malware payload (Mirai)", "value": "23d4f4c2a4676889d08dc0309274067d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470652, "uuid": "b0fbe89b-b8a1-405e-a7dc-eacc8d56ff19", "comment": "Malware payload (Mirai)", "value": "a29c5bd37a6f6eb86babde27589419e0009b153e266a7f43fa7a1d7f2a88cfad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470652, "uuid": "06333853-d56e-45ac-adcf-930edb518d1f", "comment": "Malware payload (Mirai)", "value": "102873e898c59c07a6c4756aefa31a28d2e52fd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470652, "uuid": "600cfea9-d70f-4f70-ac91-c5656d434ae0", "comment": "Malware payload (Mirai)", "value": "9025fbf20b518d4e4ead3c0fa3a37a5ba5134742432e5b701f9c1c8030f1ccd3290d7167bdcec65564f0c05209174b95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470652, "uuid": "ca09dc45-9383-4983-aae9-9142da378513", "value": "T1456339D7F401C97EFC4AEA364C534E18B131F2644F930E679657BA7BE925098192FC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470652, "uuid": "85bcdc3b-ea9e-4ad6-bb20-cf52f3a3cd07", "value": "1536:1Dquso2rv2U4XJIogCdcX8cT81H6mQeuacWjcW0JcWcBekEMTPBh89rS773:JnE0QWcX86mQeuacWjcW0JcWcB/EM3s2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470652, "uuid": "ec4bf4da-3316-4b66-abf1-79dacfa36377", "value": 71036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470652, "uuid": "b0b9e634-0c24-47eb-8d6a-827b8e60919e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470652, "uuid": "6a896873-4da4-400d-853a-10d81856da65", "value": "23d4f4c2a4676889d08dc0309274067d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339b7c59-fd2b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713407248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407248, "uuid": "a1315e3b-1c2f-4d52-be86-64f1b897ff2d", "comment": "Malware payload", "value": "3f44d20c542fa8ad9e3291be2f9b1397", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407248, "uuid": "67028bec-3df4-4b3a-8096-c9b685495786", "comment": "Malware payload", "value": "a30c23132e3c9fb91bc3845d2c63eeaf1a9089e8c198357a023aeb0fb44be2aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407248, "uuid": "9b85fb32-f3c2-40b2-a909-51bd7a166f3c", "comment": "Malware payload", "value": "a374e3ccb1492d11de782d7993ba5c39cb3c185f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407248, "uuid": "9925ac72-6b2e-4fc9-9a96-63578a28cd83", "comment": "Malware payload", "value": "cffdbfaefa8daac15cec0a2c2c7e49bdf77aa5dca88ba68843a35073f942b3098eef915091de6020e8ff202b4f212147", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407248, "uuid": "3a47af5f-f8bf-4fa8-95d2-f6f5b5095be4", "value": "T1598423F0DCE196E6D26CB87634537325637CE611AA08482A5DD15ACB4A2302DFE3BF1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407248, "uuid": "aec67b62-18ed-4f99-ae51-07657082c751", "value": "5318cd03ef5b5da86800f1483484cfd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407248, "uuid": "3862bdd7-b94b-46cf-9220-ef87db94a813", "value": "12288:xPVEtuySIj8sEtb6QMSH0uX3vD3pPp5GkmVc9iTtP99i:xS1hGs1G3Jp5GbVsgb9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713407248, "uuid": "75525589-8234-4faa-9099-4dcbc5baf956", "value": 405823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713407248, "uuid": "ce7f6fb5-1799-480c-a02d-e21ffcc87338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407248, "uuid": "b65f8176-3b51-478e-a57e-44daa5959fb5", "value": "SecuriteInfo.com.Trojan.Inject2.3080.11920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b479c1-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713466895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466895, "uuid": "34898da5-7814-46bc-a2f6-e18681fff566", "comment": "Malware payload (GuLoader)", "value": "2ea61e83ee687b29c058279893e1df8c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466895, "uuid": "e2850834-9694-4988-8fdb-46706cdc077c", "comment": "Malware payload (GuLoader)", "value": "a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466895, "uuid": "e63441c4-c0fb-48c6-bd52-9700b8f91c26", "comment": "Malware payload (GuLoader)", "value": "0c6fc46e4a0bf4c62a5cd2e263313e82f2977a50", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466895, "uuid": "b696f54b-b455-4990-bea6-1b61b1ed2f75", "comment": "Malware payload (GuLoader)", "value": "828bbe98d1790cb229ef2c5db27df77d505b86d71d9f2b8187b0bc761297c1b068f13a93381730f77c524024e1c0f980", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466895, "uuid": "f94ef979-902b-45cd-ae53-c3351577cf5f", "value": "T186145CA0DEC922384F471BEAFC650561C9FC8169462610BDFACD275D6103E6CE3FEA19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466895, "uuid": "5ef2a591-38ca-4911-91af-b814bd0c3830", "value": "3072:2vU8jq6KK8ccABOwbDS2y2zJETxUuoHh38zH/O4SCvewvB7wrsCREBJo5mFSar+c:J6R8ccABOwbDA2zJETxVu1iH/GsW3EBB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466895, "uuid": "1fff1c0e-6a82-41fb-9e39-20fd6b97c7ed", "value": 192338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466895, "uuid": "db8f7e9d-523b-44f7-aa43-4f8ef459260f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466895, "uuid": "a82fda2b-2c23-4ec9-b1d1-3f7f5e710169", "value": "PO_La-Tanerie04180240124.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fafd05-fdc5-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1713473494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473494, "uuid": "c46cfde3-e30f-4666-9a3e-e0bc98348575", "comment": "Malware payload (Socks5Systemz)", "value": "f1d29fddb47e42d7dbf2cf42ba36cc72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473494, "uuid": "6ea81d0e-7075-4553-a546-2fb3ea6d3a45", "comment": "Malware payload (Socks5Systemz)", "value": "a50431ef857f65eb57d4418d917b25307371dd2612c045c0d34f78cea631996c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473494, "uuid": "b7c12829-8405-46cf-9872-58c02208c3ab", "comment": "Malware payload (Socks5Systemz)", "value": "95be0248f53891aa5abecc498af5c3c98b532ba6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713473494, "uuid": "81626584-3450-494b-867a-ee2c1ad2b9b9", "comment": "Malware payload (Socks5Systemz)", "value": "b190e32e95ce01dd542463cd26a29750c27ac3d927afffb9816cdc4892cd5f9ddefbff74f0a447fe4fd8adc4b40f7b07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473494, "uuid": "d2082e70-dc6c-4b56-95b9-55870db19c4d", "value": "T1071633014E3BED7BC82155FB975F5122ADE17E32627E1010A1AE4A0C4B463AD8D79FCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473494, "uuid": "413d66c5-ec3a-4460-839f-d1d431a9eaa0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473494, "uuid": "cc28b496-5af1-4763-a20e-86e0e86df167", "value": "98304:7aBtuktfhEkNB30u1j+CLCCM3/z2m44L1l0Tbkd:9kQlubbM3/fP1yHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713473494, "uuid": "067e2920-9f66-41a9-bc70-1bab8cdf08d8", "value": 4066205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713473494, "uuid": "1374e585-6487-4638-8e9f-cd9b9e21151b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713473494, "uuid": "2aaa1aef-4264-4927-b692-cc9eed10dd90", "value": "f1d29fddb47e42d7dbf2cf42ba36cc72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a7ff05-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433686, "uuid": "432d0353-4e0f-4a2c-84bd-9527984e239f", "comment": "Malware payload (GuLoader)", "value": "881f0892d33291aec64ee24eecd688c8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433686, "uuid": "95626516-8371-4350-92e7-733f3491a0b1", "comment": "Malware payload (GuLoader)", "value": "a54f088c60a0119468c0d9f54ce971826ad8d4ecdc579e1f7f1488caba0b6ca7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433686, "uuid": "b03b6d80-d982-4bed-b544-3741c34039a2", "comment": "Malware payload (GuLoader)", "value": "8fab76574605c4e2ad1b6ec17f6b08d902ceabc5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433686, "uuid": "38784986-1639-46a5-afc5-e5e5ca973e77", "comment": "Malware payload (GuLoader)", "value": "0287022dd3e74e2ef922c00e6cfe5f66808c4ff5864afd04710b21f570961bb968a906edb0073ab363b4dd6706d874a8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433686, "uuid": "bba79b74-70fe-4799-a49b-f4ba51b11196", "value": "T1562407F0DF0B36199F4B3EDAAC6449824AF48195051638B5AAD807EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433686, "uuid": "1297ae25-7fdd-4df0-a7f7-8455fc137ad7", "value": "6144:IYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfKqzH:x2dOFSk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433686, "uuid": "b22d5cb0-326b-4835-b7fd-5836120a23d5", "value": 211200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433686, "uuid": "2d4e93a1-5d0e-41a2-b6b7-57206289ff12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433686, "uuid": "9ee6b935-290b-4e8b-82b0-89d773784037", "value": "Hsbc009873042024-pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06058d2-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450837, "uuid": "19ebf0ff-c2ee-4936-a475-90a3bd2799c5", "comment": "Malware payload (Mirai)", "value": "e035f3798d67973101b3b31c2c9d6eb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450837, "uuid": "91e1fb2f-2d38-4112-95b3-c25e093a3ca4", "comment": "Malware payload (Mirai)", "value": "a60b59063612dcf8a1d804b07556b29afb7f44146cf9844faa25906d720eb229", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450837, "uuid": "4fab65fa-ffc3-481c-a76a-7e5f56a8fb41", "comment": "Malware payload (Mirai)", "value": "9146540b794357a8e13478b2569be9ab4298c5a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450837, "uuid": "afaa4936-cbda-4f6c-95ab-d1e8fe6fea90", "comment": "Malware payload (Mirai)", "value": "8350b86dd37b03ae1c1afb301fa3eab7bdf21a265010723a6bbc6bcd9e9d78cdb83ced8fa714e95f011b3173316a3f24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450837, "uuid": "e805b0a4-9d86-4a1c-b9f0-d110a2c246d3", "value": "T171C31945FC415B13C6C212B7FB5E428D3B2A17A8D3EE72039D256F61378796B0E36A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450837, "uuid": "2505c8ce-1c19-49a0-bc6b-577347bca4a3", "value": "1536:Jtv+s43G5bUWk9RA0Sh71QAFMxK4VIGUT2yFyFO/ukA46n7tVlYm+wyw1FrR7LVx:jv+XQORbg71QNE43UqyFyFOu467Q4Hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450837, "uuid": "68c3488e-c916-4a5b-ad68-de513aa4e132", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450837, "uuid": "7857bfbb-8f03-42f3-8361-1eb724faa232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450837, "uuid": "ad43f5c4-06a9-47df-8f68-94932d71a973", "value": "e035f3798d67973101b3b31c2c9d6eb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d51b87e-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470991, "uuid": "246ce801-f13f-4285-8c0f-8e2cf987df94", "comment": "Malware payload (Mirai)", "value": "ee93b4a0e808606be2a76907a5bb7c3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470991, "uuid": "c255c83f-4a13-4fbe-99ae-9131198891a5", "comment": "Malware payload (Mirai)", "value": "a6ec86bd23962654c0c8dc4111185d0cab44d5d08fbfd941cd51d9dbb3e2220f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470991, "uuid": "9154e80e-ede8-417d-932f-6fa6344d1a99", "comment": "Malware payload (Mirai)", "value": "a7c493d7387e59d0045b0de3dc63f2e18190a8dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470991, "uuid": "7a260d32-eabd-42f6-997e-dca1ed0300dd", "comment": "Malware payload (Mirai)", "value": "96a83195543c20499dadf45d6015f6b01525a0cdeecbe2befaca81c0856b543e192bb992b160755ea366434daf108427", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470991, "uuid": "6e15ae52-d80b-4cf4-8af2-cd7d4d598316", "value": "T1C0242A6276781B26C4E0A43D51FB976EF2FA078928A4C20F7E614D4EBF549B032532F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470991, "uuid": "695e457d-5d03-4228-baee-aa0f33f443e5", "value": "1536:yV59KgpHGxjB3LSkum9ioxLEBzMXSHztRf:yVntHAOK9iaIBlztp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470991, "uuid": "22d95276-a62a-414e-a5b7-a7da65f438bd", "value": 213628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470991, "uuid": "9134b534-dfd8-4951-9205-f2134a005576", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470991, "uuid": "ff7dd841-4654-4c7a-8eb8-5e2a3d24e945", "value": "ee93b4a0e808606be2a76907a5bb7c3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a6509e-fd5c-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713428589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428589, "uuid": "68683b3e-c1b4-4106-96b2-2a28296952d3", "comment": "Malware payload (AgentTesla)", "value": "3f16e37bb0dae4c27fafd5b22358e0d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428589, "uuid": "ea9c9d0a-10e3-4810-a8f4-5d5b720967e1", "comment": "Malware payload (AgentTesla)", "value": "a75670c0494c5531412a0bccfded6d785ab1021e0c0dc08362471ab7692d6a09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428589, "uuid": "89341f87-0c85-4bb6-85e2-0918e736d66a", "comment": "Malware payload (AgentTesla)", "value": "67fc007e685204c51041771bda8f53410a9873e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428589, "uuid": "a0307401-2172-4432-91e0-83161d3dd7cd", "comment": "Malware payload (AgentTesla)", "value": "0826c8cfcdc0e6571bcbad9345187a6d5291af2153a95a027545500c71b871d99a62e63a9679e7374fb837e2666a5d01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428589, "uuid": "687fe29b-e6ba-4e6c-9648-20b35748051a", "value": "T1F20533E82C5FF95BFF8E944380A4123E1750B0EF6C2612AA9C2659C49AFD9400DE77B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428589, "uuid": "c2876160-dfb5-4400-a2ec-282f860352cf", "value": "24576:sXfVYHbAsP7sxRta+dIjgT/gdzBGTZjKpsXErahg:aVRBRNdIY/9TNKiAaa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713428589, "uuid": "d53acea2-3db1-4a0b-b9a9-130e2827e005", "value": 847670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713428589, "uuid": "480f8de8-d2ec-4f5b-b33c-2941a87108ef", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428589, "uuid": "30799586-8428-45fd-b099-7eb6638beaa2", "value": "I-IN-6757165752-DEL983527_20240416074318.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ee077f-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466440, "uuid": "293a8ff3-1333-4035-9bd3-baf8ef2cb017", "comment": "Malware payload (Mirai)", "value": "27a068ce51588c47515b51144098e27c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466440, "uuid": "0f6b02d7-6917-4d8c-b65a-c97c72def3ff", "comment": "Malware payload (Mirai)", "value": "a786d58137e50153fdb80c8c47432d1d50bb2e2b2adb4debfa1f7a318c6f339e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466440, "uuid": "30d2abe5-468e-4262-a9d2-b86d832bd318", "comment": "Malware payload (Mirai)", "value": "5fc38e0d5a2e8a43bf88e511685a8ca05c899c3c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466440, "uuid": "e48160a6-b587-4fde-9055-4c3d3556f16e", "comment": "Malware payload (Mirai)", "value": "5a78f2cd420b2768e8de5e66a21a5077304881f70da6181a3a48aafcdb2f55c81d5ffac7d6788de0653194ac534a54a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466440, "uuid": "11fdb65f-0db9-432a-af33-71f1ed65c6d1", "value": "T19D04861E6A228F7DF6AC873047B74E20976D23D617E1D684E1ACC5105F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466440, "uuid": "8402c446-7a4e-4935-a42f-d76a66d2b4ad", "value": "1536:8f/8ANwxlq37wW+aff238a4EonKya16QmXVMOUtPO3L3Y5kdDsg/EjCUr7bx77hP:8XFNylePtoMMtFkNseUv8OCwjJR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466440, "uuid": "94ebbb5d-ef4a-4ec2-822b-b86bf012774e", "value": 189712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466440, "uuid": "eebda193-b326-45f9-beb8-71b8d6b7eee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466440, "uuid": "3c8fe331-ca89-4645-8668-23f87d2e8c47", "value": "vlxx.mips-20240418-1853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd21132f-fddb-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713483070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483070, "uuid": "82ab6207-5391-4253-b587-30f4f5239cbe", "comment": "Malware payload", "value": "180e97a753b38a75031487130f0f33fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483070, "uuid": "e09fdab0-fb90-41f7-bdb1-dc2a3fa67616", "comment": "Malware payload", "value": "a7bb98097d03e4038ddf04cc17954b7a66e29f0f66f9c7b75821776fe80cf13b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483070, "uuid": "f720d0b8-afe7-4720-8397-3b1932c61a25", "comment": "Malware payload", "value": "d5b3e1a7806b95a88db68846604d780066f464fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483070, "uuid": "035d2ddc-7fb7-4f3c-b38a-6c987a69148d", "comment": "Malware payload", "value": "19d8ecdd23aba33182246b90be233f30c14aaa1f4e701ccf4dffee6da75a6222e7cd7d6b5d6ec4fbb30bb32bbe306c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483070, "uuid": "ededa45a-12b1-4f1d-a7e0-bbd049a52770", "value": "T16AF423507F831C1FD0AC097939ACF73EB2EC2094B2119C97F5CF62A075E299B3265A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483070, "uuid": "38b0e7da-bacf-4cda-8191-febe56982a45", "value": "267c593aa72d8bb28f1c513170712d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483070, "uuid": "592f1d0b-1784-4f1d-8cce-3441ab5ebf77", "value": "12288:lcVdS+vV/j6jqaSGbZ6fXr9iOi+DwPudidLSaGsi93GOAxaBokQ:lcVdScVb6jqHNEOi0066LXElMcok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713483070, "uuid": "cd1aec2f-9a84-4ebe-9043-c066333a1a3b", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713483070, "uuid": "c61c1e3b-73a9-499a-be74-43045eed04f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483070, "uuid": "c1135676-d3bc-4182-a8dd-692b27952dd6", "value": "SecuriteInfo.com.Trojan.KillProc2.23108.29569.31585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c316036c-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713433688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433688, "uuid": "d91bc178-9e01-47b5-817f-b9e0c0fe8403", "comment": "Malware payload", "value": "3043a787914f10bda1a56829e76ac43c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433688, "uuid": "6ad76c9f-3c6f-421b-bcc5-0c5e215679c1", "comment": "Malware payload", "value": "aac4537caa1611c913a0081d6dd930e548ab3cc3798c5da215db0509b87914ea", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433688, "uuid": "4f603af0-6054-49fd-806e-e22cf03a9eb1", "comment": "Malware payload", "value": "bed17b2d644f93f8d9c2eb2b703da482fe9775d1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433688, "uuid": "b769d284-974b-47d9-a0dc-c32afadc414e", "comment": "Malware payload", "value": "d47b5954ea502b2ceffa56d361e3195d012e491a33caf16c6d46ab08a9dbbf454916b2fb47037d37f42f40383ba609fd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433688, "uuid": "7b43c2d8-8c73-477e-80d6-145f079e3a4e", "value": "T127946D60EE68065A0E4B279EFC911A92C5BCC219462710B6FEDD074E610B5ECE3FE71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433688, "uuid": "0f2cc2c0-2337-4bb1-b2d9-ca5df191a6b9", "value": "6144:ltrc0iH9QXg0Im+pUBFcWtBVkmMt9HRYyY8FD3VGcBXMVG:lFidQ0wbzgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433688, "uuid": "3c26edaa-c5c4-41ff-83c2-9563746b392c", "value": 412949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433688, "uuid": "7e80fda1-7148-4020-a9e6-75c4c803ac49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433688, "uuid": "3d2fed84-aad4-4920-a303-94f95119b351", "value": "SWIFT_DOCUMENTS_CONFIRM_ADVICE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4126f801-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433900, "uuid": "bd43254c-83db-44f7-be56-9e3f9572d810", "comment": "Malware payload (Formbook)", "value": "d105cc608069a83a5e4a5a9589e9120d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433900, "uuid": "f29af756-0d0e-494d-8ff1-15d509b62b8d", "comment": "Malware payload (Formbook)", "value": "aae1fbf3b67c937e79df2f39403c2482609b52de86736a64ac10035f6d86a367", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433900, "uuid": "d9216e2e-bee9-41cf-b974-d1dfc17881dd", "comment": "Malware payload (Formbook)", "value": "badaffc05f8e60473e673bfde242faac26af06cc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433900, "uuid": "b23bf2ea-6b4c-4559-aa2d-9f4b955cc1f7", "comment": "Malware payload (Formbook)", "value": "e54a3103e4254e69f14c06af80e22b85b096eaa8f2879d61bc385ac727c4bbdbf4a1b29e304303aa11a908e9ac68c60d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433900, "uuid": "ab69b846-301f-45e8-a98d-c125a03a7a2c", "value": "T1CDB3BD1267FB1208F5F7AB48A97611340B37BD99A97DC64C05CC295E1FF3A808825BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433900, "uuid": "5f9ba795-c8ec-4e96-ab96-cbfe9f512de7", "value": "1536:KzV0jKGrJ8z+U1lBHFcJUJI+YZb5bJ9Gmgz/+rtfRDFqGb5uJZUU0tKl9CP8Z:KzIKIJ8z+U1DHFUGmgURDFBe0tKl9CP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433900, "uuid": "e37b369d-b5bd-4990-87ab-7fea543b613e", "value": 115098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433900, "uuid": "5118de2f-cab7-4d7b-a9ff-d34192aadad8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433900, "uuid": "17d6d801-3088-44d7-948a-f98aafbec848", "value": "Payment Advice for Invoice 2024 0904.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea68524f-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713427741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427741, "uuid": "1f1c47e4-e1aa-45f3-9e97-b8dc48471e34", "comment": "Malware payload (Formbook)", "value": "bfd7010ffde0b0999735a27223423630", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427741, "uuid": "8aa70937-8e12-43fd-8205-a768209c447e", "comment": "Malware payload (Formbook)", "value": "aafd60bfa2caff0b6619f41051994104031993beea57644aea828abe34e3ce02", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427741, "uuid": "b693089b-36fe-48cc-9a6c-4e0fccf455b9", "comment": "Malware payload (Formbook)", "value": "ee935964369110e57c9aeba130ac10f19be2c818", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427741, "uuid": "74c498ab-74ac-48bc-bfd6-f6afdc164256", "comment": "Malware payload (Formbook)", "value": "8e88566569364914491434eeb920b44cfb7313139ab98a952f181e423891c3438862fc9ed3dd0c36de5c0740112f57ba", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427741, "uuid": "1341eaff-2a58-43a0-a9ae-907a6c9442f0", "value": "T15374372AD34E0269CB920373AB1B1E94A6FDBB3AB39051A1341C433533DDC7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427741, "uuid": "84ef97e9-86d6-45dc-839b-441f00035435", "value": "3072:osXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEKEOszdc:pKMeKMeKMeKMeKMeKM8Oszy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427741, "uuid": "3c2be82f-fedb-4e78-aa6a-323f8d26a80b", "value": 338514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427741, "uuid": "ecfd8abf-32e2-4bfb-8744-fcde9219d639", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427741, "uuid": "8da63ff3-d38c-46a4-b2c1-6be433baabd0", "value": "Payroll_Salary_Update.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5562465e-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434793, "uuid": "bcb99c8c-ed86-4ce8-8ebf-91c2ce254694", "comment": "Malware payload (AgentTesla)", "value": "6f96aba54ea08f823a90e051928cff11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434793, "uuid": "6955cbd4-28a6-44a8-8499-071e96d86f19", "comment": "Malware payload (AgentTesla)", "value": "ab6799b9abcfccd9d1813d07d83b325737221cf242126ad0918c2b84cc16c815", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434793, "uuid": "d4a30fda-b140-4ef4-ae5d-383a33a1f7bb", "comment": "Malware payload (AgentTesla)", "value": "7b096da6663eb1ec9509117fc41212766b1f0d61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434793, "uuid": "8c24b60c-1e10-4041-b23d-48f76ee25095", "comment": "Malware payload (AgentTesla)", "value": "734fe990fb0a7fbd58596c0096dfe581f18f26de3bea2efb3397faaa68928c7c5a577821f27cc01c474a29b2ba30866d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434793, "uuid": "2a750db1-b751-48ec-bc49-2f35fede28a0", "value": "T1535533A8DA1597DFDF6D317D2FEC92B6A12FEF07AF449D405802D10894DFA820C89B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434793, "uuid": "09daf037-b49f-4970-bb2a-c0474217311d", "value": "24576:3i4bUj5hLtI+QfHAsK8e0xTpkOk/Dk0KGf/9L8K98qiB9MDztJirnH6R+OMK1sUj:3i4bUHLO+QIx8eCk/DXdLSvB9MDjirnE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434793, "uuid": "08731097-1323-432d-959b-df0b4b99118a", "value": 1338362, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434793, "uuid": "9f762727-fd59-407e-a4b4-5730e6e69690", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434793, "uuid": "e7971ef6-55ca-4f8a-a660-999bece48f3d", "value": "TransactionSummary_910020049836765_110424045239.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79dda314-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713433565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433565, "uuid": "7f328916-de48-4329-aca6-5b44c64f4436", "comment": "Malware payload (LummaStealer)", "value": "4f51306f0eefb7e09c18243cef738560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433565, "uuid": "5aba9f73-5a64-4632-8329-ed6773c64379", "comment": "Malware payload (LummaStealer)", "value": "acab94050ce3e61fb227467c5b3c1cf22bc2956fa81399f68876bc4236458d4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433565, "uuid": "cfc77689-c291-4261-8d1c-3cf290257773", "comment": "Malware payload (LummaStealer)", "value": "3670045354492c36ca99093e9383215dd9742569", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433565, "uuid": "2ba9e9b5-00d3-41ba-87a2-09e312081b97", "comment": "Malware payload (LummaStealer)", "value": "135ce53e0a3833cbbf4bdeed692e19218bc46b0964584bc23c33076b9a03fa566c2a4cdb855b4db6414e713e75cacd76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433565, "uuid": "1bb671b7-5c15-4122-b249-4c6c389d0805", "value": "T11794BF03B2D1A870E63347325E6DB7A4653EFC614E556B3BB3485E1F09B10A0DAB2772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433565, "uuid": "51f3e0a8-7cdc-4c13-a7cc-1af20ee6a586", "value": "3c62679fe3cea3c660b4a0b83c80e478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433565, "uuid": "4bd8a46b-77bd-4866-ab24-608c7454ad25", "value": "6144:99bFEK5pwdfP4PMQnThNkRcqyvx7y3bNo0c4xWtOm8O:9lFEFd3qNkRcFGoZ4xWtOmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433565, "uuid": "13f94102-7faa-4689-bdaf-3494d2e54f94", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433565, "uuid": "9cab73ef-f803-4dc4-ae04-7acd35612794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433565, "uuid": "de489559-2d9d-4540-8eb0-2997a124cd7f", "value": "4f51306f0eefb7e09c18243cef738560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c1bfa2-fd5b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713428059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428059, "uuid": "61ac2fbf-adf9-4630-9487-c092689e7102", "comment": "Malware payload", "value": "68eb04e4cb5b8b7bee600c05dfaaf81c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428059, "uuid": "524a0e87-296c-4041-96e8-80bd4e1a7fe4", "comment": "Malware payload", "value": "ad0a11b87b468cbd4d9555d4f845e9256370ff631f7cafc063d6e0a59e98c777", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428059, "uuid": "3b542bd9-c799-45f2-9c24-fa83b63e083f", "comment": "Malware payload", "value": "7323f2f13981031c0d16d3f4e61fed9bb126f304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713428059, "uuid": "4c6a146e-8037-4895-8b2f-d6453c2a5d56", "comment": "Malware payload", "value": "9fa759eb707ed9eefc3683398eecd5a8b09708204dff5a5f65cb3349f526180c6564930af5cc76a39ebbaa8018985a7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428059, "uuid": "e0ba037a-3db0-4f0f-bed6-665353039bda", "value": "T11167CF7791067CE9E9A94DB4841015816D787C874B78A3C7BAC8B1F66AFB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428059, "uuid": "1bf3fad7-f682-45fc-9187-97dfbd876c45", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQK:cqYUQuVDt0TZEAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713428059, "uuid": "05f7f754-d4dc-4eba-b470-42c87aed7dc3", "value": 30179328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713428059, "uuid": "3a9da029-4d44-4f61-a9c9-f0e0f3b3e393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713428059, "uuid": "f544db1a-3aca-4a35-8fde-1d3a05d7bef5", "value": "ad0a11b87b468cbd4d9555d4f845e9256370ff631f7cafc063d6e0a59e98c777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70d909a-fd98-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713454391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454391, "uuid": "61b1cc5c-1daf-4806-a23c-991a0a588404", "comment": "Malware payload", "value": "ba41431c69cb3a3a558b7d363ad5160c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454391, "uuid": "f8f2d01b-dd9d-444c-b1ac-ccc90c3c4404", "comment": "Malware payload", "value": "ade6b6e09ec807df13e6128b48461ff279967f72bd12cfc777d7114e44b1219c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454391, "uuid": "79b30cb8-1617-46ba-8f87-914319074b55", "comment": "Malware payload", "value": "c981e506dd06d254c456b64fb01de3e5a73ee178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454391, "uuid": "9e31ea33-1082-4136-b89a-c7c7e8cffd20", "comment": "Malware payload", "value": "d3adbff6d7013aa7be5a5a70ed4cb2e6967dc4cdab89c74ee8dd4e2a44ab2adb4bc62fcb3f9ce19eeb5e456e82b5c503", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454391, "uuid": "786a60c1-4b5a-474d-a345-ff5856e75140", "value": "T13D57234B6AE6E2C5C7C218A43B4681DA26D195CEC4FD49383ECB4C027474DAF499DEB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454391, "uuid": "d4513104-7c42-48af-a3d4-df7763f8d813", "value": "2ad5bba9a7f55df153e18e95c7aa0b7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454391, "uuid": "ea80e216-71bb-4cef-930f-4c45a9209204", "value": "786432:76DrnZZjyehu2r/MTNwXqTlgRoZCGQ3T:76v7uZ2XqBiZGQ3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713454391, "uuid": "b5f4b891-f5de-422f-80da-6c78f017678e", "value": 27669504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713454391, "uuid": "969caa76-034a-4afa-a17a-7d453ca40bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454391, "uuid": "ad5a0bc0-708b-4d66-a9c5-6eb16fba03ef", "value": "SecuriteInfo.com.Win64.Trojan.Agent.ASGXPI.7352.29283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1b5c43-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439179, "uuid": "d5a501aa-2ce5-4c2a-b4ea-d0aea8b3dbc5", "comment": "Malware payload (Mirai)", "value": "db56445bf49e64cfaa2fd1293de3c821", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439179, "uuid": "249dc635-6c49-4a9e-8a3e-8dbdb1bf410d", "comment": "Malware payload (Mirai)", "value": "ae1edd82334b53232914e784b09b737a8bb41fedc2a47086685a2614f1dfcfe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439179, "uuid": "995dd23d-d349-4cd1-afd7-b5ff2943cf11", "comment": "Malware payload (Mirai)", "value": "ea65f98ca2acb64896dc4ad99b746d38c2ea407c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439179, "uuid": "5eb7696f-7b6d-4530-9784-cd2a3ab6cc8e", "comment": "Malware payload (Mirai)", "value": "eaa0c0e25081aa3248a85d186ff0324772ea83b6ec49f75d70de4729ae311b71b82a2fd1d0b03ff503661f48dcf9a454", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439179, "uuid": "4e211c27-e483-419b-95a4-b9b9f6a6285f", "value": "T1C483851E2E218FADF76C873447B74E32D758239227E1C644D15CEA011EA438E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439179, "uuid": "d5f6fa6a-3784-4a58-8bd5-84c73ff29950", "value": "1536:PZFoUqFSQAY6+zW++/YDOBEamNmF5npu4T8tWStt9:P1nY6+C+mYWErNupu9Y0t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439179, "uuid": "7cfcd34e-135b-4020-a9eb-4be93fa17a63", "value": 80768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439179, "uuid": "347871a5-20ac-499b-9999-cd12eed49722", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439179, "uuid": "6362831d-8c27-4ef1-8ed6-6bacfd5c098d", "value": "db56445bf49e64cfaa2fd1293de3c821", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f3aea1-fd40-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416407, "uuid": "fddfa1d0-c0f0-4ac0-8fea-6fee4623a339", "comment": "Malware payload (Mirai)", "value": "5a938d6d9b64103069be9151d19b41e4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416407, "uuid": "7544198d-506e-4a6a-9323-ebc724a189ec", "comment": "Malware payload (Mirai)", "value": "b03e5a62e44af9f96b0dcdab205ed37d7a9c9fa493a91dd778b1d4c9e8145835", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416407, "uuid": "7c5178d2-bc10-476f-baa1-f1ffde18cfeb", "comment": "Malware payload (Mirai)", "value": "0519b03db4f95cfa79bbe4d6ebb675634e7c8178", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416407, "uuid": "9b890745-8f68-490e-8a20-eeb04c39a5d7", "comment": "Malware payload (Mirai)", "value": "f96a395664e3a4984ebdfd8656e3a0c53be8777eea723ab199a68d3c0e003566ff62bf903e11c9aae36b57e4e8061cbb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416407, "uuid": "e413075a-41f6-441d-af44-170a07f17b17", "value": "T1B5F2F171FA7793B5951C59FDDE268E0723C8393C81FEB021263283642AD78DB09B80B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416407, "uuid": "c0300f71-1adc-404f-ae76-d9e8ae2558cc", "value": "768:J/hL3imUau24c2TP1jJAGRkaF/3Q/HWau4Gq4uaGiIBS0H3Uo:J/h3i3audcgJAGRdF/g/ju4GqzaGiIBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416407, "uuid": "cb198f66-010e-4d6a-a7b3-d9644e52861e", "value": 37204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416407, "uuid": "ee9a0d11-7ff2-4c3b-8cd6-0e5529e023f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416407, "uuid": "b5fae786-32fb-4273-9719-818a41c311c2", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e456ddd7-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439327, "uuid": "e9d4d99e-1cb3-42af-8c99-aca2cf61379b", "comment": "Malware payload (Mirai)", "value": "4bb278a420cc77e3d4110927a3069b27", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439327, "uuid": "6cea474b-d6f2-405d-b32b-37d8eb35e282", "comment": "Malware payload (Mirai)", "value": "b0ffd3a849d2c912ffc4328e4aa868701698d01ae6be7d30f286efab3e832937", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439327, "uuid": "4e550449-0527-451f-b7c5-7cca91167262", "comment": "Malware payload (Mirai)", "value": "a4059dba0d476041f15bc2258d30f3f84ba054a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439327, "uuid": "7f851210-488b-4c52-a3cc-2f08b7be7710", "comment": "Malware payload (Mirai)", "value": "0790b4dcd08b7e62626081e72268b4a118c6cb36047781918a680592214970931852b3a64f0be9ca879037bd552d69a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439327, "uuid": "af439ab7-2f05-401f-ace8-e563e538e00c", "value": "T14C042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439327, "uuid": "64aee838-3dcb-4788-9935-5e85cd55e4df", "value": "3072:EZHZ1pjx3vAqTkgabsh+OcAIeLHSwBjzq2cJsoyM/Rs+qtK:EZ5Hx39ogabsh+nAFlB/q2+xyM/R7qK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439327, "uuid": "05d10762-7f83-480d-af85-9f9cab830bad", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439327, "uuid": "0091540a-b37e-46b8-ba5d-701274c153fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439327, "uuid": "dd329498-dd2a-49b5-aac4-d491c8ffc98d", "value": "vlxx.arm7-20240418-1122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd84f32d-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425143, "uuid": "9f5cb5e5-4d9d-4eae-a52c-3a6a6600065c", "comment": "Malware payload (Mirai)", "value": "68c4be6643488cf78730e9669d53d54d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425143, "uuid": "bbabbb06-c6cc-48b3-97e0-673d3049a7f3", "comment": "Malware payload (Mirai)", "value": "b2551c6a2bfa6bfff3bb0dc726bd93a3e1c56a50dbe00e7503f859ccb2d9a836", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425143, "uuid": "baea7291-ada3-426d-8166-90b3b5ef244d", "comment": "Malware payload (Mirai)", "value": "76f5ad74ffc7d53a79a3d1a1d0a31db1c9ef09a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425143, "uuid": "3b96cacc-5e2e-4e77-91a6-a4e968cbe9c7", "comment": "Malware payload (Mirai)", "value": "5bc9bda8e9d537f285f7ae5b33e98a10aa125ccdc64ae30b070cfbf8e954f7f3bed29c8bcf492108839057195bd9847a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425143, "uuid": "b0925aeb-34f2-43e5-8af3-2c47c4351c98", "value": "T1FFF2F1E0A08CAC8EFADF9AB55D5859D5FBA09F8135018CC425512F116F07233716FB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425143, "uuid": "9e1496bf-f43c-433a-a9c7-63b3113fa3a0", "value": "768:KLn62rg1EWHclo6aQBxl/k0ZGYp3aorhWxbdOZ84uVcqgw0X7JkmWx:J+oB4dk8Baowxt4u+qgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425143, "uuid": "3965a084-13ca-4502-9df2-a4bc723e6b75", "value": 36700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425143, "uuid": "544ad5c1-e010-40db-a7a5-3f57a768f2d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425143, "uuid": "32e4d9f8-cde0-4d79-9c34-85ff07b18d5f", "value": "SecuriteInfo.com.Linux.Mirai.2599.31851.29053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64de4b4e-fd28-11ee-a120-42010a9c002e", "comment": "Malware payload (njrat)", "timestamp": 1713406042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713406042, "uuid": "16bbfaea-bc8b-47fb-aa9a-f79101c380b8", "comment": "Malware payload (njrat)", "value": "c0bf09b4829bef52bac3d6fc6758ccd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713406042, "uuid": "5008ce0a-bf5a-411d-9255-93c640b3a26b", "comment": "Malware payload (njrat)", "value": "b255d7d07da3fce68de66f3b0ea1cc08931e1f2d6514a19442e51269f2277e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713406042, "uuid": "fab3209c-a0db-4361-a064-2d6de12ba968", "comment": "Malware payload (njrat)", "value": "964c2ee33ab5b14dafb08cf0c58e908467226487", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713406042, "uuid": "12efa1b0-d7a4-4c7c-b1a8-7ba66e6328d2", "comment": "Malware payload (njrat)", "value": "8ccc7187884b9b5d03f8eccffdf0f90dd88cf3dcca872b260377587a7087059c6593f27919b07dbc0189fec83b6c72d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713406042, "uuid": "3fc00b31-5bd3-4ce1-af75-080c5b6cec3f", "value": "T1E5E2F84677B58229C6BC5BF88CB313110772E3438532EB6F5CDC98CA1B67AD04245EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713406042, "uuid": "00364fa2-5b3b-4280-94e3-c39f6146a5e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713406042, "uuid": "93b5debf-e590-4936-8714-b0cd04a8b7ab", "value": "384:v0bUe5XB4e0XzObWiaXLilpknDNWThtTUFQqz9MBObbx:ET9BuqZaXWlBibx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713406042, "uuid": "1db39c8a-d05f-4a32-992a-c7718cbf6341", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713406042, "uuid": "34e67055-c559-4cef-8b38-fa469a7aae75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713406042, "uuid": "8db06298-d659-4bed-8409-cf8f4d3d7576", "value": "bUBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e220c58c-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1713425150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425150, "uuid": "228d256f-7380-4bde-948d-1231d834c181", "comment": "Malware payload (Adware.InstallCore)", "value": "2987312ef9127e6c1059dc8dce51fd1b", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425150, "uuid": "68c8e9fd-7246-4377-82dd-2ffefae40fb5", "comment": "Malware payload (Adware.InstallCore)", "value": "b2795721bbd6f4b652cd89536b26b6ce2a26b77fb11304f89a49c99ffaecbf92", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425150, "uuid": "ea73e3e2-8909-46d1-a432-ca10f0e54cd2", "comment": "Malware payload (Adware.InstallCore)", "value": "c966177aa5ead816c2fa67acca2fdeacfd2b975f", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425150, "uuid": "79689406-5ab4-465f-bd52-2432c044e02b", "comment": "Malware payload (Adware.InstallCore)", "value": "07c2992a1f284630c7a507165723f42c17e90541575611b533b53aaddc9219c02b96490d777c29e13cdcbce0a0c26797", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425150, "uuid": "0e258cde-85c3-4193-8682-3428418a968f", "value": "T16F863302D78DD1B8D28834F5C48230D2A9B8ED600F09816A75FBBF6A6779D93CE5D58C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425150, "uuid": "c03fbb55-1c65-4e25-ba7e-c081df15b009", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425150, "uuid": "9b2e9290-e921-41a4-8c02-53ea70e82910", "value": "196608:F10nDBPwUnMiaJquIr2Ml3yhRmsux4y9BB8a1ryrQ/6A:FylP5MiaJA2MByhsp4yjBpyr9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425150, "uuid": "b7326006-996c-4eeb-99f9-c013f83fab2f", "value": 8203693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425150, "uuid": "f2db7bbe-66b6-4aa3-b006-6b8c51a4040b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425150, "uuid": "a248348e-2114-46b5-b8e2-74aa614650e0", "value": "SecuriteInfo.com.FileRepPup.23715.521", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718871e7-fdd4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713479937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479937, "uuid": "d4361bc9-5539-4f93-8dcc-0b4ff85b8217", "comment": "Malware payload", "value": "a4d2a484e1f0bf11169fda433a385f7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479937, "uuid": "89784f8e-2c9d-4a32-992e-6d8272c57cf3", "comment": "Malware payload", "value": "b2a55016c310fb3b6e38ea7dd08f6387c18c9eb2a4007947b43e6f1bb712c36e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479937, "uuid": "42a32447-b65f-48f0-9779-d2c931e789ba", "comment": "Malware payload", "value": "6733490679d6236a833d20390bc1e2d8ea88ed2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479937, "uuid": "65ba723d-0b83-4ec1-8c55-f912cb9d7da1", "comment": "Malware payload", "value": "40acd0fe6b6f4d503779e76d07f02fea7c757ec35be698a1d8be5a1f3d18daaceba05cabf917ba37d4951dad47965b52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479937, "uuid": "5980605d-d9d5-408f-8647-18e40997b899", "value": "T13B863A47E8A541E8C0AED1348A639263BA717C481B3427D72B60F7382F76FD0AE79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479937, "uuid": "1609bdc7-cefe-4896-b38e-9df3b2003303", "value": "9848d2dcb193b1c689991b27006bc941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479937, "uuid": "ef8b6a73-0bf3-4fd0-8073-aa3e580da0bd", "value": "98304:7GbT/vHJURAs+Flc2MuwWXD0SOi7aEh8D:7GZUus+FYHWTzHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713479937, "uuid": "7967e67a-86dd-45e8-bc02-b360020c0cf8", "value": 7870976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713479937, "uuid": "3cd26a2d-7135-45cc-83e1-b8f526ddf736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479937, "uuid": "331f1fb4-ee8b-433d-8cb0-624fa9991492", "value": "SecuriteInfo.com.Win64.PWSX-gen.24850.22028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89aeea0d-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713425431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425431, "uuid": "d9adbb70-4a79-48e2-a736-758d0e0bebdc", "comment": "Malware payload (LummaStealer)", "value": "017adc7dfb6b77dd2c14f7f7a4933f1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425431, "uuid": "b59d26ef-122e-4118-abe6-b6da8ab9b63e", "comment": "Malware payload (LummaStealer)", "value": "b2f99dd2c6fa0d0321832ac217f6a9842b4b27f3dbfff993547ba2c593573fba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425431, "uuid": "ee361d8b-8b8a-4d30-826d-ba5cfe7d6c7e", "comment": "Malware payload (LummaStealer)", "value": "1038aa153bfc7e29ffea56b13f24e6f98d7413d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425431, "uuid": "4ac3299d-325e-493f-8a46-2f3af7b57600", "comment": "Malware payload (LummaStealer)", "value": "e96e664d38029b4b330f4ba315abda8609563cfa347c3637bac7b18729f599327ca40f4545e3f90946d83f6135b58a80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425431, "uuid": "85fdfd65-e27f-42bb-b3a6-1454dc08e078", "value": "T1FB74E0E07EA0D435D15A8770BD29E6A81A2EBC71DAB5C1773764275E0E30290E63237F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425431, "uuid": "45179d51-4c40-48ed-ae39-f0f234678577", "value": "96d5e40a6f183914c8bf0374fa1144d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425431, "uuid": "48421473-d751-46b0-92c6-48b04c663792", "value": "6144:mL755LpGJb1tny2qvdbgq/1aQQ826Tgtvbgi6GmKEaYTi:m5W1gwYg16U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425431, "uuid": "ef2a4f56-3160-4709-8315-82b2ab87634d", "value": 368640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425431, "uuid": "87397223-adca-4541-8c8c-ac59fd912452", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425431, "uuid": "1ff7d13d-3291-4ff0-8e7b-0e72b226b0bc", "value": "017adc7dfb6b77dd2c14f7f7a4933f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "037a5687-fd5b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713427783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427783, "uuid": "694fd484-09df-4bcb-b49e-1c875d165fb1", "comment": "Malware payload (AgentTesla)", "value": "e639a26040e4180f739ee0cd78f65c64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427783, "uuid": "023c6160-6164-4bdc-b07a-d2639bd5cb6d", "comment": "Malware payload (AgentTesla)", "value": "b31ab1aa44953eb1e2371a7c4750ab24ac44497ee45244f7fe5940d9280f0ab5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427783, "uuid": "979431de-b43a-42f2-81f3-bf1b3c1a6635", "comment": "Malware payload (AgentTesla)", "value": "7f7aee13556a622d65bf1a2387bb74b9e728430b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427783, "uuid": "ceaf9f0e-d764-4c2f-9d02-0e4773b75600", "comment": "Malware payload (AgentTesla)", "value": "9f5b4cedcb70b4126e2f3ed6c2aec91708799ac30bb9c26411098f75ce0163b65d85dda0d8889bf06867323da01a3ea5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427783, "uuid": "51bc890c-6eef-46db-a75b-91ff86ed9db5", "value": "T14164362ED34F02698F920372AB1B1E95A6BDBA3EF39051A1341C437433D9C7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427783, "uuid": "053b0f46-f117-4680-a07c-47fe104dfdb7", "value": "3072:YsXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEiC6ghyl7LI9:5KMeKMeKMeKMeKMeKMrC9hyl7LI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427783, "uuid": "b29f885e-8912-4cca-ac33-d7fbc85ed134", "value": 335127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427783, "uuid": "832ed700-f877-4e94-8db0-d0c48601f9c9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427783, "uuid": "b06792b4-0b70-4056-9510-5c7d9a3b41fe", "value": "COACH APRIL ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d693b2dc-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419547, "uuid": "c94da3b0-a933-4b04-9a49-0971a76d17db", "comment": "Malware payload (Mirai)", "value": "9f3e1e500941982cf2482666a4e60013", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419547, "uuid": "6c0c3d01-40f8-4a9f-8dde-d4204681282c", "comment": "Malware payload (Mirai)", "value": "b3c9ed7fdf27f2ce656be446e2fa552ffb6a9071601a6572acc4957fbd955db5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419547, "uuid": "139c2ace-9a25-44b4-b152-4339d73e6f18", "comment": "Malware payload (Mirai)", "value": "29273de9d51e807eca4ea398cf191818476a982c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419547, "uuid": "5702b845-798b-4066-9273-b0bc60a08117", "comment": "Malware payload (Mirai)", "value": "8f38401fa52a4d1f0a607fabab0fa349cfc96e8bcb531911bd765f9409554a2b09d939a6945575a00bff57b0cbcd9338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419547, "uuid": "f3b7078e-76e5-4136-aa72-7a10b3202a45", "value": "T19D440B623B790B27C4E0553950E7A727F3BA47C92478D20B7EA05D4D6F6CAA03153BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419547, "uuid": "3e1f68b9-5714-46cc-a4c5-7f6fd7ce37bb", "value": "1536:0BxxQ5dxI2cygBVEa82sTQRyQxTJvEXCP+v3jJWYbzr+wbp5HVKV4tu6za+:/H+VfsTQZxtWtvTJWYaw951MD4a+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419547, "uuid": "28973f5f-b05c-426f-b864-7c4d4235828d", "value": 263812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419547, "uuid": "d6c65f1d-19af-43a6-87d5-0efb414ae248", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419547, "uuid": "0ab94b43-455e-4170-9b09-6656f5a0396c", "value": "9f3e1e500941982cf2482666a4e60013", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0892c2d7-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472459, "uuid": "d7d96512-8a0f-4e02-b8ed-d747d4c33fd8", "comment": "Malware payload (AgentTesla)", "value": "76f3349e9436ac839a2a1891f023bcb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472459, "uuid": "14fe41ae-dd56-4325-95b2-c0e19b96d93e", "comment": "Malware payload (AgentTesla)", "value": "b4a28403c7dd90741d3560d8a4b6b40dee0a58bdac54409c341eb3e882e518f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472459, "uuid": "4c38bb3c-fe06-4956-8c98-9dc44d880f08", "comment": "Malware payload (AgentTesla)", "value": "58eba13eb4ba6d178de98c027ae1228128034f2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472459, "uuid": "957cf6a8-52f6-4d53-b044-19d1a5fb4c70", "comment": "Malware payload (AgentTesla)", "value": "b91954a9edd0c10a92f2703a932b90854eb616b26761d7d1dbfc317ea0bb826ac948485c8370ef277bddd797fd81a111", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472459, "uuid": "6e02d79a-1c6b-48df-81d4-e8daf3ae9596", "value": "T166E4235C56CC098CAD08568CBACA8D5CB6F7230BF79B8F75A945D7987EF2E001A41287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472459, "uuid": "ae3a6281-118d-4c9c-96d1-05c85c098094", "value": "12288:CcdIlL1Tx1Z7rgZSmlrySrEyi7C0f/ZR0XYVuLIQwPKxKekXrdoEy0vS:CjlL1Tx1Z3CTluxJCg/r0XQuLIQzKrdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472459, "uuid": "b723aafe-2b75-4d5c-bf9a-b4e2982a0294", "value": 659604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472459, "uuid": "b41e4701-a885-4581-a489-4d9496c5ee62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472459, "uuid": "7b356a3b-5b0a-4cd0-9253-09ea71cbb2c0", "value": "Gcerti Quote_10.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80142214-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425415, "uuid": "00d3ae47-3181-47a8-b6ee-e2f26a6699d1", "comment": "Malware payload (Mirai)", "value": "7ed98990590f42500903d1bee26689b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425415, "uuid": "6a46c098-6be7-49a0-adde-c712ae3a0956", "comment": "Malware payload (Mirai)", "value": "b5088f2089f61263b06a91d6440b99fd80fc81c72d81045c4ea80aa43fd0adab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425415, "uuid": "0fa6cbea-cfd0-4316-9c0a-0fe6343ee73f", "comment": "Malware payload (Mirai)", "value": "8f77bd4c041bc5c3566557f5045107998d15afde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425415, "uuid": "1ab8b324-e33f-49d3-80a0-69d774d581c3", "comment": "Malware payload (Mirai)", "value": "684567ddd0229e1312ecf351685d7f45125d50ec71a98697be2be87c56821cfe8f8a3b40f46e5070c3ed55e41931dd69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425415, "uuid": "17074634-a18c-4674-821c-2c6d4150db1b", "value": "T17D0429C7FC00DEBEF80EF73A48130819B130B7A254825B777257796AE93A1990567E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425415, "uuid": "66a121f0-d0e5-4ecc-bc4a-2443236e963d", "value": "3072:yWLMQYZvmJroeylz5ur7h70FW/CItC0A844TbMoZsUSjbMdV9jbi0LJ4sMHfQQyY:yWLMQK27mz8RA84kbgVjbMhLJ4scQQyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425415, "uuid": "8874ecf0-ced4-4d82-9d0a-4007c9fb79ed", "value": 180256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425415, "uuid": "7963d636-338d-4aac-84a6-a2e5d0b1c78b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425415, "uuid": "d99cdfcd-c252-4217-922f-e909f6651561", "value": "7ed98990590f42500903d1bee26689b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1be8cf4-fd6c-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713435458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713435458, "uuid": "729de576-2a11-452e-b788-244fa03d5a2f", "comment": "Malware payload (Formbook)", "value": "e5caf7bf236fcba472f42d1502fb1401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713435458, "uuid": "6ac1b60e-e16e-4097-beb1-0e63227ca541", "comment": "Malware payload (Formbook)", "value": "b58782fa1f8c4ee6b469c7467eae7f371be4793685dc655087af6b413e4a0c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713435458, "uuid": "4445a7d2-9764-4cd4-bd8d-eabc9a77f570", "comment": "Malware payload (Formbook)", "value": "8f2d74c9d26cac2c26a5143269a6e722d2c1c21d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713435458, "uuid": "7a3441c9-b319-484c-8a17-1428742a8f26", "comment": "Malware payload (Formbook)", "value": "440c850881500675e85d4f7a0d950d4c455f4cf332aebd3d7b61cf81b11bd94f51564be6fce0e2e537c34b3746d2e06f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713435458, "uuid": "506e0489-12a1-4534-b674-e17ac81ad85f", "value": "T15E25D13D1CBD2A3B91B5D2A9CFE98567F040D07B3A11AD3A98D383954346A9379C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713435458, "uuid": "a17b2b23-9cc2-4826-8680-571e3521f484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713435458, "uuid": "8c31ab62-e311-4595-b083-016c1483d3d5", "value": "12288:G8riV2Dq61jAWZ5tw88Bt9WzMu0qYPgbQ6G35rItEOSDDEcu/i8LfeZAUWimlxbG:DrbDquj0tXrbrHDEhliZ0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713435458, "uuid": "7276a8a1-f24e-4c12-ba6a-98e738ecbf98", "value": 1027072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713435458, "uuid": "20db16d5-c32f-41a4-afcf-fa4d677e7fe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713435458, "uuid": "a304da76-d38a-4b09-8a0e-461f9680c59c", "value": "PRODUCT LIST_002673CC1F68.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7131ebd-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713439332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439332, "uuid": "9dcfe123-1540-462d-96b6-b22febeb94e3", "comment": "Malware payload (Formbook)", "value": "0b5320569b694837adca0b9ffb73f5a6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439332, "uuid": "2f00bfb4-0482-4374-9374-e46962edc82f", "comment": "Malware payload (Formbook)", "value": "b5f06b3e1a8856ea36f9a85336395234bafbe5a909a395c54d06eb54a36f17a3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439332, "uuid": "2c5d4864-d641-4876-8405-eec64febd918", "comment": "Malware payload (Formbook)", "value": "d7009e7ccb4787a13259918cf47f454da5b1eac0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439332, "uuid": "b8fa9c76-d96b-4612-9ef0-8e5ef45c4fa9", "comment": "Malware payload (Formbook)", "value": "1607ff8391cb80626d9bad69d3424279d4e6f094a7f8635c1fd0379f072a98ebad75806c1dc1acc5a5748badc0e50b61", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439332, "uuid": "53f863f9-d23c-45e9-b7b3-24d89ce9fd13", "value": "T10AE42316284FC5871EFD730C7A6D85B92AB1BAB0D2232D8E990E21549BF7732D584C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439332, "uuid": "53b3162c-60bc-48fe-8d12-f87f543f1d93", "value": "12288:kn4JPajzbf5k6+r6vGlDJzSYiTYNCSpVxUljhTFpMXZkE89:JJiHbRk6+r6cVzXiK/IFFvX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439332, "uuid": "260b921c-7a2d-4748-ae7a-082ccbaec53c", "value": 690040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439332, "uuid": "1d282c84-a0b6-4044-b775-05b99f05b289", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439332, "uuid": "321e3f37-d35b-4a62-88e6-a195e832d8fc", "value": "DOC 331-100920-00.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec4d8ab-fd4e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713422246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422246, "uuid": "ceb7488b-a1a0-42ef-abf7-66c581a08166", "comment": "Malware payload (Mirai)", "value": "769aea7ea26bfc99dd337dbb26191705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422246, "uuid": "ea73c7f3-1459-49cc-9af6-dd54c6b86003", "comment": "Malware payload (Mirai)", "value": "b63c93206417321b6e35e1accb8f667810c3e8a93978070d24f8382cc3d488dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422246, "uuid": "eddc9af8-0633-4a6c-9ed2-48498063aa1d", "comment": "Malware payload (Mirai)", "value": "d1b79037f929f318c1669ce39a5c484a9be4161b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422246, "uuid": "9f02c866-2ca2-4781-9134-84321cd0a467", "comment": "Malware payload (Mirai)", "value": "7f87c47995e60826f51b5ea2b07ecea76ce4a1e931b82d15377950b67e826b339dfcba1d694da26183103b1e15faeb7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422246, "uuid": "fb541d25-3684-450c-bfee-e0619eaeaf0c", "value": "T1E8E31985FC509F26C6D6267BFB4E42CD372A1768D3EE720389255F24378A99B0E37142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422246, "uuid": "9d34448a-d7de-4df7-9bb6-f5d440acac37", "value": "1536:A13J//isx1XUQfDugVylImza1FxuYB2A1zFCAD41STPIpKu4ROxOWpcSPCZI/puV:K5/K21ZfD2O/B2dAWSzQKuCs5q6/Wf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422246, "uuid": "df7d6d70-6307-4e08-9337-3158ce1ec6c6", "value": 154240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422246, "uuid": "8f430be2-b87a-4d20-91f9-e0b37594ad74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422246, "uuid": "5b36ae12-6a03-414c-847c-209780786b32", "value": "769aea7ea26bfc99dd337dbb26191705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95451af1-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713431034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431034, "uuid": "948b49b4-38f6-423a-8559-530a13c1c0b3", "comment": "Malware payload (GuLoader)", "value": "6d2f93878e625759f49553c5f971ddc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431034, "uuid": "dd2e6ad6-da62-41b7-a4cf-bb22ea2f615a", "comment": "Malware payload (GuLoader)", "value": "b6938d3e36a7d58523cd80f095f36593e0de47fe6d65dd74e5e91c0719a3849c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431034, "uuid": "ddc7face-5062-4377-9194-ef99f3eb8b4a", "comment": "Malware payload (GuLoader)", "value": "bf821caba21c6786fb3c0657259fa9e6fa09aace", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431034, "uuid": "8b583c13-5e3a-4c28-bb99-a719199ada14", "comment": "Malware payload (GuLoader)", "value": "416cd038716c3b1ad58110549a2d3034150ddb6a040d32ca60f2beb92f3fdb00f4e3bda68a2378a500db69f2b8acd590", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431034, "uuid": "baf611eb-dc89-4778-bfd4-24c22e10c6f8", "value": "T13D2419F08F0B36199F5B3EDAAC6445928AF84195051238B5AAD817EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431034, "uuid": "34bdabae-7622-4806-a7b2-c34e310df829", "value": "6144:eYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfaqVf:T2dOfxcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431034, "uuid": "eba4466d-f0cd-4024-9d18-9a7b848d32d2", "value": 215926, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431034, "uuid": "2b164b2b-7210-4376-8d20-16e393347734", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431034, "uuid": "519f9b9e-d6bd-4d67-b5b2-ce1355977d4e", "value": "justificant de transfer\u00e8ncia.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f479e2ef-fd6a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434630, "uuid": "31a89aed-b16f-4b4d-b1a9-7074e265d940", "comment": "Malware payload (AgentTesla)", "value": "e907575ce7483815f7b1dc48299c0e75", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434630, "uuid": "80097608-61ef-4a2e-97df-5d8e23600741", "comment": "Malware payload (AgentTesla)", "value": "b81fde316fe737f58af2b06055dab179ebbb444238749c8b5cb5be8bda80e7c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434630, "uuid": "a4226e3a-62cc-4931-873f-c5c0ba1e7905", "comment": "Malware payload (AgentTesla)", "value": "65123d2ccc90b518443bab836029505da31b129a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434630, "uuid": "27f0ab5e-e76a-488b-9246-2f21b6a7299d", "comment": "Malware payload (AgentTesla)", "value": "053764d117ea5b06ff5cdb52ad645b6f74ca138ff26b0f154da3dd489074fa7991f2704cec774384085e376275c8c009", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434630, "uuid": "957f573f-3180-4dc7-bb63-e14c90f01d4d", "value": "T1D745CF027391D022FF9B91334B5AF6115BBC6E660123E51F13A82DB9BE705B1163E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434630, "uuid": "d57d98b3-f40f-4f33-864c-1fe2db55303d", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434630, "uuid": "1f0a2e71-afa6-4871-8020-6e720b9da1cc", "value": "24576:nqDEvCTbMWu7rQYlBQcBiT6rprG8apGEfuCWOI/melVpvL51kKNU:nTvC/MTQYxsWR7ap0CWO2mqpd1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434630, "uuid": "a2422e0e-dc55-4c44-b802-8961b3ac734c", "value": 1182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434630, "uuid": "9ca16f60-acf8-41ad-a081-0ebbd64a01c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434630, "uuid": "1ae43c4e-6945-4484-a329-1578f62f6a4c", "value": "dhl shipment IS00O105560 INXPECT- 4123074 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bd7c46-fd66-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713432584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432584, "uuid": "2576a7c9-16e5-4503-bf4c-7854abf37aa9", "comment": "Malware payload (AgentTesla)", "value": "bbe8dbc3138fa7d19a81dd53e05cbaca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432584, "uuid": "d0cea711-0492-41ca-abcb-ed3d7bd45e1e", "comment": "Malware payload (AgentTesla)", "value": "b824af761566c8811b79ce3c96f0aeb00a1838e0a4989e5b257e9d753f214455", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432584, "uuid": "274d92bc-423d-4b1f-b887-c80abc3577e0", "comment": "Malware payload (AgentTesla)", "value": "bac6e4f2539a76f3173509166d77d6ca36b2a49a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432584, "uuid": "5d4a65e1-456b-4c8c-ab30-d38cb99667a0", "comment": "Malware payload (AgentTesla)", "value": "e6ac145ba76561e6e6512a31a6892ff6f4eef968ad71a9c15e38bd5d7b4bf111a9d422383d4b16bb217fa92fe433cfe1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432584, "uuid": "8d5b0277-0b2c-4212-83a7-c5c1e11fff63", "value": "T1B425AEAD365076EFC957C976CAA82C64EA107477930BD203A02705EDAE0DA9BDF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432584, "uuid": "0ab1a377-2fe8-48b8-b279-058083117fbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432584, "uuid": "1deec232-3ed1-492e-8e5d-659a8a7ade65", "value": "24576:yOuvC2tIIBUER4wnAmII5CjVRRmMVt9TSFtjlHg0oiOV:yFCEIIfR9/IeEfR1zAFdlHBoiOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432584, "uuid": "b061936d-c085-4e23-bf91-79e1d92d1dc9", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432584, "uuid": "c8dd7240-c1cc-4fdf-a361-f607c7e57469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432584, "uuid": "5b113ac9-0f3f-409e-b402-7074066e263c", "value": "SecuriteInfo.com.Win32.PWSX-gen.11821.9568", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b453fad4-fda0-11ee-a120-42010a9c002e", "comment": "Malware payload (Kaiji)", "timestamp": 1713457715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457715, "uuid": "6214b437-1cf2-4b35-8b92-05738b13118e", "comment": "Malware payload (Kaiji)", "value": "c6db589a8273a13af68755082c0833bb", "object_relation": "md5", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457715, "uuid": "90aaa329-d3e6-40b7-afbd-98f1589738e9", "comment": "Malware payload (Kaiji)", "value": "b8cb2e91eba3e711da1cab280e87955b93c482c2e4b9c4fb503cf561b5c487b6", "object_relation": "sha256", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457715, "uuid": "de673b08-2b83-479b-94b5-fccceda5429a", "comment": "Malware payload (Kaiji)", "value": "cd06dfcf7889072c111ca5730f2353dc05f02b08", "object_relation": "sha1", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457715, "uuid": "26a2ff90-6b4f-424a-ae29-302772033a56", "comment": "Malware payload (Kaiji)", "value": "0683586a7d0c2d973506db16d10d04bab575ea8ad90196586ef60270df49731a649100555dbe304cd6218f28bf65d9b5", "object_relation": "sha3-384", "Tag": [ { "name": "kaiji", "colour": "#928985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457715, "uuid": "272b4308-07d4-45fb-a4a2-eccf241eb761", "value": "T1C5363942B7086FA9CA60493385B38ED117727D996F315343AB14FABEA8B63054F15FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457715, "uuid": "441a9afa-e73d-48fe-9a61-90c461d29999", "value": "49152:i2LzgioAq4P670Og/d6I+eFRgjpmbLQYLy28UntKyB1:nLzgioh4P670Og/d6I+wgjpaLy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457715, "uuid": "579de49d-9489-4123-a514-0e123ea29ae9", "value": 5101348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457715, "uuid": "bb2b9a74-b1a3-4eba-be30-6128d1ddc15f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457715, "uuid": "a1b26b97-aa24-4975-8880-0b5a3073387b", "value": "b8cb2e91eba3e711da1cab280e87955b93c482c2e4b9c4fb503cf561b5c487b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ad160e-fd1b-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1713400482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400482, "uuid": "a9dc45d4-2d6b-4c3d-8810-7f82d723b0a0", "comment": "Malware payload (Glupteba)", "value": "e1d8325b086f91769120381b78626e2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400482, "uuid": "ac47b849-3928-4184-abc9-352dbb833b91", "comment": "Malware payload (Glupteba)", "value": "b925abb193e7003f4a692064148ffe7840096022a44f4d5ae4c0abb59a287934", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400482, "uuid": "f1adc46c-5322-4b60-911a-d80536af48f1", "comment": "Malware payload (Glupteba)", "value": "0eb6827878445d3e3e584b7f08067a7a4dc9e618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713400482, "uuid": "b2bdddf0-3464-4d9e-8984-36c9b64cb080", "comment": "Malware payload (Glupteba)", "value": "1a3d767d023e33982969ba202e659882381af319d8e125c9193185637af2b148145cf59c5db2e4d97b6adfae9405f78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400482, "uuid": "162bde81-8a04-47d7-b6dd-4116ce355384", "value": "T180C4F121B3DC4A2BCBAF03BDA47814211BB0E257554BCB5F5D8498DE1C8BB855F22B93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400482, "uuid": "cb432ad0-90f1-49d0-b571-f2a17badc7db", "value": "12288:vWcj324ri1mvJnrOj1fiTvwG/APkmUETuegWaR0j:vWcj/rxvJnCj1aTviPkmZLJaR0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713400482, "uuid": "bb220dd0-ef19-49ec-9772-66c7235cb98c", "value": 570320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713400482, "uuid": "f49ff679-5256-42aa-af84-21b828d34af0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713400482, "uuid": "217df35b-fa31-488f-b08b-4119a0a3ae6e", "value": "SecuriteInfo.com.Win64.CrypterX-gen.2144.26023", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914dabc6-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (Quakbot)", "timestamp": 1713467105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467105, "uuid": "33d65be5-8906-425f-a863-0c33b51f29e6", "comment": "Malware payload (Quakbot)", "value": "f48cfe6ae7cd4014461b54f4f546a300", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467105, "uuid": "c58efba9-7681-4d2c-85b9-87a0444af1c3", "comment": "Malware payload (Quakbot)", "value": "baaf0f3b544c0809f8367e6521a3ed59d2baaad83f112072830dae1779080b99", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467105, "uuid": "bbf0afc9-8779-4697-a118-141e7bc43569", "comment": "Malware payload (Quakbot)", "value": "17efd4c79341045fb4e0739f4ad698dad2d2bde8", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467105, "uuid": "ca874bc9-9366-4a50-9e36-0ed40854c61b", "comment": "Malware payload (Quakbot)", "value": "a549213ba127825413ce9cfd6fd41b589052905d4045bdba8655ccaf34fa8cf30411602a9bad09255a85f62bc32d2b48", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467105, "uuid": "9e8e7eb0-4b23-4619-919a-6af28c4b83f7", "value": "T1F101E5045BDA0610E1728D736DEFE306CAB53893DE939F6E4084828D3464941BDBAE17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467105, "uuid": "7b04f9c6-753c-494b-a388-7c02fb8dacc2", "value": "12:8Y9M0m/VnEXz/nvhsIgqEKw+ilDmIfcq6iNAILY:8YiJtnmnvtDHm4I02Ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467105, "uuid": "10a1b3ce-e39b-4ad9-b1d5-ffd17c6c1f82", "value": 668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467105, "uuid": "c2c7cea4-cd29-4d2a-afc2-f939523a976d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467105, "uuid": "77b6ce80-5064-4913-bffc-4eaa77f89606", "value": "Archivos.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5054ac-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433548, "uuid": "f700d86d-c364-4330-bb05-4fe5a28ad95d", "comment": "Malware payload (Formbook)", "value": "739cefccf7fa26e1f7f9923a6cc9620a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433548, "uuid": "f30b4315-255f-489f-a628-2a8bd41a8f88", "comment": "Malware payload (Formbook)", "value": "bafe3979cf8761e4f305509427099ef0e6193ce077236e31540aff4c47ddc74c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433548, "uuid": "b79417ca-df43-469e-9c4a-4e31092eb273", "comment": "Malware payload (Formbook)", "value": "94a3e2a59202fd3590d1f9e4755727303e14662f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433548, "uuid": "d499383e-3ee2-488b-aa4a-89093d240a4c", "comment": "Malware payload (Formbook)", "value": "efc3558e609ce24d1d5ad6187c4495800b3ae28369c431b764f5f14ba1a66e81d22b67142a0ba0f2bcd5da79715c12d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433548, "uuid": "de48a9ea-7671-4deb-987c-529ee4b89542", "value": "T115F4235FBF9DA343D63C1EB1A1A6963843F195C60483FBA91C85247B6BD2BD04603B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433548, "uuid": "6c1328c9-354c-4f11-9755-52b6f572b63d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433548, "uuid": "dc7e59a2-bb85-4a6e-ae46-a1efc5b9f8b5", "value": "12288:n3bjrXu7i/5sf2FOcMoywdwDvJaFSitOjaQEeopByBJ548Mpp+8MiwgNOj626tcs:3TQeFxTgoFSiODigilklco6pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433548, "uuid": "ff9f2640-f6fe-4bb6-a33a-120c5f4ac3dc", "value": 724488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433548, "uuid": "7e9313a6-b20e-42f5-b16f-4caf57fa244a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433548, "uuid": "689cf426-f939-4d6f-805f-dd3394c6ad12", "value": "739cefccf7fa26e1f7f9923a6cc9620a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c9df1d-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419219, "uuid": "dc2ce670-5cfc-4e10-9a8a-50321595b71e", "comment": "Malware payload (Mirai)", "value": "5d6d117eb21f39c5964f78be7275ed3e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419219, "uuid": "450e4292-8749-4a49-abae-0f219cce3751", "comment": "Malware payload (Mirai)", "value": "bb3423e0836401208ab5317c8e957a1fcd9073b8fec8bc8f380bf33fb8499b17", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419219, "uuid": "afdf25ce-472c-48dc-b1f0-4326092ee5bb", "comment": "Malware payload (Mirai)", "value": "88ab5618dff1afe060395cbdddd90592080b6b00", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419219, "uuid": "f3ba6712-0fbf-44d4-b926-ebe5125114dc", "comment": "Malware payload (Mirai)", "value": "711fcf42dad372371cfcb1add79e549c29d87a68b679fec0f205e2ad3bed3260030a469e0a8694a5787f89cd822dc2ff", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419219, "uuid": "3404e4e9-df29-4c0f-94b7-79e6093e9a67", "value": "T120530813F68240BDC187C5704A9FA93ADD36B8FD1328B66A1B90FBB12D71D225E1DE44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419219, "uuid": "9ee0268a-3986-4e8b-bdd4-508f46c79d89", "value": "768:kNT9wfpxIO2LDGyLZnX+WXe1JSTz/kchCeaLv4Z2nRR5gGG8OXZzsKYErO:AyTZ2eyLZnOoJTrkcEeaLVz5I8Oaer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419219, "uuid": "601fdcc1-2548-4b20-86f6-66fa47d58808", "value": 64776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419219, "uuid": "a0c89463-57bd-46f2-82af-5387df2aacc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419219, "uuid": "87ea0d26-a355-46d3-987d-5b35f263c629", "value": "5d6d117eb21f39c5964f78be7275ed3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c6261f-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713430946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430946, "uuid": "5f64802b-f796-486c-9a71-b612dd69fceb", "comment": "Malware payload (AgentTesla)", "value": "74c8e10f46a216147cc067dadfffe3e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430946, "uuid": "9b7a2766-e99d-4294-b8d3-448bbca2b22b", "comment": "Malware payload (AgentTesla)", "value": "bc110b120c65ddc0fb8edcd0acfc7083701769f6a3531dc7d53e00fd6f26993d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430946, "uuid": "0523261e-0a8b-4b83-a2be-40cd241d633e", "comment": "Malware payload (AgentTesla)", "value": "ed325d17c62cd86d47582c9f6e8da6e9794dae2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430946, "uuid": "e4e9223a-9148-4564-a6b9-8eea5d5dd0d7", "comment": "Malware payload (AgentTesla)", "value": "ae4ee14b110bcdad1dc7b419463d0cc8b6a35948d18eb305d0afa7da6f85c61c5f999f127e3cbb045917d5e9f72a2ef7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430946, "uuid": "e7256378-a077-4ed0-abb6-631819c717e2", "value": "T1C8C4E066279A8803F2DD05F483A3E77873359D982A1B826266F1FE2B787C3D15D3D142", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430946, "uuid": "8aebd9f4-b381-4870-832a-1c86d923487b", "value": "59a4a44a250c4cf4f2d9de2b3fe5d95f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430946, "uuid": "ed66201a-f8a2-4973-a956-ff046ea0ff6c", "value": "12288:r9HJGvMeqQ+ArfWv1t/xKXkJkDvzWUpcviV/:r9HJMGCDW7/xAkarJV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430946, "uuid": "c78e030b-4adc-4a23-a8e5-794f91e378ab", "value": 577840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430946, "uuid": "cf7d862f-853d-44b4-881f-5c586809e120", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430946, "uuid": "9bd03181-823a-4f52-a475-73d59aadf370", "value": "SMLOUVA DEV8759 - pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e1ad4b-fd43-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713417513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417513, "uuid": "590f734e-982e-474f-b3fc-e5ab58604c9f", "comment": "Malware payload (AgentTesla)", "value": "6e0288d1513d271ed045d827d9475117", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417513, "uuid": "e4ea1a5e-f957-4f8c-83c4-57ddceff84ef", "comment": "Malware payload (AgentTesla)", "value": "bc533f1c04f542db4d2cf6edd86eb7caea7a60b53098e4145068f43030560122", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417513, "uuid": "645bad75-e37c-4b5c-84a8-b00547341723", "comment": "Malware payload (AgentTesla)", "value": "a78ee2121afc54778a7a2176cc2b413c609734b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417513, "uuid": "7a7d94a6-c53b-4329-afea-f41a90274628", "comment": "Malware payload (AgentTesla)", "value": "2eb352edbd8767caabb3e095cc2c130e3cbbb9c3dc02ca6a7993b41da5d20cf5dbc51ae1d62c1ce037a1068bff2275bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417513, "uuid": "1f46b722-22b7-4861-a4ca-bbd06c7260d0", "value": "T1D1F4226526E95B21C5BC0BFA0CA4128443B2BF273052E74C9EC662DD5D53F914B60EFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417513, "uuid": "0c3421bf-44e4-4017-b0e6-d2753dbedae6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417513, "uuid": "8a26b0ab-68b6-4bc0-aa40-1914e3ddf5dd", "value": "12288:iFaK/pbMXRwwAFiq9gxH4B3fkwdTYaVOKpEW3xT3eL+KepfBY:saiMXgiAPpvpHTI+K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713417513, "uuid": "e797ddd1-5678-4922-a5d6-9bf5f8f9ec69", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713417513, "uuid": "aee1b09d-2b3b-459c-8700-a3d0e3ecbfc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417513, "uuid": "04b9bb88-6195-4fb4-a7b1-1d5f03d5e82b", "value": "SecuriteInfo.com.Win32.PWSX-gen.1728.1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b78c03a-fd43-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713417516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417516, "uuid": "0fe87276-de8d-46ac-96f0-3f83b1c58577", "comment": "Malware payload (AgentTesla)", "value": "c92b0f610f6923b486e7fc1ea5ee3b48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417516, "uuid": "ad6561b1-26fb-4e91-83e8-c694131248b2", "comment": "Malware payload (AgentTesla)", "value": "bcbd16bee80900e31b5e9382f6dc69a0a4903e22bf497513b49b0c6ae56685af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417516, "uuid": "c74e5b39-4093-4138-8692-a06140188179", "comment": "Malware payload (AgentTesla)", "value": "a89306c53f9350f7498355f0993bb03dee4a1cb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713417516, "uuid": "4c2171cb-9695-481f-827a-70a95ffb0cc8", "comment": "Malware payload (AgentTesla)", "value": "d1399a9f7f0f1905efeb737673b74f74c0c89b087ac105567ff9827e3e026d46474a8862982b2f34f1f309c6f1e99a61", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417516, "uuid": "d334d1f7-44be-4e07-9815-9f32a3f6592b", "value": "T1BCF4221436A99732E8BD2FFE0425224043FA656730A2F74C0ECA61CD1DA7B45E705FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417516, "uuid": "3646b0e7-5d02-4ac6-b231-037c302c9668", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417516, "uuid": "fb1a4d99-2f0c-479c-a3aa-8f6d62327c7d", "value": "12288:FGK/pbMk5KI6+h4qK9U/T5DjZSh9EfR5Pah+XGc6VasW+qaAYTYjBAalWnWRwwAJ:FGiMk5KI6+hqyb9QjE3S4XTeqaAYUFAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713417516, "uuid": "d0bf92d7-54f6-435b-9c49-108689ca0961", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713417516, "uuid": "2fc9838b-52ea-4a8e-b548-dc55d09b3f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713417516, "uuid": "70dac2ca-0b4e-4364-851a-2655a20bc222", "value": "SecuriteInfo.com.Heur.15333.25205", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc04ece-fdcb-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713476283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476283, "uuid": "12bb2cff-6907-4beb-bf87-556dd490c252", "comment": "Malware payload (Amadey)", "value": "926fc8b724cc682d97cf0849c0fcbda3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476283, "uuid": "594f000d-70f0-4fe3-bca5-9c09d8fea5b9", "comment": "Malware payload (Amadey)", "value": "bcd9d9e586c6d788717507307e47d2e7c85eeaa49e7766434dbeca97973f8e59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476283, "uuid": "f5fc2376-56e2-41b7-9476-301d4daceb6f", "comment": "Malware payload (Amadey)", "value": "2f1555afddb43a13be489200a751698302340056", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713476283, "uuid": "3f4936e8-2861-475e-8477-20b63840828c", "comment": "Malware payload (Amadey)", "value": "45f4895d14441d6539e75cde1882c1f7aaa553cbefe43ae869ea693a3b1485cd490e3f463f559d0dfe75746b9fc5de97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476283, "uuid": "1dbc2adf-6ffe-4f18-ae94-132198376c1b", "value": "T105050202BAC58572C53329336A359F11A93DBC302F76C9DB9394696EDE321C0DB31B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476283, "uuid": "05dcb62e-dd0b-492e-bb3a-86b07d48851b", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476283, "uuid": "b1dd5ba4-e2f8-4816-8866-feaca3d9fce8", "value": "24576:vubsnafAPyjJUIDTp8ul8CoZq40OGhrcuT9V:nIL5lvzYG9Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713476283, "uuid": "64b7f6b4-7a51-4d5b-abe3-25f5a7b14baa", "value": 798855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713476283, "uuid": "aa6fd272-9026-40db-9c04-a46348cde9e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713476283, "uuid": "993fcdf6-d8aa-43be-8443-600dd04a319d", "value": "926fc8b724cc682d97cf0849c0fcbda3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac464c2a-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470587, "uuid": "5975b546-b697-4e99-ad87-50d54b4dad4f", "comment": "Malware payload (Mirai)", "value": "d49bae27fe405348a5a131c0838fed4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470587, "uuid": "2948b202-0c90-47fe-8a0c-2dfe1069ab78", "comment": "Malware payload (Mirai)", "value": "bde84ebfaecac402633bc44c7d2e080a600971464eb87f41074c0270ef1edf8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470587, "uuid": "210d96d6-3fc8-4112-b7b0-d581ab1c0662", "comment": "Malware payload (Mirai)", "value": "d6a395338a68b0d55720aeb734e497a50d9aeeb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470587, "uuid": "5f82b7cc-8ded-4597-880a-81d457a343b6", "comment": "Malware payload (Mirai)", "value": "90aaad2fc25bedb8cf440472219d7527fd7c4eaac94c059a794b44a2950bf87262809bcf7cc4982e0da28ece8c635787", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470587, "uuid": "dac7451b-1564-43e1-bee6-acfbc58d57dd", "value": "T1A0630755F8819B26D5E052BFFE1E128E33132BA8E2DE3213DD156F2037DAD194E2B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470587, "uuid": "b53a6698-7e8a-4a98-99e1-a9896f1bd00b", "value": "1536:3PncamxOJ/u3UzRIKX8OFkZPMXHpn8FeI38r8YA8AJOvAo9FTQI:rqOJW3kRIKX8yXGFBW4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470587, "uuid": "1a5a862d-7844-4303-a2fc-71493e979314", "value": 70368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470587, "uuid": "6c737b8c-075b-4bb2-9afb-d4d828d1909e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470587, "uuid": "d4e7d2af-b728-4bbb-a223-91d8c04c09ce", "value": "d49bae27fe405348a5a131c0838fed4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae2a239-fd40-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713416307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416307, "uuid": "f801c29a-31b7-483d-95be-41651cb8517c", "comment": "Malware payload (AgentTesla)", "value": "cd7c4ece35508ec593df126f064bb3a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416307, "uuid": "aed0c4a9-4e6b-4143-8354-cdf8f4c01496", "comment": "Malware payload (AgentTesla)", "value": "bdfbc6917b7327503e838cb43ba79302f9323377b593f5f55f9d31909818728f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416307, "uuid": "195dcf32-df97-4fc5-896a-d8a37b729e9a", "comment": "Malware payload (AgentTesla)", "value": "9a0ce3d2e796a092e78014150620334dff8ebd03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416307, "uuid": "51c69e97-8c12-4127-a947-c76b03bed390", "comment": "Malware payload (AgentTesla)", "value": "730480b9d6a878f75fe1eb880cbae153bbac57fdef2f8e937f6b812fc96f8f4736dc86418600e5c2d63f7be45ac24c2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416307, "uuid": "97cdcde2-1e18-44f1-bdb4-c1eedcfa81cd", "value": "T1DC63AB2EE70F0954DF55977B434A4B4A06FCB33DB28540A179BC97343BAD82E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416307, "uuid": "75423a14-d50a-45ee-8576-3c636bf678fb", "value": "1536:dQGlXZVZA1HvwZry4R/Z6tVXWSyEkkcGve7sngqEzJ2gAV5Lv:dXlXZVZA1HvwZrlR/ZOyEkkcGm7CgnAr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416307, "uuid": "864deeaa-c256-43f0-908f-3b48447a1d35", "value": 72316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416307, "uuid": "1bfe6696-197d-4bd3-873f-6be445d91b4f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416307, "uuid": "814ecd77-27ca-4887-91a3-e2c4311d0f30", "value": "cd7c4ece35508ec593df126f064bb3a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beca05b9-fddb-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1713483073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483073, "uuid": "e6d63efc-ea39-411e-b100-ef7ef5e28559", "comment": "Malware payload (Adware.Generic)", "value": "630eaf6b2cd6a3d86a3575f746a660ea", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483073, "uuid": "6e51c210-46a3-4b32-aaa3-e27f5bbee86f", "comment": "Malware payload (Adware.Generic)", "value": "be306e6861976343a15defb58fb07f500f5376eff3a54deb320ae64dd0a15431", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483073, "uuid": "82fd2eb9-c171-45dd-9bd8-8409bae2bcbe", "comment": "Malware payload (Adware.Generic)", "value": "deecbf311666f0234c0b8bd8142b698c931ae822", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713483073, "uuid": "a10e675f-a1c8-4ce9-8eca-3de704e164a9", "comment": "Malware payload (Adware.Generic)", "value": "8e7a519b771c129d44d248ae9e72cf8bf846a6667fdfda3c2da6ae865bab292a615ca92edce87c48463bdbc00c6ec6cb", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483073, "uuid": "0e3803aa-4193-4860-82c9-934dd4fecf0f", "value": "T16BE6233BB2A8753EC86E1B7259739210A97BBF61A4168C1E07F4351CCF725702E3B616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483073, "uuid": "4e9b911a-f04e-4023-b9a2-ef66fc6dce68", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483073, "uuid": "4fbc5699-2023-4354-9c87-d90bbee8ba19", "value": "393216:IsvTmt3TP95cxsgsNUAgX6oXrPUZx7RV6Zc:IsbM3zTcagsiv6xx7RV6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713483073, "uuid": "0cfa03ae-a510-467e-bd61-26c093decf5c", "value": 14973712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713483073, "uuid": "a2b1a40f-843d-4421-8d45-862bf3344232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713483073, "uuid": "4f60cd81-05df-4036-bb4b-922e3931eda3", "value": "SecuriteInfo.com.Program.Unwanted.5412.9308.3353", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fc23a7-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (DarkTortilla)", "timestamp": 1713472422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472422, "uuid": "56ee70ed-4dde-4947-9282-03d7d0ac7964", "comment": "Malware payload (DarkTortilla)", "value": "c66e9ddda9b6199e8b5987f1f6cc617b", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472422, "uuid": "421a8635-dba7-45e4-a04d-a1392faa9288", "comment": "Malware payload (DarkTortilla)", "value": "bf59eeee70c668fdf6fbf586811ef7d432a656060dedbf02ba705a6dff9d83bb", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472422, "uuid": "6bb551f4-3271-4178-836b-0cfb83daaca8", "comment": "Malware payload (DarkTortilla)", "value": "8e8c951bf89951a9f9aa6b1c3ec67bd9bcff8632", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472422, "uuid": "083d56cb-3252-4f59-b1b9-8525247fbf83", "comment": "Malware payload (DarkTortilla)", "value": "1a2edfd4b4ff17c35d7c7e1a2eb1abf5524ed06ddb2d5b1fbc840fda0c502a9b37c6c457969fb715e6626d192fa92400", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472422, "uuid": "f649a789-3d56-4bba-9de2-b7ab62cbda6b", "value": "T11ED423D8112DA00D90DEC3A4986F1C5AB0C4F451BFEACF379A4AE1E861D42A6C0FED5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472422, "uuid": "37dc2903-fd6d-4ec2-952b-8ffa7ef3d604", "value": "12288:nLz7TezCZNfwnsVGCjGd5wEPY1x6UVHkV+zWeJSqIl:nfHFNssbjGd7POx97wqIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472422, "uuid": "1abdfdc9-9e96-45cb-91d7-341a4117b530", "value": 603887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472422, "uuid": "4581a167-98b0-41f0-b14d-d04e2794a887", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472422, "uuid": "f5f8a3d4-d914-4b04-895d-2b6b19e49d92", "value": "DOCUMENTS OF OWNERSHIP AND PAYMENT REQUIREMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0197459c-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466435, "uuid": "1ccfdfd2-ee53-45d1-9556-411eff8efefa", "comment": "Malware payload (Mirai)", "value": "a0fc453a111c1825c7ab521f0a5d4a10", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466435, "uuid": "3c88e04c-908f-40bd-90e0-f0dbfbb06b33", "comment": "Malware payload (Mirai)", "value": "c0e53e52f1891655c36abc756f59b191b7574f5c9981dca3ad9e3857ce4baaf2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466435, "uuid": "ad8bd98c-2bc8-4ef2-a809-be8989488a38", "comment": "Malware payload (Mirai)", "value": "6cf877fa78bce2dc255a1a149302df9390b83973", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466435, "uuid": "9d941f8b-214e-4fe8-9089-741cea345373", "comment": "Malware payload (Mirai)", "value": "b8297248ae61f3e795014dc1e9ba24eb76ae69041dc449d171d519dbe3ddef2c14b3e3eda3fa1007344d526cbf5ee9a2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466435, "uuid": "fa57f49d-7b26-4a09-bacd-2a782413d601", "value": "T197146C86E762D9B7C44A077506DB97354636E8A2032F4F02E35CAEF42E532C2F585F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466435, "uuid": "ed2d7234-6690-4312-ab66-d66b89a934b2", "value": "3072:FFs/9JkjdckfXvlNcFwYynHbVuXh7TCKKwTIC5FYHVByqqeTh:FQ9JkJZXvlOFwYyn4h7TCKKKIC5qHvZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466435, "uuid": "1c1bad1f-3223-4ffc-8ec7-cefe8796119a", "value": 192060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466435, "uuid": "072eae91-ecb7-4cd0-b8b0-5ec9f1ffa6ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466435, "uuid": "a17c12fc-1b8e-4709-b25e-f9def5f30057", "value": "vlxx.x86-20240418-1853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83217bf5-fd23-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713403946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403946, "uuid": "4f4d0ff7-540a-43cc-9d86-82e061ad030d", "comment": "Malware payload", "value": "87b6fcfdaa0ab94d9cf4b7f3cbbc8b8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403946, "uuid": "5d2d6ca5-a735-4a35-9c97-658e2d905ef9", "comment": "Malware payload", "value": "c1874e86e54a70b1917c708826975e45fa5c813f0ec30f6afd4971100ac0e5b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403946, "uuid": "a48c94ea-b8c0-4139-a26e-9029317f8f11", "comment": "Malware payload", "value": "2e3dacf58466b4b7a2c6d52b008f6e1b4c98911a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403946, "uuid": "192fe2d1-e5de-4636-acef-f0370d1b61d6", "comment": "Malware payload", "value": "24a9d627bd6b1d7159cc9e103f87816547ba3e2f76b656120f77ed514b33dd158f689f44bbd64c9e276d49850f13ca9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403946, "uuid": "0a1441c9-f34a-4f3c-baee-670354630718", "value": "T1A6A5235B323551F8D5678078CA8A865BF3F278890731938F1270CB7B5F277A56C6A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403946, "uuid": "7b63a82d-e7f8-4833-b2e9-d0eef43fbfca", "value": "08fd62a9d05cc8111782017958ea975d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403946, "uuid": "c99643c2-7e6a-477e-aabf-d40b306bc8e4", "value": "49152:Il4n2ygDR5l1R+2CvsKU4TP5GdY/5ONw2cK9vWvGYYhfBfah7Dgpqqd:JnsRfXovsKjTxkGONw54vWvxYNBfahIr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713403946, "uuid": "80e6e230-e752-4e61-9a67-5982d81e6c07", "value": 2068446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713403946, "uuid": "ee003314-4ed8-485e-a288-affdf23897b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403946, "uuid": "e560aaa5-96d6-4f43-a48f-6a30d6ca912e", "value": "SecuriteInfo.com.HEUR.Trojan.Win32.DelShad.vho.25230.12529", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84caf3d0-fd40-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416404, "uuid": "f970009d-c24a-4dbe-a003-1d4a55443763", "comment": "Malware payload (Mirai)", "value": "5f7f793a62d71883f939e3f911743f4c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416404, "uuid": "9f878500-558c-45dc-ba7b-db6b41a3f0c2", "comment": "Malware payload (Mirai)", "value": "c2666c6409b6c19733c1c44751da68590fb41b6c395312766879be72aa578299", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416404, "uuid": "9732d58c-631b-480c-959d-2a5d22966560", "comment": "Malware payload (Mirai)", "value": "92caabfe14df59d1a47e5b1dbbd550b3ecb0fd8f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416404, "uuid": "ab0fb8fb-f7dd-4532-beb3-384173e80031", "comment": "Malware payload (Mirai)", "value": "513648e9197c3acb005eecbe5a9a5e08b927ea716fe26db41f9f0d9b47c284cfa0ab64f6de7b43598c6c3b08581756f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416404, "uuid": "ed4d33ad-0fb5-44c6-9ffa-a4272165c5bb", "value": "T1DA530154596DC601C5B068756B2A995C3A6F6FA0C1BC37EB3742C310EA98E32CF8C5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416404, "uuid": "e7fbaa01-6e0f-482d-ab82-481e7ee002f9", "value": "1536:BeIqfnocUDwSSrDez+0qFRiPhAjkWnPX0CyGQ:BeIen5UD3owqFK2RnPkCyGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416404, "uuid": "b0dbf775-6311-4e36-b85c-7cfbb60727bf", "value": 63304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416404, "uuid": "94078d3e-71bd-4784-9b3a-193041538166", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416404, "uuid": "030a2011-2912-4bce-ad47-e0fc7e105751", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010556f8-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416612, "uuid": "7b9a81fd-d795-41e8-9ef4-7367b2f8b93b", "comment": "Malware payload (Mirai)", "value": "e2765beb0f46bf29ac6eacff880015e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416612, "uuid": "513baf70-597b-491a-bff7-3e4003af9977", "comment": "Malware payload (Mirai)", "value": "c405d0997b3a689aeccbf324693ffda128ce17011474c758fdf7f8c7afa11140", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416612, "uuid": "57c06039-e954-4dde-a217-20c0f2cd3e92", "comment": "Malware payload (Mirai)", "value": "2896ff683798cf0bf6ff8746bcb383a60af0728f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416612, "uuid": "7eaca42e-a459-4441-ae56-69eacdc3f46b", "comment": "Malware payload (Mirai)", "value": "89ee0529d7fb6e682b4e317268872c4127f63c36f684d512eb25b695d82d8098a0ceacfdd9c84ba292dfba77d7270f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416612, "uuid": "d33d4bd6-fc75-4807-a40d-7039d69c4ff6", "value": "T1E1330123B655BCA2CE751D3962F98C9B3144026EE0ECAC2139C8686173D2157FBE15D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416612, "uuid": "23c62f0d-ff1c-4ef5-aae7-9af314942039", "value": "768:vfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbMK59q3UEL2qEK5J6OAsNTGjf2tl8XO8:0PtQjiZVcykHRDMbL15J6RN2tAt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416612, "uuid": "43ec0d60-4616-47e9-b271-6759d8fffa5d", "value": 51432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416612, "uuid": "2ade6e64-4577-448d-b753-02860452d714", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416612, "uuid": "77a1f439-47e9-4567-bb3f-a48620bacc42", "value": "e2765beb0f46bf29ac6eacff880015e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8df3407-fd84-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713445670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445670, "uuid": "4c5388e9-4e0a-4cc6-ab01-d4ccbca2510b", "comment": "Malware payload (AgentTesla)", "value": "97c4ff1e31210f89e49b3abd3ac7eaba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445670, "uuid": "16dcec7e-b83b-40b5-9e70-5f442afbe6b1", "comment": "Malware payload (AgentTesla)", "value": "c4bcbb525aadbcdb6fd3b6d7bbe99d2dfe8fa916caf54bd733bf450d2a570c94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445670, "uuid": "935cd30b-7f72-4a15-b991-e14e88f647a4", "comment": "Malware payload (AgentTesla)", "value": "485277778f1f918eb565ac9909e65fcb8256e905", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713445670, "uuid": "66aed2b2-5662-4664-b642-897fcd5a89c1", "comment": "Malware payload (AgentTesla)", "value": "401201a1e5f8c882ef06620341fa4aba64effbd9bdfa0597a16ac2128f9e8ba188f981ec03071a0131bb5c052cbd9bc2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445670, "uuid": "7e77449e-b64e-496f-92c5-4b7d292b1a64", "value": "T11B35E23D1CBD2A3B9179C2AACFE98567F140D47B3A11AD7698D383954342A9378C313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445670, "uuid": "59069757-4fac-4851-9dd3-bc8f36165481", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445670, "uuid": "7be7f719-9829-4093-b710-ed028046bebb", "value": "12288:2wBHvctHj5r1gjcTT4KqAscgj7+R2+PgpP/xWKt55B2TXvkQK4s3Q75:fB0E4JjscgXk2+6pmkKs3Q7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713445670, "uuid": "7235f5d6-dec9-4776-abe4-24434a0ac203", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713445670, "uuid": "6434f823-abff-40ca-970a-e1137c3425a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713445670, "uuid": "803fe3b2-4b46-49b0-b61e-48f4103dc884", "value": "order 4500381478001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b2ac335-fd8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713448976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448976, "uuid": "dc0eeae9-843c-4859-8749-ed38890d9391", "comment": "Malware payload (Rhadamanthys)", "value": "b6c511480d3c76834e42b773836e76a9", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448976, "uuid": "e5ffe756-9989-455f-8484-17aa8b50def9", "comment": "Malware payload (Rhadamanthys)", "value": "c4e79437d564a08dacec5a0bb754c6f03d13333276c9a48253a247bef5742c0a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448976, "uuid": "3953133b-2050-462a-9265-0367f51af362", "comment": "Malware payload (Rhadamanthys)", "value": "f135c8ece764465c4e9ba8fded937f0ad4a5ab79", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448976, "uuid": "b5ffe780-04ce-4b9c-a328-cc6599167580", "comment": "Malware payload (Rhadamanthys)", "value": "64f785269b14751abc6ade93e236851698f03486208da41b31704a8e2eb94b54abb9f3f66d02aeb9c321752b1e597e9c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448976, "uuid": "db3cdc52-3300-44b6-aeb6-d117d899062e", "value": "T11A41FE0517FD1731E3F38A7614BA9731CE7BB805CE56AB1E019113885862B40F869FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448976, "uuid": "d7f32a11-8aa5-4b51-9d17-34e0823edddd", "value": "24:8faNkDmgih41Av94zcuhJBkOtp+/4O+8PxkIqdd79dsW28mT84abtl868z7m:8famDmCC9AJL67mfdJ9pn4a46q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713448976, "uuid": "81950b02-2bc3-47f2-a428-1f7e4409153a", "value": 2005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713448976, "uuid": "06ba676e-0489-4905-84ca-d688725aa966", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448976, "uuid": "efdab338-74ca-4497-99a6-495f49237fdf", "value": "SA161.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ace76f9-fd51-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713423581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423581, "uuid": "01caf4b3-810e-4b88-b5a4-8fea2e35de72", "comment": "Malware payload (LummaStealer)", "value": "5281a3b932a77491091881ab9141b523", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423581, "uuid": "9ecb2e27-f67d-46b0-ac4c-e0655dc84f68", "comment": "Malware payload (LummaStealer)", "value": "c5c773e7a27fa021cd656f7743c3351a6b42ec333533323aa049a0877707216a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423581, "uuid": "ca77a9db-b9ac-410b-bcd1-9ae0fef0b00b", "comment": "Malware payload (LummaStealer)", "value": "0e46cc3760599bd2c8b7964a6d771163deda7e63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423581, "uuid": "68c80938-289d-407e-a711-55a9e65460c8", "comment": "Malware payload (LummaStealer)", "value": "e164739f33f702750f317fbf87a161c33c5cde12dd364c0f7a956904dd81e5669ef7c21e379c4d19cdb938979946cf31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423581, "uuid": "00605042-1233-4645-b3e5-ae3b28efdd9c", "value": "T16C74E0C12790D83AD65255707D25E6E9AB6EF822DAE1C187777C17AF0F30390B23135A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423581, "uuid": "7b0ae241-6ee5-425f-9250-472bb7e1f6fc", "value": "96d5e40a6f183914c8bf0374fa1144d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423581, "uuid": "78309b91-22bb-41a5-83c8-271a514df6a4", "value": "6144:QLD4DtcToI6PA3H39LaYx7VkcngNoxmLjguKaDT9DKEaYTg:QG3I6oXVecngKxmHT9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423581, "uuid": "41879167-b8a4-432b-ae51-c7e0be1795ac", "value": 368128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423581, "uuid": "d72d20ab-5f1a-43eb-b428-5583c5c16f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423581, "uuid": "e03d46d9-6c14-4323-b6cf-162a28df4d33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "736776b0-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713467055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467055, "uuid": "f9ca0769-817b-4252-8ad5-9702b4479abd", "comment": "Malware payload", "value": "86b1dd888c6962715c8157a4d5e828eb", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467055, "uuid": "0f464b5b-75c0-4183-8884-5081f02126e6", "comment": "Malware payload", "value": "c65951ad4832c8590f7130a50cae2cd48b16ee394fb1ad548d4510652569b16f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467055, "uuid": "6f20e70b-6f95-4769-bab9-4a111e98ff68", "comment": "Malware payload", "value": "fcc2c7ee3723d7e13f0cf16c2109bc6f75752918", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467055, "uuid": "bd1f5650-4d53-4b18-b03e-45b3cbda035a", "comment": "Malware payload", "value": "38126a8b1d06f218841065e5b8e97264381060a1b20cff6051db5e431a9dec5a185222a389eb7dd7a50500ae484207cb", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467055, "uuid": "b9d947ec-222c-46c5-b83b-c28aa8ae2977", "value": "T1CB64DF51FE808A57E455037189F78B9B6321FC419F924B0B324CF72E3EB53A55D2BA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467055, "uuid": "92e97693-50c9-42c0-beba-d9ac323cd009", "value": "6144:hTunJgMY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVAwMI3/a7p+PkWPFcedGA:h+JgB3bVAwMI3/adrkFhGuN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467055, "uuid": "8a15f32a-5ac9-4484-af97-ef8631e51dd8", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467055, "uuid": "a9df4f98-4115-45c1-87cb-f7a456c24914", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467055, "uuid": "a95e85e4-83d2-4900-b6af-c9cee94a8b5a", "value": "PO_983888123.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9c162e0-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713472408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472408, "uuid": "39062f71-84d0-4bd4-b720-b8a48a6abff4", "comment": "Malware payload (RedLineStealer)", "value": "de2adabbce0147d01ae2fc5d80e9efbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472408, "uuid": "4b12da1b-c497-4b35-ae1a-77e05a131e9c", "comment": "Malware payload (RedLineStealer)", "value": "c6a9cf5bccffab4f117d72117c58d725d779ed907d449426eb93a86956d33947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472408, "uuid": "1fee5c83-b169-46a7-9022-61cc7715bc3b", "comment": "Malware payload (RedLineStealer)", "value": "5c499b18b0a6059a8266c14c2a7db79ef1511637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472408, "uuid": "58a8d224-c5e2-431f-a238-3f4f9613568c", "comment": "Malware payload (RedLineStealer)", "value": "b73f84beace631b1ba4bf5162a54236480451dda64edf1ca1286ecf5cbeb27dd42a3726a5d7c97488fec87adc0fecfd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472408, "uuid": "c13c9dcf-0ee9-420c-96bc-f469d7d78e6e", "value": "T10C459D3363918025FEA6B3FF5B55B23147BF6D250123851F12B83969A870163FE2D26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472408, "uuid": "05ddc4fd-e2b7-45cd-a196-4f63264a6121", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472408, "uuid": "3930e571-798a-4308-b48f-3e27c6b8ea05", "value": "24576:JAHnh+eWsN3skA4RV1Hom2KXMmHa1DIx+YJbBHtT95:Qh+ZkldoPK8Ya1kxxJrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472408, "uuid": "e8a5268a-18ad-491b-89f5-75e1f2b6329b", "value": 1219584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472408, "uuid": "f02d387c-2789-4dfc-bd25-3ee790a811a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472408, "uuid": "2855d883-0050-43ae-b445-9762ba088ba7", "value": "Arba Outstanding Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22eba9a6-fd3f-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1713415810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415810, "uuid": "81e8f60f-556e-4ffe-9ab6-a2f4996b4e6a", "comment": "Malware payload (Amadey)", "value": "f6ee2a295cd2ba584f9a363ade3d55b3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415810, "uuid": "467749ac-2205-4d92-a821-90daecf4d155", "comment": "Malware payload (Amadey)", "value": "c92ec1cea5a09af2f334a2e0d127f41827855c21c5e725afb702ec29e705d1f3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415810, "uuid": "b2333208-c23b-4a79-97bc-ff12dd62991b", "comment": "Malware payload (Amadey)", "value": "c6966445c9adf9a0afe1a62b91d1e4f75c5ac55c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713415810, "uuid": "d56473e4-62e9-41aa-9668-628cea9f5ccf", "comment": "Malware payload (Amadey)", "value": "fdee973bc21536dba5623384a6686211debc363b4ab1a1653f131e179063e959d8704a8c423f847a273741f3185964df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415810, "uuid": "3453d20b-93fb-4b79-a87c-900a261d19d8", "value": "T14794F112B640DC73F55648748A27CBA47A6EBC7196B9518B775427FF2E3038082EB336", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415810, "uuid": "943e1523-9acf-4f51-b74b-c8bc97d272a9", "value": "14ef0fc1d4be9b1c7ae01c60ea12a8bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415810, "uuid": "7d4df95c-0d2d-4247-b7b9-abba6825403f", "value": "6144:vZLBvj27DEXhnzCaknvrhHq6p5Km/OZ2iqzUhYA0FvYgtv3EagG64/dAdUcgf:hd72YmQ/mWZUzGUvYgt8FGBxcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713415810, "uuid": "48db782f-cbe1-4ab7-95b6-9009c4bf28fa", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713415810, "uuid": "26bc6dee-11ea-4cbe-b169-2cc36d3a1998", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713415810, "uuid": "b6c32399-c519-4bce-9040-ed3fde9c3c37", "value": "c92ec1cea5a09af2f334a2e0d127f41827855c21c5e72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca128535-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470637, "uuid": "79d6af1d-eecc-4938-9308-29cd6c70e6d2", "comment": "Malware payload", "value": "c4f6352a4cf74fbf3a9634cd897de59f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470637, "uuid": "c87d8a61-32df-432d-a627-2c39736a0e13", "comment": "Malware payload", "value": "c97933a8eceefe37d3283c5930b456f90bad0b090c53d9a6a8e29ecb5798f8a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470637, "uuid": "14db4682-7c60-4f22-a070-4bf88d1998ae", "comment": "Malware payload", "value": "ceffd683664dec104c424008538f13fe3e633dbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470637, "uuid": "52457e76-bb55-4eba-9421-b2999bcc4166", "comment": "Malware payload", "value": "8cb5a30d43f6578a8dd2aea6823438aa8590e77ee10c77dcc4f48aa83b8e59626954969fb52443fd94e444be6ca8ba38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470637, "uuid": "3db6571c-e88f-4833-a1d2-8b6f2fa83646", "value": "T186E34905DB408B17C1E2277AEBDB424933339B54A3DB33099638ABF43FC27995E26516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470637, "uuid": "ade8e1df-9dc5-4839-b28c-19821c6d1b35", "value": "3072:ut8iFDKEfFN+Fa+1sWCh7nI8txVpUMbmQwfCMQiGW:s8iFDLf/+FaNrh7nI8txVp5mQwfCDiGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470637, "uuid": "aa556d2b-0138-4394-aa3d-18cd886f585d", "value": 150049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470637, "uuid": "0dee2442-10aa-4199-96d6-39b144cf2f30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470637, "uuid": "9e423196-ea61-4f05-9b20-a5a3d87a2989", "value": "c4f6352a4cf74fbf3a9634cd897de59f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436c76c8-fd66-11ee-a120-42010a9c002e", "comment": "Malware payload (RevengeRAT)", "timestamp": 1713432615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432615, "uuid": "b22820c4-96ed-463b-a2fc-88db4ddca44f", "comment": "Malware payload (RevengeRAT)", "value": "17d0b9ac75dfd038ac11c64940a5a6cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432615, "uuid": "9eb0e97d-4c7c-4e79-b064-e408f718175f", "comment": "Malware payload (RevengeRAT)", "value": "c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432615, "uuid": "b59741bb-6f43-46c6-b54f-af39b6c19cb9", "comment": "Malware payload (RevengeRAT)", "value": "fdf4a6d488ba2220c808a8e233ea0e219273c3b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432615, "uuid": "b34ba0a4-3753-4d04-a85e-e03d6628fc99", "comment": "Malware payload (RevengeRAT)", "value": "50fc76a1171b00c05f050167500226aa3e0e0a5c599a1a549dd97a96d77ac64b34e91b7164bca5598502f4524138827d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432615, "uuid": "d725fa96-50a0-45c4-9859-3448f0840c8b", "value": "T13B84234162D8413FCBBD577606B022415A336367F02BEFA95D98C05CED82BC587B27BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432615, "uuid": "cdf6901e-7a6b-4e41-a976-eca0a076ff6a", "value": "6144:/IWyveo8OzcrumMozCE6+bIPEMMjAtUO3nDv4abP212gG7EXoiToLa:/IpvZDoruYeE6+EsPjA4a7mJWEZga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432615, "uuid": "5e96d2bc-b6e3-44ec-b7ca-57d5d19f3aa0", "value": 406640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432615, "uuid": "e0c2b4ab-674c-4a04-9787-44849f39cbea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432615, "uuid": "b0dffbe1-6655-4d26-ae19-6ce4f8014654", "value": "17d0b9ac75dfd038ac11c64940a5a6cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d969d62-fd2b-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1713407426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407426, "uuid": "bb9e9ac3-d69e-4e52-a943-9e8e0fd09db3", "comment": "Malware payload (Stealc)", "value": "867b7d371368f7872da473e89646aa0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407426, "uuid": "56928ea3-19fc-4068-900b-b8f28866e000", "comment": "Malware payload (Stealc)", "value": "ca3cb9514c8544017cef8e68c76d4abbb7028019d2db0c4ac4d88c29700743dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407426, "uuid": "8de66168-3f64-4115-929d-374ea650176f", "comment": "Malware payload (Stealc)", "value": "632e18c92f4e304dff18f8c6acfe165d7f5f538c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713407426, "uuid": "8c4700db-7a5f-4576-a21c-92f3a4cb0978", "comment": "Malware payload (Stealc)", "value": "5cdc78bb20389df0747d068b5ea7d58b7eca089276f07c092e20084a66b3a0a65332b3fbd2ef8ed817e517a3e4f6a2d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407426, "uuid": "c03b78bd-2305-456f-ab90-8f1b6772d946", "value": "T13B648D0376D16B70E63347325E6D86A4263EFD214E556B3B2B485E0F09B23A0D672F72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407426, "uuid": "f0503909-5ba8-43fa-9ec8-ff45cb334761", "value": "3c62679fe3cea3c660b4a0b83c80e478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407426, "uuid": "a0c667a1-f83e-41fe-a157-78137bfcf217", "value": "6144:JXkws5FHvbaXTLC42m+g51uHct7jGZyL:JUwsvbaXTLCfg514ct7aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713407426, "uuid": "e1945738-9b5a-4a20-8a00-532a0fff5ddb", "value": 316928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713407426, "uuid": "3d0767f1-f46a-4eff-8637-d0e14f3d8137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713407426, "uuid": "fe3250d7-1660-485f-8257-1d69219205c8", "value": "867b7d371368f7872da473e89646aa0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faa2bad-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434676, "uuid": "b2c1304e-bbc5-4b07-aa2d-ad1ab15ab5e1", "comment": "Malware payload (AgentTesla)", "value": "78a1ff0d4606e46358ad0fea96899339", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434676, "uuid": "900999f1-542a-418b-a0f4-9ac95b699b5c", "comment": "Malware payload (AgentTesla)", "value": "ca477265e67c6313738b85012acb71740d0ffc6a5e9ab38e8e512b7397c7e7f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434676, "uuid": "741be79a-1643-444b-9242-d44a628447cd", "comment": "Malware payload (AgentTesla)", "value": "cf7cbc850cb269650174f447332fa047572baaa3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434676, "uuid": "2d434efd-216d-4348-a0e2-4212f29a5ff9", "comment": "Malware payload (AgentTesla)", "value": "5e3951605c77f3509eb1e0bb6f65a7b21888c3010ccd759beef0aee46c3f081a88f17b314dedc1c3d0f27f6f16273eda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434676, "uuid": "bbc5415d-f3b9-49bc-8767-d5adb6765bcc", "value": "T10AE422B6A270DB27F5F4D7F08AC600D243F25796053AEB6A2EC2A6DF650BF510451B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434676, "uuid": "f764b797-a38b-4b4b-adbe-06b577b4b2e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434676, "uuid": "11c1e917-52af-4a5d-b0b6-0b37789853d3", "value": "12288:ZVk/nVjVDe61iDDsVxoT6tiis5IC2FaXq6jfuI852cWjoIK:kV+sVxoT6s2Fe1ArA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434676, "uuid": "bfb32abb-82f9-439f-bd02-9421c3cef5d5", "value": 660480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434676, "uuid": "fec4022c-aaad-4c80-8834-3fd9993ea07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434676, "uuid": "2254f941-a8eb-4610-a43f-06b56a9ab91e", "value": "DHL 0028374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26aa75cc-fd65-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713432137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432137, "uuid": "985ffbb6-ffd6-4b67-a566-0bc0ccaf4d4f", "comment": "Malware payload (AgentTesla)", "value": "ccdb29c0d8e287cad8644e0adfd56178", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432137, "uuid": "018e6222-4369-4f22-976d-b4e398cb1c3f", "comment": "Malware payload (AgentTesla)", "value": "cb06339a87bdd6284086a97545c32dc8a3eb3701c7642543e7c327d0539005f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432137, "uuid": "d8bce5e7-60c1-4179-bfa0-9533022e2f2d", "comment": "Malware payload (AgentTesla)", "value": "3b5534a7af776ec14a07dbe81cde5bdbb538dce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432137, "uuid": "c4b3b6ed-d75d-480c-abba-bca5f5869a78", "comment": "Malware payload (AgentTesla)", "value": "ff6c002f35a160206e58aa9ee9fe7b7a7e738f0b69bf875525c46adf39804d40ae68b7bbd661bc9f1f1635df40f0f696", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432137, "uuid": "1d6b3212-129d-4001-9405-4fcf48164bac", "value": "T1EB151357722D0B03CAFA1AF5450762292BF40259B5E7F3C98DD209E531EAFD49ACAC43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432137, "uuid": "36810468-242d-4ca5-9490-9a83fbc38330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432137, "uuid": "1073380c-3026-4a88-9cf7-4647940f058f", "value": "12288:6FCnt27FjOqHjvCcDRLM4o4K6GCj4jo5TIOTOJLUn6nwj7po+Cycrf5ehpph1yB:Zo7FjOy3D93ovokqOJLU6nwjRCspH1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432137, "uuid": "a154fd80-b5f9-4bb6-80b9-1397c32058cc", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432137, "uuid": "1a2c56d3-201f-4071-b5ea-82e86f3b73c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432137, "uuid": "d1341962-eae9-4d90-b1b4-14096fdf50e2", "value": "BKG#SGN2106728.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4976159-fda4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459407, "uuid": "f8f8a396-fb6d-44ed-ae1f-40694fee6b3e", "comment": "Malware payload (Mirai)", "value": "8e94a58a9ea60b7ecb5aca256902bbae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459407, "uuid": "2207732d-fb4b-48de-ae0d-77bcf6fdbe51", "comment": "Malware payload (Mirai)", "value": "cbab9972feafdbeb7d2a67fcad49b5402fea6480ad7b7cccff931bbc11b1cfcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459407, "uuid": "a9a99f1b-fb80-4df6-964c-bb359264a528", "comment": "Malware payload (Mirai)", "value": "a54f2fc5d503dc8baa67c0b5fa4efe84bf85856a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459407, "uuid": "587e7ea0-7091-4e55-b354-0a603346c0ba", "comment": "Malware payload (Mirai)", "value": "ce00b39fad2468594bfd8c663e4d28e91020a0ca5e9955cfb9d035e5ea8168d1bce70b95fa262fe5a0833ffb5b08f51a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459407, "uuid": "4422cc13-4957-4194-8bfb-c5d7a8ee79c2", "value": "T176330784B981AA17CAD543BBFA0E43CD37262398F2DE3217DD256F5133D652B0E6B052", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459407, "uuid": "3be5e51b-0318-4864-8d61-7c941cff1406", "value": "768:j9Fk5xV47mh0r7VRvWRVavTg7Ks18/jeJBbbW5LCDxwoCkQK93aTm5HzMIx:5EN+aTaFs12jeJBbS/oRr9KE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459407, "uuid": "02d80999-2dd8-4dc7-9982-1da58478259c", "value": 52880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459407, "uuid": "4786d4bc-2dad-426c-a008-522cf7ecbe45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459407, "uuid": "36c149df-54aa-4e52-ac96-88725134ad7f", "value": "8e94a58a9ea60b7ecb5aca256902bbae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc90387b-fd40-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416605, "uuid": "24140979-4338-44ed-9230-3cc9fe98cd83", "comment": "Malware payload (Mirai)", "value": "dcd3e254093f51ceeb0f33de779d9a97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416605, "uuid": "2b2f9ee6-6551-4abb-8719-812a1e2554c3", "comment": "Malware payload (Mirai)", "value": "ccc63c243c14f50cea7b6380ff613b5d24e1069125367e0923b8ddf913afcd1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416605, "uuid": "531d4d8e-5937-49ca-be4e-a121a27fc284", "comment": "Malware payload (Mirai)", "value": "88cdc38d90d0ed2f8051245121c47b6842ac2e6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416605, "uuid": "b0d725f5-9ca4-4b49-b34f-5d2d4cdc3cf8", "comment": "Malware payload (Mirai)", "value": "25a7aea027dfe893a6e7d7a7f15ce324d5e81a491afe5f59d47ee859ec05d5b118ccd63f583b808cb9871bf9fe3861af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416605, "uuid": "7de85a09-ddf8-469c-bbd9-469d2601736f", "value": "T1C1A35E17E1A19EA3C0435F7D15EBDA340B13A8865B132E72E61D8BF80A43DDEF848B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416605, "uuid": "b139129c-ed1d-4a86-995e-a9e8c341f699", "value": "1536:TL12949MK8vjLzHhHZzvhLO4/hFIfOjorkBKQ/P59Edvs8RQBsrhB:TBO4+K8vjhHZifOcwh9WskB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416605, "uuid": "c22f3990-588e-45bf-855c-cff17516e30b", "value": 100123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416605, "uuid": "9d9ab4fa-4659-48d7-b035-14e307cc5d74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416605, "uuid": "5b7606bb-4ff2-4faa-9551-0f86648a35cc", "value": "dcd3e254093f51ceeb0f33de779d9a97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebffa6b-fda4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459397, "uuid": "87687939-c698-44f1-a14f-2ed84740b6dd", "comment": "Malware payload (Mirai)", "value": "fe7342800b4725e95f0cc7aa9ec5cec0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459397, "uuid": "0236a33c-93e8-4500-9947-ae9adfcc6cdb", "comment": "Malware payload (Mirai)", "value": "ccf74c293c8d23babdf49dddd32fe6a2b2cfc64a203f5d54e1f0358a2e4b2d36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459397, "uuid": "5d416a27-9183-40cb-baab-aca0464cbbd0", "comment": "Malware payload (Mirai)", "value": "37940a15e4b233bf2337d5944e69a3b7961bcaf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459397, "uuid": "04729e59-05ab-42c1-b287-75040f3734cf", "comment": "Malware payload (Mirai)", "value": "50bbafc013224fd0c9c5643266705cb574106d1d2fc61ebd6875c00d696fc547c1b41d21161bb6cd7d6718e3acbbc15c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459397, "uuid": "40abacb9-d9f8-4fe2-949f-9117286e5396", "value": "T1F7335AD6B500EE7CF84FE77A84070905B131A35698432B372B63BEB3AD361944977E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459397, "uuid": "2956279d-4dcd-4a56-863e-7b5b24c262c1", "value": "1536:cFrXKDllysDVxWmJGmzt2X84wBSd8tvSJHBT:cMlBD3wmz4wB/v8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459397, "uuid": "9ab8f3d5-9f06-48c1-ab66-41b72dfc9c81", "value": 50420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459397, "uuid": "9d826d50-b5c4-40b0-bd34-a8daba494bf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459397, "uuid": "064056b4-0e29-4b8a-9dd7-295cf3390de9", "value": "fe7342800b4725e95f0cc7aa9ec5cec0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d0db8d-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425393, "uuid": "dcf92985-9703-4869-90ea-7cbef8648dde", "comment": "Malware payload (Mirai)", "value": "0fe8b4c612a6e8c840579328a02dc93f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425393, "uuid": "a875b5fc-a4f0-43fa-9b93-2aa3e682480d", "comment": "Malware payload (Mirai)", "value": "ce0f6a0246f408a1ca1ec77fc7e7341756d4d5dead481f219bc7c3627f2425d3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425393, "uuid": "75325308-9476-4d74-bd8e-221e7defdd1d", "comment": "Malware payload (Mirai)", "value": "9db360adc86b08b60ac07d9d2c7e3458ca184312", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425393, "uuid": "6a19f964-3c9c-4b7b-be43-c25da3a925da", "comment": "Malware payload (Mirai)", "value": "eedcb0464560aa06e938f117708257511c26c37d5d783f87d62231f6b94440396862b26e77ac6c50cff89e23d77f7f50", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425393, "uuid": "9f55d362-f668-4cb5-853b-2d479002d058", "value": "T1DE932902F5D698FDC046C1714B9F9136EA32F85C12347ABF2794FB621E7EE215A2DA40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425393, "uuid": "dfc8dbe8-e88d-4789-85c3-efc9bb6b72fa", "value": "1536:s4omC3eg0wN0l9bqlMQsqNHpFIBryA1t7ge6systBLIfQ0J3HvOpe4oEQ1It3R+F:svmIegj0ltQs7xZ71623dZTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425393, "uuid": "f45ec6b3-ce3e-4541-805e-d9d0106c9604", "value": 96200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425393, "uuid": "52db7e36-400c-43cc-a282-9b7bd5fe06d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425393, "uuid": "5a0e7fe1-99f7-4302-8b01-2aa41c3fd9c7", "value": "0fe8b4c612a6e8c840579328a02dc93f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864fad98-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433586, "uuid": "ec68c009-5930-4962-a69b-37cfc353b3d4", "comment": "Malware payload (Formbook)", "value": "070bb791b54d69cf9315ad07402c0c9c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433586, "uuid": "05ada2c9-06de-4fcd-9e27-a16cc76e746a", "comment": "Malware payload (Formbook)", "value": "ce102b74bcdd831d40a2b02e4d711b02bb29b4a70621b4d571c2c7cfcebf68e4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433586, "uuid": "a7806c04-d2ad-42c6-aac1-4700cc0598b3", "comment": "Malware payload (Formbook)", "value": "6123b3572d7324f03c34737698995eb925032afc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433586, "uuid": "ec6cbe2a-1f13-4242-ac3c-df225f6efafb", "comment": "Malware payload (Formbook)", "value": "dd643c911ad08bdb54f0ac1941468e6fa99b6d63ecddc4b9b8210772c753b7d22dcaef89aab910a33964e368673f21b0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433586, "uuid": "772f1ca9-01af-445d-b6c3-2ba1b44ed47e", "value": "T150543AA0CFCA26394F4B2FDABD60459289FC81990212247DE6D907AD7243D6CD3FED58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433586, "uuid": "07124d47-2922-4731-b4f1-9e7e687fafc4", "value": "6144:L7dAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOvK8InaGFoC:/nS2ImOTap4AET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433586, "uuid": "4617996b-4eed-4162-96c9-c379636f35b7", "value": 285280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433586, "uuid": "36b9d6b3-f474-439e-912c-2e357d89c983", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433586, "uuid": "8dda88d4-65cc-4b0e-aeb6-3ea3a9efba73", "value": "NEW ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e1e240f-fd28-11ee-a120-42010a9c002e", "comment": "Malware payload (TiSpy)", "timestamp": 1713405950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405950, "uuid": "4b58006a-1c72-429b-a5ae-0a5e9d27116c", "comment": "Malware payload (TiSpy)", "value": "b96678bd3e90470d73f8898c086b578f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405950, "uuid": "399531dc-f6ca-478e-92d5-20fe80788f59", "comment": "Malware payload (TiSpy)", "value": "ce839a0b60ed058c74783c1dbc54e0f90943f4b2e29f331ae9e25a0db1ed6ed7", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405950, "uuid": "de176268-fa1a-4237-829e-a5e0fd34c594", "comment": "Malware payload (TiSpy)", "value": "fafed961f596d6220af3bd6101e2ed2c5a146e5d", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713405950, "uuid": "3ddaed1b-4e7c-4626-b258-ce65c60e7ba6", "comment": "Malware payload (TiSpy)", "value": "44642161e0489eebe5ceb15a299c14e98942f0fde5f93c3e06cbc4f5f54e4446d4fef832dfb84eef2119b706dee5bc9d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false }, { "name": "TiSpy", "colour": "#DAF384", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405950, "uuid": "f2889158-034e-4166-909a-18450ec037c2", "value": "T12FE51203FA9285ABE5FAD3362A6A613964362D1003839315781C3BBF727F5D90FC66D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405950, "uuid": "b5f4e7fa-438e-4474-8451-14d922526bbc", "value": "49152:f2HhnnAfGw93mP/FuaQFwSDXotujaghgRJpjZx1dVwdtp/7T6e0GX:f2HhnKGw1mP/FbQCFtuaJVDCdtgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713405950, "uuid": "98b614da-1189-48d8-a0ac-1f835d1325a3", "value": 3263418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713405950, "uuid": "c5a8344e-67f9-478b-9630-783d34e65834", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713405950, "uuid": "b8dcc9cf-2ae9-463c-8877-0cbe2c9f63d8", "value": "WiFiService.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5df44a7-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439330, "uuid": "05bffd8a-3874-47d5-8bb9-9f5ea15b30b4", "comment": "Malware payload (Mirai)", "value": "36e93fb503023068a7f79e44e3ba11e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439330, "uuid": "cad1c898-755d-4255-984d-948d65197e87", "comment": "Malware payload (Mirai)", "value": "cf0c9b51e138c73cd0469b1e1392bdee6110a5a5b28b950a5c9afbeee03fd7ee", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439330, "uuid": "ed015b93-6efd-4d47-a990-69c76d7147e4", "comment": "Malware payload (Mirai)", "value": "8da8a789832148df81e699ff256401ceec50aee6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439330, "uuid": "23300890-363e-4917-8e1a-55c62cc282ee", "comment": "Malware payload (Mirai)", "value": "7c4d46edb7339c8ca1f2c8879a76c01764c2109838fe0069d88668446c2137b1b60280bebe4f3e0ca563571a202a0111", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439330, "uuid": "7e04a1fc-4caf-47fd-a9d8-6aa2cb841d29", "value": "T1CDE30A56F8819B12D5C111BAFE1D128E37131B78E2DE7312AD246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439330, "uuid": "3d7e2be6-b81f-4426-a0b7-dcee79fc7cf0", "value": "3072:0CKAUmbgWz4XFQ9YHwEaXrxqjBPCm3C95RjM:0CJpn4XGWHFaNW/3C95Rg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439330, "uuid": "1344ff6c-b58e-4685-8049-aa1a73ad8fc8", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439330, "uuid": "a9e4e0fe-d883-4577-830e-86b78117d611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439330, "uuid": "1c731524-e93c-4151-81ae-ac70935cbbcc", "value": "vlxx.arm6-20240418-1122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a90941-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713427760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427760, "uuid": "b16af6b5-ce5b-4069-a0e2-77d0cd255df7", "comment": "Malware payload (AgentTesla)", "value": "81f9e9a53c8597a4567a7731ee9a4294", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427760, "uuid": "12678824-0ba1-44f9-9d53-e771e90515d5", "comment": "Malware payload (AgentTesla)", "value": "cf2b5ff12f2950b4ff37add5f9f412c9dfb4965f8be16135d456e3c2da21bf03", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427760, "uuid": "ab681da6-724a-4737-9579-e1457cfcf0e8", "comment": "Malware payload (AgentTesla)", "value": "2959cb39a9cd09ed774a1dd9851572bd12f0743b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427760, "uuid": "b703c9f0-a487-4fc4-95bf-f16e82ced653", "comment": "Malware payload (AgentTesla)", "value": "60824fce25f04345eed15cd2e5c644d50bbab271f8872954c76deac8df47bc4c7a2fd31a5aeddadc05374ad9345f2f7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427760, "uuid": "4cc5b6ff-7b64-47c9-bf32-c85a4800c269", "value": "T1CD44DF2ED38E0269CB920277AB1A1E94A6FDBB3EB3905171341C437433DDC6D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427760, "uuid": "44f5ab6d-cf30-43ec-9140-566f22650e0a", "value": "1536:xf0Xvx3EMERsf0Xvx3EMERsf0Xvx3EMERYEbXb5/f3PS:xsXvKMEesXvKMEesXvKME6KXb5/PPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427760, "uuid": "184e68ef-3504-46e5-96b8-d8cbb0754504", "value": 256226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427760, "uuid": "d3f449c6-0cfc-4d3c-9f18-1ba9c00d9afd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427760, "uuid": "dec075b7-64a5-459a-886e-b575921d85bd", "value": "Scan 368 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe9feb1-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450863, "uuid": "16746e6d-4a31-4368-8088-8395df796418", "comment": "Malware payload (Mirai)", "value": "d16b61e028d33909019b5b7871e3e291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450863, "uuid": "90b0504a-bee2-44ff-86ab-4ab0f14689a6", "comment": "Malware payload (Mirai)", "value": "cf9259b6a78642be0495d041bde41bec828b4429e09d316861e74e295deb670d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450863, "uuid": "1eb434de-5b8f-488a-8e6b-1d57dbe056ff", "comment": "Malware payload (Mirai)", "value": "c0934180daae4b77ecac7704154c44b11ebaa196", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450863, "uuid": "2f89b987-b44e-48ee-bdd0-0192a9ced6f8", "comment": "Malware payload (Mirai)", "value": "6173a842396e2ff2ea36ededeeb2b731e39a5117f620b29509b3ea2e966d07d28fff89c76d13231724d36565003f6973", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450863, "uuid": "a6e2b564-5fcb-481f-857b-a9d43b5bc410", "value": "T101937DD1F743D4F5E89705B1513AAB335B33F0B92019EA43C7795A32EC92510DA1ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450863, "uuid": "f6ac9fc2-1f07-426c-b02f-a785eee21ba8", "value": "1536:0pG2cWAcCghsZcecJmR8TbDCFms8CasdPIYWdgtaEoSGtA6u0xZ:0pG3WrCEjecCIbDC0ls9ZWCt718u0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450863, "uuid": "738a3137-870e-4933-85b3-b4aee2be135d", "value": 89544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450863, "uuid": "2d77dbb6-808c-4bce-a5c3-8f059bf03cad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450863, "uuid": "2e8c3c6e-4634-46da-ac87-b56fd271f46c", "value": "d16b61e028d33909019b5b7871e3e291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a76a62-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439202, "uuid": "f25e7993-b0fd-45c4-828e-c1fd4dd09cc1", "comment": "Malware payload (Mirai)", "value": "a2bb5b45c69d04bbd52eafba6f9b0a90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439202, "uuid": "c13b97bf-d4aa-4576-acc4-c886eb3b8641", "comment": "Malware payload (Mirai)", "value": "d02fcc91fe2ff0c9255c07cf94ff5f542cff77bdacc1c44fd64b37cfde8f28c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439202, "uuid": "a602cac9-5283-4162-9892-3e67ec69fe8c", "comment": "Malware payload (Mirai)", "value": "0cba33129a90e386fe3dc34d8e2ca0938c4dc1de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439202, "uuid": "a66f118f-6128-457a-a6d9-bd7916f40084", "comment": "Malware payload (Mirai)", "value": "740a9af4e6c0f5a0bdc126ba1230dd336ac5122ca0f4878db5a946fc0313251f028bb71dc4af6eef8d38dda3370e1783", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439202, "uuid": "13befe9e-614a-47de-8741-b35d9e41aedd", "value": "T1E4433B4172280543D1A25EF0353F17E1D3FBAE9231E8B248795FAB59C0B1E336546E9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439202, "uuid": "3d5bbdd3-352e-4afd-8bee-8857949c5202", "value": "768:4FjKZDs8/IxOS5DUDkmXSnxV91KKfv5pux0uvKnF/2aR5S4qLu3vVJtT/9XeMIRB:4Nr5DvmixV9197/VbQurt5ob", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439202, "uuid": "3c67c5b2-1b14-4f58-a6e9-f6baa4f47acd", "value": 56348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439202, "uuid": "73bf23e9-0770-4831-8da0-5dfbde5ae4ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439202, "uuid": "a58146f9-3bb7-45f0-957c-3554ce5f6d45", "value": "a2bb5b45c69d04bbd52eafba6f9b0a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb8d8c60-fd3b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713414429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414429, "uuid": "24969dc6-27ac-4e9a-aa72-b95fbb00f298", "comment": "Malware payload (AgentTesla)", "value": "3825ed31a02b3d690c3d43a1e3808d1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414429, "uuid": "cd365fca-a891-4790-9b42-43709887f249", "comment": "Malware payload (AgentTesla)", "value": "d0bbc42f00f4cf1b59db6e2c2b13fe64bdd85c43e8209493b46119fbcc945db8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414429, "uuid": "ace378e8-0def-41a1-9923-a769e41f15f0", "comment": "Malware payload (AgentTesla)", "value": "82b16668205bd4ca4b5c6119be08a9cfcc5248d6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414429, "uuid": "b4a89ede-eb1f-42ff-91ae-01f6f9675aa7", "comment": "Malware payload (AgentTesla)", "value": "bbfbdf52b75882ddb40a0f2bca1bd0dcb5783765b6cad8dd5cbef6a4f4b6bfdac8189ce76b6727257d6907621132ac69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414429, "uuid": "6c1ae9c1-ea1d-4ff1-99d8-4075e7637e27", "value": "T1A2741207B7856A75C90E477EA0B913B917F58F8E183AE7CF5F2A30625EB73414846B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414429, "uuid": "aab55bef-d973-49d8-b708-d682185e225f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414429, "uuid": "3b57de3f-4211-4993-acdb-563e5bc3925e", "value": "6144:Xk67U5g5NTax7p9S44HtAs7EgaIgai/rBUEjh7g/+qUMwe/vqtapko+QZKAJ7CZz:d7U25NTaNpkRNA0Jpgdj3VHZ+q7ofZ7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713414429, "uuid": "d18b7d5a-f15f-4f56-9413-b8d81004f522", "value": 354304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713414429, "uuid": "7e58dc4f-418b-411e-9745-dde725f99167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414429, "uuid": "a77a949a-559c-4fc2-b281-a530da384d90", "value": "Leoch-Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5209ef7-fd89-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1713447811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447811, "uuid": "ecfd230e-14a5-40d0-991e-b06db63e77e3", "comment": "Malware payload (RustyStealer)", "value": "1aa6f499158d4b7141db67d7038cda8d", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447811, "uuid": "2913b98b-22c3-402a-9652-4d3d5db52921", "comment": "Malware payload (RustyStealer)", "value": "d0ccad2452cc0124d95214f9a9c5e4df9d842f97c6389c6e01baa0916306ad87", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447811, "uuid": "4031336a-6e1c-45ee-97ec-b3d74f86d682", "comment": "Malware payload (RustyStealer)", "value": "5947aa44d3c8e5d3e31667553dbdc104426b57ee", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713447811, "uuid": "6bf8cf5a-2e77-4808-a3df-1a582aacbc76", "comment": "Malware payload (RustyStealer)", "value": "e31934fc871e6cb81e7f79eeafe03330036467cd915410852824ea279eabbc68ee46ca7f1d3137016aec9ecd7f499765", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Patchwork", "colour": "#4DDC96", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447811, "uuid": "f185ad5c-a3fe-43ad-8d22-a27f8f2527e9", "value": "T1C9149E26B64154FDD46BC0B082969532B972BCC84B347EFF6690B3396D32AE47E3C644", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447811, "uuid": "ccb3baad-d5c3-4a85-9ed8-507fe459ddba", "value": "33ef024f7714441fd58d95eeed6ec742", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447811, "uuid": "fcd9b8d7-eed9-4c5b-bfbc-8f3406103ff9", "value": "3072:cNOEmZoEfUHeZbe3+xW3Yf+83C63QU8rgP6A6NL6AW9SI1eBzKR:c4BZ6S5W3kV3p3QU9iA8LvaSseBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713447811, "uuid": "94332c25-0dda-4f3e-b76b-65ebe6e125ca", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713447811, "uuid": "5d727eee-8f11-47ca-afbe-fe83641fae73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713447811, "uuid": "33cc64c4-7cca-4536-b08d-d1d6164b30e0", "value": "ueworoejvdvhruthqq3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c81a98-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419570, "uuid": "bb1d97a1-a8fd-41df-a7cd-309435ad0611", "comment": "Malware payload (Mirai)", "value": "ad718a5b8f961137491eb40c879e7371", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419570, "uuid": "92fc53a2-4c22-4645-be8b-45209f9eb488", "comment": "Malware payload (Mirai)", "value": "d1621315b91c23f25e341c24f99696a988844ac2a1a38c0b37fe1da2b37b89ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419570, "uuid": "a0ac2446-f903-4fb7-bdf0-e922d12a5d62", "comment": "Malware payload (Mirai)", "value": "01f0c1cb98e1ebb8e0cc84c528b78eb01dc4fe2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419570, "uuid": "98da4051-56e5-49af-baa6-b8519a9c8801", "comment": "Malware payload (Mirai)", "value": "c5dbdbe3f357bf2d7603c62d446f9757ff62ce3cab24b4b4da6b937b9e151f40cab41e7f3211210b5641fb35313b1ba1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419570, "uuid": "e834a45a-5b73-4ba5-b51c-6cd33400960d", "value": "T10CE34F86BFA13FBFD81ECD320295DA06129C4A495399BF7B2B74D014F68B14A59D3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419570, "uuid": "d23f75c2-8a66-46b9-b805-4e1ed18ac28b", "value": "1536:6V2Ut39z3lvqL3bkxbOYbDrL6EkuLxx8VDxqMElj+/zsrQ1:6AwdlK3b8bLxxobbEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419570, "uuid": "022af435-4749-4541-8f23-311957182311", "value": 145560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419570, "uuid": "63bde3ac-90aa-4137-9a08-55465a5de984", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419570, "uuid": "24b182c7-5e9e-4497-b80f-ec7e8232b396", "value": "ad718a5b8f961137491eb40c879e7371", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d848ccf-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1713433947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433947, "uuid": "ab6d6584-721c-4eba-82be-fc816dfcc04e", "comment": "Malware payload (XWorm)", "value": "312fb234c845479a9f3b807d0d641a34", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433947, "uuid": "a7a729a1-9884-41b6-9cf1-b77213a3007a", "comment": "Malware payload (XWorm)", "value": "d251da958096c3a2e568173eb890990e0ff82086e8daab5c98b5160d56de5a21", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433947, "uuid": "de457aab-b59d-466b-8852-6c803dda0554", "comment": "Malware payload (XWorm)", "value": "8ebcf0ffb96533414e968e35b406b21b486ee3e8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433947, "uuid": "029cc454-ea6a-440a-9e82-0225eb395146", "comment": "Malware payload (XWorm)", "value": "516999a3432cd60dcd9ab407440e52707a1c21bdb0211ca70d83001951511d3fe82cc34d491e63a9cada2eeb87cf20cb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433947, "uuid": "b6347215-cec0-4302-82ae-cebf8b785493", "value": "T1C7B3AD1267FA1208F5F7BB88A97611340B37BD99A97DC64C05CC280D1FF3A948865BB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433947, "uuid": "f818c132-d789-4eb6-85b8-9280a251cab5", "value": "3072:sZEgiBAJgEUPVZU1DHFUGmgURDFBe0tKl9CP4:gE9AJgEUs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433947, "uuid": "5e0a7efe-1a44-4c86-bf95-34841d4452b3", "value": 113682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433947, "uuid": "d42d6478-1fd9-478b-b4b0-2aa0949c6046", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433947, "uuid": "dd6c4534-6f15-401d-b4f0-54c0a1c290c7", "value": "F873635427.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b530c2-fd47-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713419226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419226, "uuid": "1d6c6372-c9ac-43fa-ba53-d05e135f13ed", "comment": "Malware payload (Mirai)", "value": "ad3d9023dad469be0137fe0c807ba137", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419226, "uuid": "5b9531f5-e5f9-42c6-ba06-aeca456a31ed", "comment": "Malware payload (Mirai)", "value": "d2dab3b9059fb69eee55dccc3f8d146283ed798e9d144da2c35934017c408802", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419226, "uuid": "53cffd6f-36de-4ea1-b0cb-63935183168f", "comment": "Malware payload (Mirai)", "value": "94646f589b63cbf49e13a2cee3de03a138f341a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713419226, "uuid": "2c7c12d8-2ac6-495d-9170-7f6843c105a9", "comment": "Malware payload (Mirai)", "value": "a2e136d8420cc141d9554451a5d2c5189958f91b9b89f5fdf9642e486a06035cf19676679e23a4d22358437053982054", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419226, "uuid": "7cc346d2-2478-4a03-86a9-f12ffbb55170", "value": "T1EAF318C7F901DAFAF85AE7370C430809B230B7E145921A376267767FED3A199142BD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419226, "uuid": "ca6ed66d-6ae3-4435-a24d-9a664cb4e01d", "value": "3072:pZVjYvOkbUqZ8QeuacWjcW0JcWcBzf5NBRz/WKiRyVdUjLlK0e8kDqW7:PVjYX8QeuacWjcW0JcWcB75DRqKULzeh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713419226, "uuid": "b6656881-4138-43db-9205-da1192fcc536", "value": 164680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713419226, "uuid": "4e847dfc-114f-4ac8-ba20-8bfd070b44f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713419226, "uuid": "fb5d561f-8810-4292-b37b-031a0941ee10", "value": "ad3d9023dad469be0137fe0c807ba137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c736ffd2-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433695, "uuid": "8d46e0f2-e04f-4e72-a2e3-57396b3979b9", "comment": "Malware payload (Formbook)", "value": "b0d609c63eb6a410a68d2b76b2890e1b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433695, "uuid": "fed1ccea-bdf8-415f-b0d8-1a1d39ea11cb", "comment": "Malware payload (Formbook)", "value": "d3db343db4b6aba8724b8b6eaf2f837443a6fc03f5aa3304f168f7eddc473ca1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433695, "uuid": "305f45d9-6d4d-40f9-9d59-d2ef0e6aef25", "comment": "Malware payload (Formbook)", "value": "7b24550e251bdfeebea6adcaa38e0bb5c48a2b24", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433695, "uuid": "ddc0de50-7037-4457-8b30-ea401337430d", "comment": "Malware payload (Formbook)", "value": "dd5569d5960ddaad23f61b427d730602db1a3863b5472e3dfd7aaf0401f187d7371ea3662cfc11a9f7bcbc078b886351", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433695, "uuid": "5e5de786-c3f4-4377-87db-b76dbb5494bd", "value": "T1ED2408F0CF0B36199F5B3EDAAC6489924AF54195051238B5AAD807EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433695, "uuid": "2704f5da-c7c3-48fc-91f2-8f4bd669a3a6", "value": "6144:pYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfBQqs:i2dOE2M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433695, "uuid": "aa785c49-3575-4c57-9679-206829156eaf", "value": 211420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433695, "uuid": "6b3abc69-c85c-4e97-8cf9-4d3663b9ca36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433695, "uuid": "000bf6bb-663d-419a-b1e8-ce352cdd234d", "value": "20220830_ProtecoPTE.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c550f6-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425427, "uuid": "c57e8e3f-2a26-4637-a8fd-488af1a5a814", "comment": "Malware payload (Mirai)", "value": "c24d81ebf3483fde718d20064d0817ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425427, "uuid": "7475fd89-5e72-469e-ae13-79404cce3766", "comment": "Malware payload (Mirai)", "value": "d40205245ed1ca9ce3f55730a1cf2afbde414a8ce06a4cfce853657a2a9ee7e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425427, "uuid": "71f1d90a-308f-449e-9fe8-ae88acd2b2c5", "comment": "Malware payload (Mirai)", "value": "40842dc0a0ad06b4f04ea1e11dfde1a2106f4b3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425427, "uuid": "faff5c8f-1bb0-4773-b033-081734eb2219", "comment": "Malware payload (Mirai)", "value": "2545a8a924df5d4c5f33dff62cd1c5bfc642313fdbc03cf1d604ac994da672f6bd3cfbbe83098b458961776ba8c3f483", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425427, "uuid": "170dbe0a-bf26-45e8-b173-0b1e8d6dbc7b", "value": "T18333C5A178916A2BC2E0137FF9AE618D336067A8D1CF322BC9111F15B7C562F0DA7B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425427, "uuid": "ee647bfb-8c35-4bfb-9c07-06f14e0eb479", "value": "1536:9I6mvHvT8kHTwOIjMxA0ouH/zY4XsAlDFZ:q6oHvT8kAMzkqDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425427, "uuid": "b4c0734b-6ba3-4fda-907f-7378b70743ec", "value": 50540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425427, "uuid": "409cdf6a-689e-49a8-b7d8-65c4547cdaa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425427, "uuid": "09ab328c-ec05-4e80-85b8-52158b782869", "value": "c24d81ebf3483fde718d20064d0817ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51538282-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433927, "uuid": "3d2df035-897a-40a8-8d9e-83d7cafaba97", "comment": "Malware payload (Formbook)", "value": "3e59a048b4c55ae53953b30ea0c5cdfe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433927, "uuid": "02f62b6e-145d-4b0c-9688-dcbbc91365a4", "comment": "Malware payload (Formbook)", "value": "d4f7376ce3cde768b5cc8eeed40516fa7d61b02336eaa19534dc4418b8cd201c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433927, "uuid": "95147fb0-6ce9-43cb-8758-0c4968c17262", "comment": "Malware payload (Formbook)", "value": "628c1517013bca67b8a0c45aea707d57df78207b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433927, "uuid": "4025a224-8680-48b7-ad59-5427f90599e2", "comment": "Malware payload (Formbook)", "value": "c6939b3ec110207164af503dcb479032f445ae489daca54f474395274ef7faa83621b0a69a8fcf38fcaff99b998d1a4f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433927, "uuid": "846a1061-cfda-40e6-b9ab-bf7472369f12", "value": "T1F424F7F0CF0B36199F5B3EDAAC6445924AF88195051638B5AAD807EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433927, "uuid": "910052f5-4a96-4756-a5ab-3665f7cdca6b", "value": "6144:OYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfzqtH:D2dOap9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433927, "uuid": "bc8d71ef-47d9-4931-a423-3c56cd96013a", "value": 211052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433927, "uuid": "b1148c28-8fed-4ac3-89e9-f4b2d09bc408", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433927, "uuid": "f40cfcdd-ac27-4f16-9606-67b4bff38581", "value": "20220829_PEDIDO_22073M_PROTECO_LIMPIEZA_Y_KITS.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055b1d86-fd5b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713427786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427786, "uuid": "ecffcd11-9eec-483a-82be-de0708b0c042", "comment": "Malware payload", "value": "1b73adcb8a81f3c16c93d068ef96e71c", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427786, "uuid": "2952c4fa-2453-443b-88f7-714549743e4a", "comment": "Malware payload", "value": "d54c6022fce79e44ae05bba1f148fe83b3991c7c6bd8a8efd19f4d615bf15a96", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427786, "uuid": "6ac42726-c4c4-4475-9d88-223c7b0b3e17", "comment": "Malware payload", "value": "51a531d12af8a4146a1986c81062b52d97d39f3d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427786, "uuid": "0fa3fb98-d73e-40cd-8708-e92b0ee8206b", "comment": "Malware payload", "value": "f5b863aeb4987f2adf20a93c30be70bbccd91bbfe1195d08aeed5c45309f62c7856b15f18e75d605ed436e72a8e7700f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427786, "uuid": "7cfe71c7-a129-4c68-8031-bb5c6db373a4", "value": "T11064D011FF81875AE089573549F74AAB6225FC415F924B0F325CF72E3DB03A45E2BA22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427786, "uuid": "3531a8ab-7806-4f23-a0b9-7a5de20e3050", "value": "6144:1nunJTGY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVZWMICQVgtxNQic6b/As4:1yJTf3bVZWMICmgtMKbA3PR/yHU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427786, "uuid": "869465fb-6ca8-4eb8-9826-2ca9f899a9a5", "value": 327168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427786, "uuid": "f49f498c-7550-4200-9174-7c0bcd6c3b7f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427786, "uuid": "9b894bb2-c9a9-4c4f-be26-110f1293fcc3", "value": "11587 DUBAI BURJ KHALIFA LLC SUPPLIES & SERVICES CO LLC 6000083650.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecdfa413-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713472413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472413, "uuid": "791a89c3-db0b-47ad-ac0f-44903145ef92", "comment": "Malware payload (Loki)", "value": "b97f50f5954944ea4606400cd4d90968", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472413, "uuid": "2ec4941b-7cf4-4d7f-ac40-364b9d499fb4", "comment": "Malware payload (Loki)", "value": "d6082d4057d6d365a29065ea80c9c464141415393b1fca3d5ba5c68beed9e37b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472413, "uuid": "e27ef086-8f88-4e28-a762-b130a00cd182", "comment": "Malware payload (Loki)", "value": "0a1f5a7e6450b941e147e5b4f43fec4bc3352c04", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472413, "uuid": "05aaa541-82e2-4e55-83b3-119f4bff67e7", "comment": "Malware payload (Loki)", "value": "08c803294ca7a21c4b71f1e92b9c1e40774a982281669aaf6eb27d1c38613857d96ec8cfd3ec8efc625607e308fb6d9f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472413, "uuid": "f70d1257-257d-4391-a001-a783c1fd3f66", "value": "T1B9C423439DD867407810BE0D07B5FA3EE65706D721E256F39F36B0D90E2A1A2E7E42C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472413, "uuid": "573e7d91-ac90-474b-af71-352b804ee4b0", "value": "12288:XygChlSMUma21KwcRaWr8jC/CAtgJP2kGzx/gvMlJUBHNSSBjUlmE:XyB+MUmFOz6AeJwIakQ/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472413, "uuid": "7f94a647-dbc9-4f49-b0d4-1f8cb68f1f5c", "value": 558383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472413, "uuid": "71d2d426-00ae-4347-b453-a4d93ed2afad", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472413, "uuid": "58f93abc-f1f9-4e91-95e4-28ba7e29ac89", "value": "DHL Shipping Documents_Awb#290132721_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97439a8e-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470981, "uuid": "4d979e4b-e462-4b65-90f9-63ac288d0014", "comment": "Malware payload (Mirai)", "value": "7ea93bc649d53c24353af71f91554b72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470981, "uuid": "35c3bea1-6ae1-4b10-ab13-84e3ed8a4e0b", "comment": "Malware payload (Mirai)", "value": "d61212c6fdd6ca3b1089639dee5089d0324195b595fb1e0b653a6f5ba9953871", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470981, "uuid": "59bbcfd8-27fc-4b33-88e9-318066a366c7", "comment": "Malware payload (Mirai)", "value": "72b6740c72e0106592ecb94cb55e704ebeea1672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470981, "uuid": "8b975b1f-d415-4d19-8cdd-c7b0d5a18750", "comment": "Malware payload (Mirai)", "value": "677bb0145648d3ebb23f071346dadab3e0c338a43543876491de22405b47d63830d4e7cce783111ebbec5b34198b211f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470981, "uuid": "53c2430a-6805-4d16-9814-ace3111c6272", "value": "T152634B51BD819723C5D512BBFB2F828D372653A8D2EF72039E266F11378682B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470981, "uuid": "fb334b4c-5617-4f23-9e09-87faed9750fd", "value": "1536:0JxJQuWCYBAfHJO37jLTFkH4PevN7Xj0C6cMd/s1UAOQL:0JLfi/nFkH4PAN7Xj0ndkTOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470981, "uuid": "4b57242b-f6cc-415e-8ff0-ce15b110a46b", "value": 71564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470981, "uuid": "a86230f0-7b85-4a4f-b52b-76dac57ec96d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470981, "uuid": "3c598dd4-f8f9-4d6f-b6fe-db1a44544bdd", "value": "7ea93bc649d53c24353af71f91554b72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f8b835-fd53-11ee-a120-42010a9c002e", "comment": "Malware payload (DBatLoader)", "timestamp": 1713424455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424455, "uuid": "14b0a2fc-2be6-4e7a-94b6-35ca20e7666f", "comment": "Malware payload (DBatLoader)", "value": "c0851859dbaf5d812054e5e6177dc1ed", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424455, "uuid": "8aff9ebe-eb7c-454c-b7c0-21fc8dac2cb1", "comment": "Malware payload (DBatLoader)", "value": "d64831e184d899b8625be669e973af4620efe556344275644bf7d1cb122c3a3e", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424455, "uuid": "723d621b-70c5-4916-bd0f-5a103db76467", "comment": "Malware payload (DBatLoader)", "value": "5ae3400d0fc95799498476ec45a8a7db68c5a265", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424455, "uuid": "a8378791-6511-44a6-bd58-24a6e9dd36f4", "comment": "Malware payload (DBatLoader)", "value": "4f039de08f7fdba6f8cf0a8ab052cb36ac7884a5cc4da6567405ee4b11bc2d55b49639482d9e396a306c219979af829c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424455, "uuid": "af5d2bae-4c71-472d-afd6-06ac29277ef9", "value": "T1D0A5AEADD264D02AF736463C5487E3989DF96DE2A81CDB0739683184CF716E0360BAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424455, "uuid": "787d1541-ecc8-424e-ad85-6f9f2f91fcc2", "value": "3693314404800418c83d1170338a8d27", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424455, "uuid": "11f9953a-91f5-40aa-ac2b-57c1763816c9", "value": "49152:3ARQYxxZrm0UZu0LCi2wcc/Z9H7KtQDSxxZrmh7:3Uxu0UQ0LCccaZ9HU7xuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424455, "uuid": "8abbe6d9-dde8-4e69-ad67-ea103b38ddf4", "value": 2200064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424455, "uuid": "455c6c3c-1860-414c-87af-060b84eda209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424455, "uuid": "290b6e63-330f-4d03-8fcf-ec1d8b159f8e", "value": "Quotation 20241804.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10476926-fd97-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1713453575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453575, "uuid": "50cb8260-4813-48a8-8810-0407734c3218", "comment": "Malware payload (LummaStealer)", "value": "78838f5119a3229f8742fb24a70a482e", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453575, "uuid": "fa059d6c-6479-4051-8286-4955a2e78a85", "comment": "Malware payload (LummaStealer)", "value": "d6e6b4cc367d2870e59674ecfb09718725da12b0e5505457dd92a1c2425edb22", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453575, "uuid": "928a1aa1-0b40-44bf-b6d1-6590e2a78d36", "comment": "Malware payload (LummaStealer)", "value": "cdc990105379c5cdc9cb55b7526df5e23a4a7579", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453575, "uuid": "85a28ce7-0872-4a87-a19f-46d8130c31cd", "comment": "Malware payload (LummaStealer)", "value": "33b69cd1f802a81ddb1d19e7d69894f21c13f83dd119d27fc3f8f92f79149a8827a74fa5ead48e19857211d0b677ec35", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453575, "uuid": "1c63adb1-5bd2-407d-870d-df857582fd00", "value": "T19845ABACB4B5B94AF9E4037BC6852CF2DB3CA540DB993D8B8E2041567D8310E1F6B871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453575, "uuid": "6ee517a5-7872-43cd-9da4-84828170d70c", "value": "6144:KzGFLOWv+5GX+FYTGSAXst+lVmmBtHzqpyQBzbdDIVS+s:KzwOm+5GuFmGXcKYmBtHzqDPWSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713453575, "uuid": "24107a8c-4520-4d28-9c03-fac5185d0e51", "value": 1248356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713453575, "uuid": "254461b8-6d2f-4050-b300-56f74a95c1b4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453575, "uuid": "a347f3df-9a74-4e1a-9079-c5890fe085b5", "value": "Places to visit.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b7f636-fdbe-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713470648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470648, "uuid": "28dfd947-4e1b-433d-bc6d-360a8101511f", "comment": "Malware payload", "value": "93711b65b669db3db465caa4d185b187", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470648, "uuid": "10795855-77d8-437d-9c80-9d938900ece7", "comment": "Malware payload", "value": "d6eefeb43f024bb4a3bfe9fb8d27e097fa12a718f1012b502695506ce0e70add", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470648, "uuid": "edfb5916-1af0-4f72-9f52-b2f417740f76", "comment": "Malware payload", "value": "9de0c9a1cc524a47a8595f32b07a56be07bcc6ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470648, "uuid": "563f8e1e-7263-4c37-84a8-747a5a9c4e30", "comment": "Malware payload", "value": "010c6b191095415db59e6d3c80b834455043072e4fc0d49f9072392baf53349a4003e4bc5558b3d1fa014ba88888c55d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470648, "uuid": "9f4b4b77-8108-43d3-9846-668320f9c2be", "value": "T13EA35B53532D0A87C98B9AF02DFB27F187AAECA012B25644950EBFC41773BB41056F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470648, "uuid": "564c0d76-3a0f-446d-b9d0-8802654965a2", "value": "1536:DEg/+165BDtuS5Xap3SQuqomJd28C40W2tenAJfmsCskFw3DW:DXa65GSA6q7JdpomDski3DW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470648, "uuid": "90b9d94b-8dfb-49be-acc3-7e13d4b3b933", "value": 103588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470648, "uuid": "2c9be7c9-9d3a-47a6-ae41-99dfbb9e566a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470648, "uuid": "9526ae5b-de9c-41ba-8c6a-6ce3f7192668", "value": "93711b65b669db3db465caa4d185b187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cfa288-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433938, "uuid": "934cc959-a433-4904-a3f6-ceea23e69aef", "comment": "Malware payload (GuLoader)", "value": "f434d2c31f4b1d2924eb079796312451", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433938, "uuid": "63f8fbad-3343-4dd9-aeb0-81204c56f57b", "comment": "Malware payload (GuLoader)", "value": "d75d665b47f73c7a774f09eabaa47579aab1709b79a65a85e8fc7fc44a4b33f4", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433938, "uuid": "0ecc421c-6a2b-473a-a586-8a8ddefd8536", "comment": "Malware payload (GuLoader)", "value": "0a55fd2f3216f0c4e26f4dcac0064026b440940e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433938, "uuid": "48985ee0-9c22-467f-9ed9-f75354082d65", "comment": "Malware payload (GuLoader)", "value": "81177d73b3bedc41c43f69f91b1060641b903c7422db44cbde98092f74bffb323c162be1de9632408770da8e860c63c1", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433938, "uuid": "1ae7f5fb-4d04-4482-b602-2ce4255aa08e", "value": "T1FA2408F08F0B36199F5B3EDAAC6445924AF88195051638B5AAD807EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433938, "uuid": "7cc3d690-02ca-460c-aa81-6c7518a50e88", "value": "6144:MYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfJr80:12dOUxTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433938, "uuid": "4541a275-8515-4b37-aef1-127ef940cfaf", "value": 211324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433938, "uuid": "96b82c94-6256-47e7-b14a-2052c5d60c83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433938, "uuid": "8425142e-9378-43b9-b2db-a83aa1ac167a", "value": "Vedstaa.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabb9e6c-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713467148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467148, "uuid": "d60b4532-6b1c-4079-9f0e-4ce398a2626d", "comment": "Malware payload (Formbook)", "value": "1550c7545e2254f92020e2074b7de2c8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467148, "uuid": "b29712ff-024f-4c94-8db9-cc2135e50a7e", "comment": "Malware payload (Formbook)", "value": "d75dc44d39c0d5197b1c98f438bcc32998b55f9ff73d3577d664b2800d0429ea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467148, "uuid": "73e05347-19bc-439c-9216-ad0f4dd394af", "comment": "Malware payload (Formbook)", "value": "6261759927ec2a5570b04b58d412e37a535465d7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467148, "uuid": "e3300567-ee45-4c6d-bf7f-1317fb07ce8f", "comment": "Malware payload (Formbook)", "value": "1bdbe504da09835511bd752621cfceef994387ff5f65a667e79a746af569c80c583490d742248f35758a40a1a749ea28", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467148, "uuid": "abc32e4e-a472-4875-bfa9-c1a0b70ec9cf", "value": "T1D9543AA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467148, "uuid": "ff580f7b-a280-415d-945a-c038d9c132a3", "value": "6144:LmdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOrvL8cuHCfp:KnS2ImbFui9umF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467148, "uuid": "6349cd80-a57c-4e30-acf2-47ef6a72b8be", "value": 285625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467148, "uuid": "f5699509-3b16-4e7c-b0e8-6f6a0e5bb6d9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467148, "uuid": "0cc07e6f-ad3a-4676-82f1-469f27e87f65", "value": "order & specification.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec49d93-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713425145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425145, "uuid": "547f0dc7-bea7-4428-8710-769ce32281e8", "comment": "Malware payload", "value": "b26b57b28e61f9320cc42d97428f3806", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425145, "uuid": "639fcf2f-9bde-47ff-b25f-25396bcc58e1", "comment": "Malware payload", "value": "d76ce4776f4bffcf3b9d84cc7ed0afca5157257a459fed6ca21d68c986e2d63d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425145, "uuid": "3524befc-3385-41be-bb05-ac5270b72ed9", "comment": "Malware payload", "value": "6d494ca04455b3fd4265bafbdac782bcaafed538", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425145, "uuid": "ecce6c28-2b77-4347-be1f-691841c99a60", "comment": "Malware payload", "value": "25f51df7b37a973a779ac3a3a9111a0d8ef0b0312af33e2763e6753a42604d23f9f631c0cc86e90fbf4688845ac82319", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425145, "uuid": "34fce5d2-0725-424e-ad42-32e69f347004", "value": "T11292C48BB2914418EBF256781A7350789B7F3A00FA35CB9F629485091D34290FF39F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425145, "uuid": "2142ee9c-55fb-49ff-8cec-1add15b8a8b9", "value": "c8bf48e03c8c37268b47f1d2591aa6fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425145, "uuid": "8cb9e937-09e7-4a80-b930-ad8cf34a2abc", "value": "384:prwpQx/8pqH67ujksnWOFqgWJ+SSloQzC:prT/8gH65gWVnkC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425145, "uuid": "2265e3e7-f84d-418a-8468-9329026e4d81", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425145, "uuid": "bb7e0043-24a0-4bbd-8bbe-e4d3f75f1b75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425145, "uuid": "ade1e472-e859-44f4-bd68-3f7314b1facb", "value": "SecuriteInfo.com.Win32.ExploitX-gen.24917.16269", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e6bfa7-fd50-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713423278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423278, "uuid": "564a2cdd-b297-4fc1-afb9-68aa128a11fe", "comment": "Malware payload (AgentTesla)", "value": "d854ad99459a1e70fa9160197d8ef2a6", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423278, "uuid": "739c075e-8235-4144-80a5-dd3662747e4e", "comment": "Malware payload (AgentTesla)", "value": "d892be549052a31989a2e300f6fe21fc8a7855077857af28b47b41bd1220ec70", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423278, "uuid": "c0fe1aac-9fa7-4a34-9e58-efaa8f9ea343", "comment": "Malware payload (AgentTesla)", "value": "a85609ddd5f106b2437fed138bfd52387f0155c9", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423278, "uuid": "c413cd53-2d3a-460c-936c-1d1994adfc84", "comment": "Malware payload (AgentTesla)", "value": "43cc91fd927a10919510b4cae4793b152753ff04e0550167be7badf6cfd73c57d4758557ae94f8b3919cfa5117320572", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423278, "uuid": "3212262e-04b0-445f-aa99-3d890474e582", "value": "T15E4423C9A7A7D72A89A227CA3B7D3939B529CB606D1E4153D3004BF016C5C2C9B5DCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423278, "uuid": "a2ed2b01-f0fd-4131-81a5-b4803958a5c9", "value": "6144:rEs/KkkT4JR8lU/TFLf8TEIke23Oit9wWi1i1C:N/ho8iU/TzIkDMWiQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423278, "uuid": "d812edc3-bd8f-492d-a994-7ecebec32c6c", "value": 273400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423278, "uuid": "aef69cea-ddf9-48d6-881b-d9b17e0f0782", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423278, "uuid": "5fa21bd3-f19c-47c1-9ec9-16baaf4adee7", "value": "Leoch-Purchase Order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698a1a5f-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425377, "uuid": "87f7fa3a-fe35-4987-a3b3-fe9341e944ea", "comment": "Malware payload (Mirai)", "value": "5b91d0145d928f5b1d88fefa32453883", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425377, "uuid": "cc506277-c289-46a7-b4f9-1443d42e3371", "comment": "Malware payload (Mirai)", "value": "d8bbda334ced438055d2d337ba368af1a0ee53ccececb6c6485408e60326afcd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425377, "uuid": "4ce4b2fc-e590-4d5c-a201-92c3c4d7e103", "comment": "Malware payload (Mirai)", "value": "445d0469ccce36d09ca2861c673b83310198e101", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425377, "uuid": "8fc5b7eb-afcb-47af-8322-8586ab29fbf3", "comment": "Malware payload (Mirai)", "value": "d80cd5e290297f0f46eb85403adc39ab7ec22842399dc3c707a21e2aac883c201fa06ad769d0736a194932bdfce9dbd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425377, "uuid": "a1891bbf-47eb-4eca-b244-e971d500d73c", "value": "T1BB24852BAE50DF59F65C87310AF76D38835A23A626E5E64AC19FC2006E3131D5C0FEB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425377, "uuid": "c6cbb382-4785-4bb8-9eeb-91660199e510", "value": "6144:44WhL54943dsW+8ofdLOgrUiZi2PEL8aQTFb1leWKk:4VL6tPELLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425377, "uuid": "4ea8555e-6a0b-4b50-b548-d224ba3556cf", "value": 228808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425377, "uuid": "8948f87f-9496-46f5-8a6e-50b74cbadf85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425377, "uuid": "2af6c3ae-fe66-498f-9c31-74fa07aed4ad", "value": "5b91d0145d928f5b1d88fefa32453883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4c2677-fdd4-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713479932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479932, "uuid": "9225439a-1c5b-4cd2-a060-5a93c9854cea", "comment": "Malware payload", "value": "873d3f98aa31a6d5802e2033bbfa8ce3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479932, "uuid": "46e30698-6928-4d6a-8370-9e06bf2c3169", "comment": "Malware payload", "value": "d9a6afcf1f17010c8432b8725d77eececa4d8fdfbebf3eeaf8d1d2d31f9bd9e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479932, "uuid": "2e29e9c7-0484-42bd-a082-22f698d9ee57", "comment": "Malware payload", "value": "1692b76af4b21f6c5e6fba7c54baf7fdc4e5d1f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479932, "uuid": "1a6e5697-5ec3-4619-b768-eb0a7b58d731", "comment": "Malware payload", "value": "daa4c2cf3a6c8125df92d1cd6c36beaa35ac24b54c7c521e8423a512404833d71fd70dafab2d204dd658eeefd40360f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479932, "uuid": "1fbf3a53-f78a-4705-aa16-bf71cea77c7a", "value": "T125C4D562E541995BE43B3238011247392222AF547427D8AD29BB3D6B3D76E4F0D1F2FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479932, "uuid": "f2c9b275-0264-43fb-9e01-bac794187191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479932, "uuid": "9e6392af-94c2-44d7-9d78-f556c5663197", "value": "12288:VvDZzYGzVAGLfOa9QpJIGzVAGLfO2GoVAGLrS:kGpAGLffQpJIGpAGLfnGKAGLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713479932, "uuid": "8bc28a82-7810-4373-ab2b-b11574b15341", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713479932, "uuid": "450ca3b5-a109-4f35-b544-d62ec7bf81e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479932, "uuid": "30e3be72-aaf0-4f9f-8cbe-b752c2d3bd20", "value": "SecuriteInfo.com.Win32.AdwareX-gen.9076.19863", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42dd0aa5-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433903, "uuid": "59c460f1-11f6-4705-a06d-a8193c7e6ebd", "comment": "Malware payload (GuLoader)", "value": "ef88b5a7fcd4cf299484082c221af7ef", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433903, "uuid": "2181313e-c019-431c-af44-7241cbcd99fe", "comment": "Malware payload (GuLoader)", "value": "d9e40ac134d9cd16edfe7d9214f692fa896da738acb1d15bb45054de45fba217", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433903, "uuid": "66c951a1-c8a3-4887-9ae1-131b1944a3b3", "comment": "Malware payload (GuLoader)", "value": "94e49bb927ceedcfeead02da1cab031fd54fcaac", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433903, "uuid": "0e5b076a-f41c-4d5e-881f-0da1f87c0560", "comment": "Malware payload (GuLoader)", "value": "7adb74f960f1ad32b909d1c8d4b278c0e3fd56620eeba8ce6e41b252e6bcafbfd1dfe7439c7d92cdbe0eb556061053bb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433903, "uuid": "5c338853-3aa2-4fca-a1c3-48d31ad2eb48", "value": "T1FA2418F08F0B36198F5B3EDAAC6445924AF98195051638B5AAD807EDB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433903, "uuid": "4411c7cb-af86-43a6-8cf1-e7293e92316e", "value": "6144:SYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfOjnK:H2dOMrSUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433903, "uuid": "b12a56af-0b56-44c4-b278-38c6e6c83b00", "value": 211175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433903, "uuid": "b39876dc-ffe1-4fa4-b298-359fc2a0edf0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433903, "uuid": "35ba8ee5-d8d3-4d17-8a19-1e274dda2006", "value": "Transferencia 4334300002017359pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9936808f-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425457, "uuid": "a7be4bf3-1164-4899-8af2-6221385be910", "comment": "Malware payload (Gafgyt)", "value": "6e4e7980d73db00be90f8dc207d3b3da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425457, "uuid": "2d9df65f-458e-4d03-a8cf-a2aae38172b9", "comment": "Malware payload (Gafgyt)", "value": "da496760a579fe1297175eb1eda4f0d391786f3ca5a3f42ffd1bff39616623db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425457, "uuid": "5e730c08-c25d-4d2f-8995-df09db00d257", "comment": "Malware payload (Gafgyt)", "value": "9e4182bda353cc144db438e6a707dfadacfb4e62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425457, "uuid": "cfc51cb9-2862-4362-abdb-7847d70b76c7", "comment": "Malware payload (Gafgyt)", "value": "098f3bfb3f4ad03d312f8202bca8f21da2668752d62ac2fc20e3497054e57bfb873d12a8f688019a1cbe7622f828eeed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425457, "uuid": "b2baed04-4519-4e85-84cb-69362d504dec", "value": "T175244C24E5404B57C2E323F9AA8E428E3B3347E563D773154A389BB03FC2B9A1D75925", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425457, "uuid": "ab4b7685-599f-499d-a72c-c512f49fb631", "value": "6144:FZzyacCwXJ4DbpW0vF5hbL6K2axVOcgym0wfB5RyAn:FZzyacCwXJ4gS5hbMylgym0mB5RyAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425457, "uuid": "2984b6a4-0c17-437e-9df9-9a60d1fad04b", "value": 209606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425457, "uuid": "60577bb1-5674-4aa5-9520-d809448df545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425457, "uuid": "01ee3bc9-44c5-419a-bed8-8b36c4f4cee7", "value": "6e4e7980d73db00be90f8dc207d3b3da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "000492b7-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466432, "uuid": "2a878530-4f70-46cc-a3db-0634d2cf287d", "comment": "Malware payload (Mirai)", "value": "dec351905d66da15b979528022874d56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466432, "uuid": "88cb960d-2aeb-4cde-846c-18c17ffc2cf6", "comment": "Malware payload (Mirai)", "value": "dad10147c0bb8f5361ce19781daf645d0c1d1f4774ed3476db786bcb0883b7ea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466432, "uuid": "2f6f714f-56b0-4a8d-8e39-f814a6f8f88d", "comment": "Malware payload (Mirai)", "value": "43661cb046b2edb2bcc16adfb63c23bf6f1d2c2e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466432, "uuid": "ac9457f6-3347-4545-a525-eb7ab68df529", "comment": "Malware payload (Mirai)", "value": "1a5a503d00e3f214530cfbc19728bee0f533cc8a17f839a85c1295dd42007135dcaa16423498eb4831e8f001faa65927", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466432, "uuid": "bced5b56-3875-43b5-93c1-5a4c62ff433a", "value": "T1FE144B07B5C580FDC4DAC1B44FDAB53ADD33B4AD5225B12B67D0AA225E9AE310F1EE40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466432, "uuid": "b80d5ab5-170a-4fc6-b057-94db47c6505f", "value": "3072:5T5iDtg8xB7SZtbdguBkHo/J2JEG5LZwp8rUVTdr:5T5i68xB7SZtbIVVCTdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466432, "uuid": "68f53a84-ca67-460d-a4ce-1ec1d994338e", "value": 190544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466432, "uuid": "deea1ae0-5e5c-4cf2-8cd5-986bb53c4f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466432, "uuid": "11b601a8-a72d-4d5f-a3c7-0c81c11efee8", "value": "vlxx.x86_64-20240418-1853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dad0d8-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1713425398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425398, "uuid": "001d70dd-4e05-4c09-b5bb-0601a761edaa", "comment": "Malware payload (Gafgyt)", "value": "61cb47c6462b5b55a0ed412065f7b8a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425398, "uuid": "d0ee9796-0b68-4198-a013-8d297c6d7f85", "comment": "Malware payload (Gafgyt)", "value": "daddbed8cf66f2cd976966370de663642e457f31ddfcc872ad9b09385182b87e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425398, "uuid": "7f83bc3e-3f6e-48cf-a1f5-38abb34d3b93", "comment": "Malware payload (Gafgyt)", "value": "c1ec291daac104b125231683b4bff3b85d1f1917", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425398, "uuid": "2f88ded7-df4b-4576-b9aa-00f597960860", "comment": "Malware payload (Gafgyt)", "value": "1ce17bc71700be49605bc69f179644696ec1885d2b9aa58e1fcd5420de76fbdc4e8105e4c2b4088c1e252d6bfcb9ce47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425398, "uuid": "abec294f-c2a2-44e8-a335-96b865c75412", "value": "T1C1249479B7611EB7D81ECE7301DA4912188CC28653D97FABB2B8C618EB9794F04D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425398, "uuid": "3e286750-febf-4954-bc8f-960f6df4cf34", "value": "3072:T4mSFGv/kuidcX1qRdcB5hfH3TwpCMtmrpy6n9Nn:pn/ZmbRCB5hfXJMtmrpy6n9Nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425398, "uuid": "b1759f42-bc6c-4236-bf58-cff4c49ea440", "value": 214648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425398, "uuid": "677fe42e-65dd-4628-a3fb-b0d5891bda45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425398, "uuid": "ea4f8862-1fff-4a07-a69d-0100abf2d64a", "value": "61cb47c6462b5b55a0ed412065f7b8a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560d60af-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433935, "uuid": "238ba7ae-e492-41ec-82b2-0492dd722370", "comment": "Malware payload (GuLoader)", "value": "23684f7795d9b62ee53ed5c545830536", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433935, "uuid": "6f5491fe-7e50-4739-a15c-ffb1da76c3db", "comment": "Malware payload (GuLoader)", "value": "db47e3cd03ce51ea45db1e759e01fb7559543e59954bfccd6f98dd639c252a1c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433935, "uuid": "17aa2a20-523f-44a7-b9b8-8378b2b6920b", "comment": "Malware payload (GuLoader)", "value": "2105592ac4bafcb6f611cec7aa2b1f7588af5962", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433935, "uuid": "e6ef0475-75b9-42d1-93f8-da9c6688be7d", "comment": "Malware payload (GuLoader)", "value": "a98bd41129dc75e24fa77d75a178c3d24d36a282f6299aa462336b2df09ce8338f79b4c5248e13ae8ebbd86f5959ee52", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433935, "uuid": "fdf48470-7b77-4302-9a77-b4a17d42aa55", "value": "T1902408F0CF0B36199F5B3EDAAC6445924AF98195051238B5AAD807EDB283D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433935, "uuid": "dc86fa2b-9c57-450e-8a2a-676243f2a01a", "value": "6144:lYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJftq+J:e2dON1N5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433935, "uuid": "b2fda279-56bd-451e-b2ef-ca71d4c0f61d", "value": 211225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433935, "uuid": "5527b5e1-addf-4168-8580-d8361070919f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433935, "uuid": "c0762b83-b5f0-471a-8d44-02135f35af88", "value": "Tepanec.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d726b3-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425447, "uuid": "c4c9791e-ba27-47dd-a024-5ca25df916c4", "comment": "Malware payload (Mirai)", "value": "168f71a7b5ddccfc39f037b1100e6223", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425447, "uuid": "7b3315d3-8b30-4028-b458-b7bd1cc7097a", "comment": "Malware payload (Mirai)", "value": "dba7131ce072854b0a545afd853239c7b5edb87b820334ab1d367821a773f548", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425447, "uuid": "e6cb0099-64e6-47a3-8d25-d40c2831fc2f", "comment": "Malware payload (Mirai)", "value": "d5d2b28eb72a289eac53d7c1d85ea8d4b940246f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425447, "uuid": "3414b3c5-928e-415e-8229-7c232f01bb5e", "comment": "Malware payload (Mirai)", "value": "aebb95d48e4266a9532a0d82e4b6cfb5fc9e84cc4632da286c97d0242cf29b7d1a7d1611392a7d2bd582ff11b9acf7b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425447, "uuid": "4b77828e-9f47-434d-99c5-ac37096b13d1", "value": "T15CE36AB2D8356F68D164D1B0B030CE796B53E95085870FBA19A7C6798093DDCF60ABF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425447, "uuid": "fed7b247-fe6c-49de-8e88-aec9c86fd8af", "value": "1536:1phayOQ5pd3TckzF42sp6ECpGKUac2zvApKzZ9ULWnX/znJ7cRequdyH9:1GUhTcU42szE5U0ApKliLWX/N7seqbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425447, "uuid": "4b1c1604-9b28-4e24-939e-c83cbc4bdfbe", "value": 146212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425447, "uuid": "163c9800-27fe-4d79-8b47-6a638297b5f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425447, "uuid": "9e0fd7ce-33f8-40d3-b280-58323136aabb", "value": "168f71a7b5ddccfc39f037b1100e6223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed5e172-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713431024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431024, "uuid": "3555db47-dbd5-41a8-ad4b-5f0f5e55153e", "comment": "Malware payload (AgentTesla)", "value": "361f71c64cdcf7f56f8e6c2389401b89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431024, "uuid": "32a10c10-8c30-4c58-b909-323afd4bd628", "comment": "Malware payload (AgentTesla)", "value": "dbc99b1d313999e21fd15d8386d69d56067c2a578c9658fbff8f749e93f04eae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431024, "uuid": "d5e78e3d-ce5f-4eb0-aaf0-309155744c2c", "comment": "Malware payload (AgentTesla)", "value": "315b4b37555a2b0f82837a94753fbd36bad2f5fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431024, "uuid": "812f6a77-32dd-403a-8c31-037658463c11", "comment": "Malware payload (AgentTesla)", "value": "43993ec999776a625c5495b2c33e218345b5496b6b3bc621aeae969bea07b2b71e8ba713a49e19d89aaf987f45d3a933", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431024, "uuid": "10a2299d-dcb9-4523-a62b-6fa67ec7e59b", "value": "T12D2408F0DF0B36199F5B3EDAAC6445924AF84195051238B5AAD817ECB283D2CE3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431024, "uuid": "eac06fce-8d7b-4e24-9935-a72def94c0f8", "value": "6144:KYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfyq30:P2dONnpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431024, "uuid": "1c7a4236-6e7a-4dc2-b25b-6a219f033967", "value": 215828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431024, "uuid": "f98f2884-a34c-4ef3-9d9c-966597620ca6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431024, "uuid": "2a32977b-b887-4148-9099-52d8cd030753", "value": "FACTURA 130424435.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e34a4eb-fd3b-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713414192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414192, "uuid": "a481e35d-2273-4541-8cf7-564579c1c42b", "comment": "Malware payload (Formbook)", "value": "149275db93dd2dab22f5dc0356a774fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414192, "uuid": "5b2d8398-54b8-441e-b259-da23ad4790f3", "comment": "Malware payload (Formbook)", "value": "dc275961e09616fcda47d2acee085f1742c22e9066465eda4a06672d2efffc8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414192, "uuid": "03629837-be15-4ca9-a93e-2b6673f12759", "comment": "Malware payload (Formbook)", "value": "fd87ea7b7dc122528ca9efa769f4b404c49b0beb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713414192, "uuid": "ad93626c-d92a-4997-8d70-86d72adc4686", "comment": "Malware payload (Formbook)", "value": "3c7034aedebc5638fda14ca94bd11fa9e58aff2266c5a8fac95e62497967aab683debd2d4359409c94a5aa319bd9cc1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414192, "uuid": "3b6470c2-6b70-4421-90ab-bdd1b0ef72ef", "value": "T146F423313BE9AB22C8BA6FFD2524110093B678632071C74D5E52A1ED5D33B82DF1679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414192, "uuid": "c860ab75-a59e-4e7b-b90c-8b5ab21cd1bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414192, "uuid": "29ba4f9e-8bae-4965-ab33-f0acde423415", "value": "12288:pYhK/pbM0BjJlC+a+LMoUf0H+u4VH84v9htPW74hyik6tRKpad5rmWRwwAF7:ehiMYjnC++frVHx9h47T6t+Q5rmWg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713414192, "uuid": "17fada9d-c35b-402f-9538-31a93d4026a8", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713414192, "uuid": "262bbd97-5cc1-4d0e-809d-f9da320deefd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713414192, "uuid": "dbe7a4db-2813-49fa-aa0b-ae289a3fd18e", "value": "SecuriteInfo.com.Win32.PWSX-gen.27467.16755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99b1b91-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713471012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471012, "uuid": "9f3024c8-6423-43b6-8a19-8d6596bdfc78", "comment": "Malware payload (Mirai)", "value": "ea5e9f7997234e11e0b0287de4c74278", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471012, "uuid": "6ef017cf-fa89-47d5-8ebd-37fe8e6e9fc3", "comment": "Malware payload (Mirai)", "value": "de4b8bcc2443ba753603e83ee20d7ba1e35f4d38d9892a67ee5d286f7703f1df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471012, "uuid": "bf49766e-2918-4384-a007-2fc73232c258", "comment": "Malware payload (Mirai)", "value": "ac0e6d85fa6ee5016b760dd90271884b94bed36a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713471012, "uuid": "26233477-1b62-4a7c-9c40-3a3ffe2959a4", "comment": "Malware payload (Mirai)", "value": "e2393460690b3ae62ddea2d019c2dc2883bbc147948c3736a3a0a2f06cbf50c3f1904237f153762dad27cda6dbeb002e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471012, "uuid": "8d43414e-9a30-4a91-b482-7c10e8dc6dc5", "value": "T1EC338E22F0352D68EC211AF87024997583119EF560D71CB5DFADB5B21827FCCBA9D7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471012, "uuid": "c28adae4-7a46-478b-98e6-59460fd23b5d", "value": "768:d0UKOwKW2BbLYuCdRe+9ud8axKH+FnE/LhSVeJtkPTh:dSxmbLSd30xKHIRutW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713471012, "uuid": "323b5a33-3b93-4025-8c7c-0cae04bb81c0", "value": 53880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713471012, "uuid": "ac894aa1-7846-48fc-a5cb-9c2259c28614", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713471012, "uuid": "2eab4b42-494d-46e2-9e5d-afcf7e058ffe", "value": "ea5e9f7997234e11e0b0287de4c74278", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8516fc1-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439307, "uuid": "10929d92-cd9c-4be6-8c62-f82a9b0748d4", "comment": "Malware payload (Mirai)", "value": "07776e50a40797e2b8987ecf0ee49f84", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439307, "uuid": "e5de7e97-a444-429e-88ec-5e5fa28e2607", "comment": "Malware payload (Mirai)", "value": "de882995ef8d0e0860b987c1e0af8059baeaeef0dc3de83cd2eb177e6bce01fd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439307, "uuid": "aaff9ffa-71ae-4570-b0dd-afe958fe441d", "comment": "Malware payload (Mirai)", "value": "1dd0144bae6fc0d752d86f443e5a8a5fdf2d1d74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439307, "uuid": "48875860-e48a-485c-b3c1-2ccdfca2fbf4", "comment": "Malware payload (Mirai)", "value": "2182803b114ea36c36397a6a72d6a39aaaa0f6f7a0cea7831ce6a6459ccbdd6f7ccf6b5986ed3b51e2eb494aeac2309a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439307, "uuid": "d870b85a-b842-441f-b017-27043f01238f", "value": "T1F1146C86E762D9B7C44A077506DB97354636E8A2032F4F02E35CAEF42E532C2F585F4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439307, "uuid": "6c91d729-6272-432d-a96f-d977d8b1ecee", "value": "3072:FFs/9JkjdckfXvlNcFwYynHbVuXhXTCKKwTIC5FYHVByqqeTh:FQ9JkJZXvlOFwYyn4hXTCKKKIC5qHvZ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439307, "uuid": "96bb0185-e6ac-49c2-8822-0a6b036a6f25", "value": 192060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439307, "uuid": "6e08ca39-814f-4565-914f-ccf4dffe3fc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439307, "uuid": "b20c1e1f-f62e-4e93-b32b-101983380a25", "value": "vlxx.x86-20240418-1121", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05a8f06f-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416620, "uuid": "72bec1e3-6492-46a2-a349-66b03caec5d2", "comment": "Malware payload (Mirai)", "value": "91d23ccd3772617cabf60cb602f69e4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416620, "uuid": "e07abf4f-8d5c-42ec-bf9c-149b6604eccf", "comment": "Malware payload (Mirai)", "value": "dfcc1efbbf3745ea3f0037b89e7880dc390470e2a5924d88e5ade508587b64de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416620, "uuid": "54799b11-c356-4895-9ff9-44968dc9f3ec", "comment": "Malware payload (Mirai)", "value": "d120d796ecf0950917c2db76bc9920578327bca1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416620, "uuid": "83ec0ab3-6231-4089-b761-becd6879609d", "comment": "Malware payload (Mirai)", "value": "da530be10ea0c0fc758ca3ca4f26165140c133570af64a6ef607f36943833e7ba86c9033ab81203cfdd0a7378df9075c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416620, "uuid": "b770b488-efe1-4aac-8d77-f40b1c57f310", "value": "T1C733F123990A7D61C6722930F4F8C78A7794837EF0ECB92136D45133279B862ABC55D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416620, "uuid": "93037dfd-8e1c-4399-86fd-5552b02338f0", "value": "768:vfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfbMK59q3UELUdcK51y1qnc7XOOyL:0PtQjiZVcykHRDMbLUSAnc71y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416620, "uuid": "8fc36483-d7ed-4ac4-a685-b2c4a2e8d989", "value": 51460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416620, "uuid": "5972065f-a594-4e11-8e12-e7f14ee0b989", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416620, "uuid": "76106279-cc7e-4136-a26e-e94d111f881b", "value": "91d23ccd3772617cabf60cb602f69e4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b91c886-fdc3-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472491, "uuid": "31894a82-fe04-4632-808d-26f68380c027", "comment": "Malware payload (AgentTesla)", "value": "e5a32050e231640e359801e92a1859b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472491, "uuid": "cb2f38c1-9ff6-43ba-af5e-3256acab253a", "comment": "Malware payload (AgentTesla)", "value": "e0089eb5d56751f57a802a1fe6440b5f3157ec7ef054a9576bd072e0f9b49f5e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472491, "uuid": "c99b3a28-f2e8-4788-9402-0fbced88280b", "comment": "Malware payload (AgentTesla)", "value": "367145db445cb182208b31f2ecb74664fcce3d78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472491, "uuid": "9f1415a6-f8c6-4225-a3e7-aff1ec5ad956", "comment": "Malware payload (AgentTesla)", "value": "f9179fe740602115512b7bb22e14ecc64b4140222a31fe093e79009d13115613edae6d827edd5b013c599f3e4ed449d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472491, "uuid": "875e0eed-c25c-4ea9-8387-dd3fea341554", "value": "T1C6E423448E6DABDA47E07ECC84643519F4BF498172CF995816C97A30BEF0387E1252AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472491, "uuid": "c23c5a6e-0a01-49e0-9064-d02ac47de187", "value": "12288:qEdiuDvFWhRGWUhbCR9LLUk9vbY+HYwwCnKnwqkz2aECIfUXLM6LVbunCq:qsiXhRchWR9fUkRYxCnMwNz25cXo6p5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472491, "uuid": "7d007f5e-241c-4b0a-af14-80efe7047648", "value": 679731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472491, "uuid": "1fbbc067-813c-477a-abeb-1c9c774053f4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472491, "uuid": "d5f0cb4e-0f07-461c-b496-4d0169d90a99", "value": "PO1022_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d689e3-fd77-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713440006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440006, "uuid": "5d6a6c9f-fbdb-4c47-a244-699223526dfb", "comment": "Malware payload", "value": "336e7fc826a87a63b63b6ee895e45fb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440006, "uuid": "e9e91421-045f-4183-9fac-be9732ba2a26", "comment": "Malware payload", "value": "e11ceade8f755ea49a7bd0ca0c4abf0c339e42223a22cfa8959b8f45a135a5f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440006, "uuid": "a6eab533-d36b-44c2-b94f-a6891a93aa1d", "comment": "Malware payload", "value": "6dfef837eac65e33f8e084e943ebf2ad88ec892f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440006, "uuid": "d69d5fbc-53bf-4cfd-b6e9-74f54e2eb809", "comment": "Malware payload", "value": "5ab30242b7c9eeee89bf02ce53e7bda2e996aa2da2bb674f8ebf48d3b80dc2cc128130f7542008fbdf26379ec0052333", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440006, "uuid": "3cefc338-117d-48c9-8b7d-01d3c1a27585", "value": "T19CB65A87FCA144A4C0BED334C9B296567A317C894B3027D72B50FE682F76BD06A7A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440006, "uuid": "44ebe8d1-da55-496b-8d63-2d0c7d5c4cbe", "value": "49152:nWAi2zUyo72Jw9dv2qUkFTw1irYk9+EqdLbGzyYSDH2ZXcfU/W5EmUdxPAmyUtCD:nC2zUyB0ewwuqdWzGE5Ag5fUP5jG94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713440006, "uuid": "8b557175-bb3b-49be-8e1e-071673c6a385", "value": 10817536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713440006, "uuid": "c9f48b99-4115-4ec8-a6b6-8b95ecdf252b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440006, "uuid": "9b0b9c5d-6584-4c7f-aaa9-13bec2eeab7d", "value": "SecuriteInfo.com.ELF.FastReverseProxy-D.9265.18798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25fa32da-fd4e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713422258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422258, "uuid": "6999af4d-0fd4-4caa-9118-aac79760888e", "comment": "Malware payload (Mirai)", "value": "54bc7ded42ad84c533b2559df52fe9ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422258, "uuid": "2e08e5a1-5542-4441-abd3-ba893981bfaf", "comment": "Malware payload (Mirai)", "value": "e127153563c1e9352067e94b28687828514734d583ca6bd89ad6e9b01be46170", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422258, "uuid": "14c0021b-97e0-4686-a517-63ff17b812c0", "comment": "Malware payload (Mirai)", "value": "66a0abf93b84c549bf1d1b89381f399abec697ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422258, "uuid": "4a99b470-eff6-45d4-a32d-affe7368d333", "comment": "Malware payload (Mirai)", "value": "9443fb576a40ef539f81a45582b2448b597ddbc528bc5ebe881987a3f5b449f6ef031955dd3d90384820d07d68958dba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422258, "uuid": "c992980f-9bd8-4e7a-8163-0b4cf70720ec", "value": "T1F1E32A45FC909F22C6D225BBFB4E42CD372A1768D3EE720399255F25378A9970E37242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422258, "uuid": "1e1a2a44-1802-41d2-befe-c9d66c9d29fb", "value": "1536:+Gd1Knvu+q3X/CJE0m4ycVyEjUNiwLSAoutQADbU7TmJAWXmbOPOEKG6lI80Qe8y:Jgno3vcy7LSPA87imWXioWILQL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422258, "uuid": "b63a7f5b-10d7-4286-8ac8-3e6f2be5012f", "value": 150400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422258, "uuid": "1704766d-faf1-41fd-87e5-5eaf90e959a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422258, "uuid": "db55746d-e4b9-4bba-8ec8-f8809c60b577", "value": "54bc7ded42ad84c533b2559df52fe9ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce25360-fdca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713475822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475822, "uuid": "e1d7fd64-74f4-4192-b998-81f86a7da2c9", "comment": "Malware payload", "value": "ac38083ad80ab0bf6a26b827a73f87d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475822, "uuid": "f85a9aee-c655-42da-9d6d-473471fa68b3", "comment": "Malware payload", "value": "e17a068785f148d68c2fa2e6fd3e943e692da2ac9bee0c9f7a5ffe220035e26e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475822, "uuid": "ae721b06-21a5-4a6e-a5aa-f279e63dac78", "comment": "Malware payload", "value": "59fc220585cb07d200779c2b99ec8113dedd1a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475822, "uuid": "4df64004-6870-439f-ae62-f882576169f0", "comment": "Malware payload", "value": "a921fdb4dcdb962d57293589569e7521a056eeaa74f288a789d97f758f7006d0f52eb8768fbf0823443ae3727086fc9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475822, "uuid": "9e1fd23d-d906-4a55-aadd-f959f4cd804a", "value": "T10F84E781B668489AD341333BD99293A01739BECD5B96C383533CFDA63A139B35D4E9C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475822, "uuid": "87ee5390-9cc4-432f-944b-c98068b1d15a", "value": "2997e474ec31171014384ac167c8f196", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475822, "uuid": "96641e4a-1bb7-46f3-b840-59cd569eb81b", "value": "6144:PDWWy9TPBLZ6M0W3Iv/uMgPYHQHOgoq5oopMpPDxO3qG17php8S/IVw1cdDwLfW:Pk9TPBLZ6M0W3Iv/uMgPYHyOgoq5ojKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713475822, "uuid": "c9c0f209-4163-45ef-a8f1-ec708efd8784", "value": 385306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713475822, "uuid": "f7d5b486-9dfa-4f3e-b8eb-8fa3e1511c32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475822, "uuid": "d6653e52-cc57-44be-bda2-7cd2cef90eb5", "value": "SecuriteInfo.com.Trojan.Win32.Zmem.13051.25997", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f268c47-fd98-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713454217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454217, "uuid": "81c89221-ce12-44c5-af69-00cca6e210f0", "comment": "Malware payload", "value": "99922f67c76259aa7994be21a6634ec2", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454217, "uuid": "31ae1c97-cf8e-49f1-9bea-7c909fed7d6f", "comment": "Malware payload", "value": "e2eaf60508f8b2c8e55b30f711623a57032766750e123ddf11bff66c2cef73ee", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454217, "uuid": "7254789f-f914-4196-bf88-674438d85473", "comment": "Malware payload", "value": "80db25b6cd6c98bc9a09d82a006adc9ea313d105", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713454217, "uuid": "b1e5b232-d022-43af-8db2-f9ce5344967f", "comment": "Malware payload", "value": "07ac18561ea9485480e251f0637faa50d331925843144d3a002b9ea1260c0815c54a99d10f06911fc5c9b980236a8d05", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454217, "uuid": "0d24b4ea-64ab-4ee9-956f-2dc9893cebb0", "value": "T1977512669D842184C3F4D6768C6657D1773940C8E2336F1E3F1BA1286EDF29A30B63AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454217, "uuid": "2419b2c7-26fe-4002-b2ca-cd853a4d7528", "value": "24576:vnR45q+k1+m6JDDo2j+piq7odmVi6A5LXljoCdz0xqkFPBLEmR/gaZx4z:JB+6+mgDF+piq78mkb5FoCCx3B45an4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713454217, "uuid": "2ce771f0-e1b6-41ba-92da-19409d5e912e", "value": 1589666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713454217, "uuid": "ecfdd12c-3429-40d6-8ace-2adebf415c1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713454217, "uuid": "3e0ca812-d1a8-472b-89be-f76c16bd60cc", "value": "IDUI-ID#FACAFIGEHFSVVKR.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd582bb-fd54-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713424980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424980, "uuid": "2ea5b165-16fd-451b-aa6c-2f9e667bebde", "comment": "Malware payload (Mirai)", "value": "cc3d20d197bfe26ec583a9fc847de9a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424980, "uuid": "185fdbb3-529e-4334-b2eb-7dfa45e276a9", "comment": "Malware payload (Mirai)", "value": "e3c4ff93117226ef1d525f058011bd88bb2b0cbe1e5b756b20e6b1b042d76fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424980, "uuid": "df25f8f2-61cd-43c4-95e8-98a5896e09f7", "comment": "Malware payload (Mirai)", "value": "f75f6452d44dafe2f20ab84fab8eb581ff7ed871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424980, "uuid": "652d32cc-eed7-47c7-a5d8-83ba521bf433", "comment": "Malware payload (Mirai)", "value": "11ae406d4521258731451618d52ffdd140cf4c5de7a563f004719c5f91f56b2a2b36d7893185e847cc151950b95a739a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424980, "uuid": "e84f5953-c2f0-4405-9b6a-7cda0e1e58af", "value": "T1D4631981B8814A16C5D813BEF92D01CE33226B68E2DF7216CD116F5477C6A3F0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424980, "uuid": "cb8ae14c-d536-40f9-96a0-aced27926c02", "value": "1536:iWnvcKwB0GbszUNaXC3DMqR8eKKHzkI+i4/xlBKXR:EK8xbtaTqk/xlBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424980, "uuid": "1af1c703-3c57-41b3-927d-3793eb5b9136", "value": 67848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424980, "uuid": "0c21243e-af85-428b-98d4-44c8f2a98aee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424980, "uuid": "5c75aae0-ffa8-4a75-8d8f-697247df9794", "value": "cc3d20d197bfe26ec583a9fc847de9a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0701f419-fd5b-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713427789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427789, "uuid": "0797ebe0-a0cb-4980-8bc8-3d5c36c1a38a", "comment": "Malware payload", "value": "7ce51dcab2b7c23c8433595bd7fb0787", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427789, "uuid": "ef2c3a75-e48f-46f9-9231-5132524364f1", "comment": "Malware payload", "value": "e4b33b5db184841268cf4b385db34c0abcf11a684dba3932eedf016fe0af4b22", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427789, "uuid": "b7308550-a8a6-409b-9bf0-c72326442209", "comment": "Malware payload", "value": "d42f250b8804416933a995198adf29bddefd199f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427789, "uuid": "94d9e595-5aac-439f-a9e7-dafc31d338ba", "comment": "Malware payload", "value": "cd5544b0d8265bfe165e44679d732d59e64d6a9323836006a4450316bbdab53bf69e410da02fbf3bdf9c6b8d6783a8f0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427789, "uuid": "41f5e4fb-ef74-42df-bcbf-5bcf0ebe9f3c", "value": "T16784372ED34E0269CB520273AB1A1E95A6FDBB3EB39051A1342C437433DDC7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427789, "uuid": "eacaa1de-25ba-438d-b99c-350aa9cb0ce3", "value": "3072:usXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEoken3MCE94:DKMeKMeKMeKMeKMeKMeKM3ke3hE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427789, "uuid": "ca20996c-ab89-448d-a961-25d75c4ae789", "value": 386257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427789, "uuid": "23ed1870-ad33-410a-b0ea-8aaea025c62f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427789, "uuid": "8582dd17-1be3-4711-b582-9f68adb11d3c", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a7d4bd-fda4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713459402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459402, "uuid": "49d6ba38-fca5-41a4-a25b-b184864e2345", "comment": "Malware payload (Mirai)", "value": "0c49099c4b3fe271beb912f0a1116ee9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459402, "uuid": "a4764c0c-4dc3-4fde-8294-946902a761e8", "comment": "Malware payload (Mirai)", "value": "e4da40e9a08f169be4bc7dc9e27c939e1434a0d48a09bcb1dd8e32f0d0b3bae1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459402, "uuid": "7a70a193-3e70-4263-99d1-620fd4bd4c43", "comment": "Malware payload (Mirai)", "value": "7476bf6f70808da386c15dc6146b08b630a6e6e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713459402, "uuid": "6ab90faa-58a3-4955-bbb5-2e10d0673c30", "comment": "Malware payload (Mirai)", "value": "dc13f03f9c1e9880bad97cf4410647bd2b6d8b11f12e4eaec0821b775ce7209213eb9a663efff3f506ac4157c70687c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459402, "uuid": "873f4c5f-d442-47a1-9d6a-c1e0f5476bd5", "value": "T17373095AFC81AB15D8D512BEFE0E128A33536B68E3EE7112DD115B2067CAA1F0F77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459402, "uuid": "b91132c1-aaf4-4c0c-b689-b4bda9625105", "value": "1536:3KnMduic4ssbqhfOP2sm3TUBzCyQ2CWdBNlh9lWoiNgTSaN2:dvcBsbssmohCyQ2CWdBEfgTSO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713459402, "uuid": "7100c119-cee3-4fef-9cd1-a3ca0e94e87e", "value": 77272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713459402, "uuid": "344cc0a9-25e8-4b93-a7c3-30ace6a01231", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713459402, "uuid": "b8666028-4b07-4d46-aa3e-fe4a1b3ac384", "value": "0c49099c4b3fe271beb912f0a1116ee9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "441b0d37-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1713434764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434764, "uuid": "a82ade96-0ecb-4c7a-9190-9be8f6f2c304", "comment": "Malware payload (RedLineStealer)", "value": "7f6601499a756ab1979453e643d6b5ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434764, "uuid": "cdedd5de-cfdc-45f0-9dd8-842b4f13bbfb", "comment": "Malware payload (RedLineStealer)", "value": "e51a99e0f04ae001810c958a59b5c1a04ec668ab1d07b352665a887437cfacfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434764, "uuid": "ee94ac94-15eb-4153-89bd-e413cddb6af9", "comment": "Malware payload (RedLineStealer)", "value": "86ec61a67165ba7ad607f831eab6d9643613b0d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434764, "uuid": "aa573483-1e87-439f-b3e1-2e10618c18e6", "comment": "Malware payload (RedLineStealer)", "value": "a3f00eeca58ccab430c3f6bdd3eb3194f63eaec3b875fcfb162367118deb4ce340e887c940a9fda7b85f864ca10f5b74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434764, "uuid": "5a4d9a4d-6bfb-41e0-a31f-9efcbf6f2a84", "value": "T1DA45C0027391C062FF9B95734F5AF61147BC6A260123E61F13A81DBABE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434764, "uuid": "560cc3d4-2833-486d-a2ed-fabc5b6feb5f", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434764, "uuid": "caf0040d-d078-4318-a1bc-f260b2465dbb", "value": "24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8aaR+x0yNNo:iTvC/MTQYxsWR7aaRAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434764, "uuid": "2db12732-7533-4ffb-b564-f2068f996984", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434764, "uuid": "01c29363-d0a6-4cb4-bfd6-924d3f6c843f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434764, "uuid": "7de620aa-9469-4a7d-b31a-702f6ef7950b", "value": "Fiyat ve Termin Talebi Hk... 18.04.2024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa6e2db-fdca-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713475765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475765, "uuid": "4ccc3470-b3b2-4911-8745-cd2178abe994", "comment": "Malware payload", "value": "b6d1f343014dc55ef2588ca861db518b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475765, "uuid": "16b9600d-edb9-48d6-9137-5d268bfe9e95", "comment": "Malware payload", "value": "e5e5d8f93c5b2df051962b4aec10d2f75207e6b3113ae85faa2d810ca4bcf616", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475765, "uuid": "9cc09e72-82e8-4ea5-afa7-4138e6a9fa00", "comment": "Malware payload", "value": "896f1eb79619be7dcfe3f3b137a59f2ea2712fd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713475765, "uuid": "60dc7147-28db-42ff-88f2-a66a3fc3ed3b", "comment": "Malware payload", "value": "bdfce37262535d4a5401c2eb6413e3893ebfcbe0abc7b17e31d68c323a498ffc19e1704547dc1a9007f3d7024ea45fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475765, "uuid": "aa6cb345-3ad6-478e-87dc-3fdc326c7519", "value": "T109B4F11179C1C072D476163106F0D7B99E3DBCB04AA69ADF67980F7E4F20291E721B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475765, "uuid": "78b67cad-fd4a-4502-b1de-e24dc0fcde47", "value": "19233e39149f52fdb71945647d5026f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475765, "uuid": "f9572367-4c6b-4401-b7d3-f979ec4abf53", "value": "12288:93re4RXLKXpN3zZ8+A+PbjNHsX+54YzHiegI5pRO0:3RXOXpNVr4+GEHi4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713475765, "uuid": "42efdff7-9e65-4746-acd2-231072b5b562", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713475765, "uuid": "79c1b9e6-5804-4b64-99af-5cb0ecb069a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713475765, "uuid": "a004fb0f-6119-41a5-88e7-e59622da96fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c920e8e-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (Loki)", "timestamp": 1713434697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434697, "uuid": "b612cbcf-6c48-4dc9-beeb-f6d315526f3a", "comment": "Malware payload (Loki)", "value": "99c5c9172ae14aef0cad5d0882e08e0a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434697, "uuid": "11df5d03-1e3c-45ac-af9c-f8b37c873f4e", "comment": "Malware payload (Loki)", "value": "e609540945ebef9d1596ca2b25b84c647093c5cd2739bd956d65d78b0b3aa7e7", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434697, "uuid": "0ff527de-9f48-46aa-9fa6-c847eadab5d0", "comment": "Malware payload (Loki)", "value": "c60d974e2273922644892fac7100222d98345ca6", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434697, "uuid": "9c58debe-71bd-440f-ba5e-5978324909e8", "comment": "Malware payload (Loki)", "value": "84e7512fcf79a0a88bf6d0438ff1dbb86c1c20bedb7c49a9c5017deda9e3242e6e63d1a1454d8c41fe245df7bda1e434", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434697, "uuid": "e353d093-d3ef-4ed7-b0cd-13d9edbccaa3", "value": "T123C4120C9FE89955C7E90F7AD172A5148B33E186F503F32BAED850EB4DA1780D2C8997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434697, "uuid": "f75b3290-b95d-44d5-94ad-adf81c87adfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434697, "uuid": "208fdae5-4e7d-483e-bfac-aaae9b9e32cf", "value": "12288:b4nvyFxAgk/g7jFq81pds1N7SEwNLrzHBLA3B1ELYisAY3iuzCjkR:bFxDOiFqspdUN7HwNLP/snyuzC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434697, "uuid": "b78493f7-2b51-4d68-8dd5-195543b6d03d", "value": 568328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434697, "uuid": "b2df943a-5ffd-4b52-bc41-5e7967adbe82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434697, "uuid": "cde349d8-c22b-4593-9ed3-792f5042dca6", "value": "DHL_Awb# 12944872091.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb83e6f9-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713427770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427770, "uuid": "6beff351-52e3-478b-ad74-4554a084b873", "comment": "Malware payload", "value": "2be86255d5c58c9d1452c9cf39a6a66d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427770, "uuid": "21c645c8-403e-4d19-9d57-9715b820a1e8", "comment": "Malware payload", "value": "e6be399576b6bc96254e00a8743115604bf1dff765789d3483d3650575de6129", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427770, "uuid": "afcee904-f77c-431e-b417-43aaab8bdb2a", "comment": "Malware payload", "value": "058d72f3e45476408ffaca4ce9f7b39a05ed3405", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427770, "uuid": "7e7237ce-0e72-4b2f-9341-2ebd9bfa9458", "comment": "Malware payload", "value": "e9a0e89aba9694874f1b3f1b7ae8bb2decb1dcc516fbdb6c5c758d2e6f32ca8d40c0b39325b8fff9289a419e34ad3bf5", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427770, "uuid": "faca26be-bf9b-4428-a1a0-e5dba1060ef1", "value": "T1FA64D011FB818716E455937149F74BAA6325FC416F924B0F368CF72D3EB43A42E27A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427770, "uuid": "27bc8016-0f5a-4f53-a608-f76989840f44", "value": "6144:cuunJ1qZ+RwPONXoRjDhIcp0fDlavx+fgLt0d6oivSbVjHyNI89GQ8PYZMm/wOGP:cvJ1J3bVjyNI89f8P4wTUoIEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427770, "uuid": "85d42ff4-b607-48fb-a4b4-a768decaebce", "value": 330752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427770, "uuid": "66628132-d9f4-435e-89ba-3562c4d97a1e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427770, "uuid": "1010b236-8448-48bb-867d-a95660e842ad", "value": "IMG-Scan_PO CW289170-A & CW201.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76da8bb-fdc2-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713472404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472404, "uuid": "714e2642-68dd-4db3-8122-b6176a80e900", "comment": "Malware payload (AgentTesla)", "value": "1c03282d15f52ed3095a5c64e7c2a78d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472404, "uuid": "da897a46-b022-49a7-acaf-eeeeb0f9b97a", "comment": "Malware payload (AgentTesla)", "value": "e7ca5b6e85e1d8cec45ab5d12640dcc7016d6ca9c27b0b8d66f119d4639874b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472404, "uuid": "267e0349-cecc-470d-89e0-762bcec759aa", "comment": "Malware payload (AgentTesla)", "value": "86530804a57608459d3ff6ffd2442758dc184f89", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713472404, "uuid": "25c6b864-003f-4c4d-95b0-b69d427ebd68", "comment": "Malware payload (AgentTesla)", "value": "b363c229f875272c3aab1aa4300158be2e3cefa2a3df9624a817f3b027a5b6ada6a24c97e06a2656b76bb45703116fbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472404, "uuid": "ee62a32f-b29a-410f-934f-f0088d6f2995", "value": "T1C1F4220037A9CF37DA7F6BF8187828A103B135A6F428F74D9D9920C82715F4587A1E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472404, "uuid": "76335e3f-e415-4b02-b770-b5919ddaef82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472404, "uuid": "977e5fab-c257-44d0-93c6-3fc433d1c590", "value": "12288:Is8NBIu1GLMKsoXtsXVBwNlTqNwp1aUJbypdAt9XhyfOSlF8+50NgxkI:R8Nyuo/soXoVBwjgwp1bOCyGSlF8+5OU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713472404, "uuid": "61bb9bfd-7bb6-4b64-9b24-355d38956177", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713472404, "uuid": "799231fa-4833-445d-a580-d5ed0325db3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713472404, "uuid": "6a52c39a-1eea-4660-b885-94e213d85616", "value": "4v7myD9mN2OaWZp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b29165b-fd8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713448841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448841, "uuid": "599df22b-7816-42b6-9650-313c753cc2d5", "comment": "Malware payload (Rhadamanthys)", "value": "6b602c96ff01c4f55c7a625b2358a988", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448841, "uuid": "0173fc08-1dfc-4fe2-9cda-e3d2b296fda4", "comment": "Malware payload (Rhadamanthys)", "value": "e7dec31185f1555bb009e5f7348a31f98bb0d60c82d81c6ab42f95d6715ca6dc", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448841, "uuid": "adc54a07-a655-4b57-be9c-ac00c2a48679", "comment": "Malware payload (Rhadamanthys)", "value": "af42a6e2c1b97a958cf9e50a30cdf02221c07098", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448841, "uuid": "c3f632a5-7ca2-4083-80ed-9408ba4eac3a", "comment": "Malware payload (Rhadamanthys)", "value": "e5608b094414302eddf4c2656f3a4f75eb370f123b3fd48e76914541d6da209768903ddb5d51706fd68bb7e0b26af2b4", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448841, "uuid": "ab616bee-18f7-4360-bdf2-ed7c39189cbd", "value": "T1154114051BFD1731E3F3893610BA97319E76B405DE56AB1E019113841812B01F864F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448841, "uuid": "99be56e6-04df-4811-ae96-1e0cc6e42f56", "value": "24:8WYaNkDmgihopv94zcuhJBkr+/4p+8Pxu3Hgqdd79dsW28mT84abtl868z7m:8WYamDmux9AJA7gndJ9pn4a46q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713448841, "uuid": "7c5c2672-8bf4-4115-8975-e0cad5f14066", "value": 2003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713448841, "uuid": "23ee5791-2cec-4924-a1d3-3704a4bb5899", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448841, "uuid": "ee17300c-65ba-4d20-a9dc-b5c108ec1ed0", "value": "Factura_SA161.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e1db94-fd40-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416406, "uuid": "9a5764c9-49b4-450d-930d-a9dfc7adb508", "comment": "Malware payload (Mirai)", "value": "7c2da8202951debe176fc47541ae754c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416406, "uuid": "5c7a6719-b5ab-49d6-9192-8275f25ed19c", "comment": "Malware payload (Mirai)", "value": "eb9731dbd90a56af5a7f75188d1cc6c3463091770dcd4a5581136fcbe458043d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416406, "uuid": "63c82fce-99e5-4f55-9c3d-9e93b1955a55", "comment": "Malware payload (Mirai)", "value": "ed011df676af41489ef38213af10b5c70831ec0d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416406, "uuid": "e5217daa-1ce0-4e31-b2cb-e4a1bade0947", "comment": "Malware payload (Mirai)", "value": "724f88427a947b193aee952d3e7120e7a29be8af3c3f5f2e075203591574492fc11c48edaaaa373a472c94dafe8197ca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416406, "uuid": "52d1e136-ddf3-4d62-9c0a-017ff6d0910f", "value": "T19ED2E191DA74CB2BC8ABB232281A75128125B72D70E5C9A57CE0391B45BB93057EC3A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416406, "uuid": "eeb4bf4f-eea3-445b-a05d-aa1f2e4cd05a", "value": "768:ELZW56tNDAFiY4FGG1Nn8MPDEzg6cHoC5Is7nbcuyD7U0/2j:FMtmij8wyVcj5dnouy8jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416406, "uuid": "ac9297e7-b512-4fc1-bb77-5baa7848f24c", "value": 29740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416406, "uuid": "8220fd13-18b0-43e0-8bba-f82917868ffb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416406, "uuid": "d0766160-d677-49f8-8299-961d7f02f78e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c0b8dd-fd5b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713427792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427792, "uuid": "f1a7a095-38b0-435d-abf4-1bc5b165f410", "comment": "Malware payload (AgentTesla)", "value": "9500105068ac091471491a1a7c9065c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427792, "uuid": "e9169ed1-5de7-4334-9c73-6cac28575060", "comment": "Malware payload (AgentTesla)", "value": "ebfb38c8313f04d9afc3223ef7d30908d98880d333bff470da280d472b3cc836", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427792, "uuid": "fa31d806-d262-4f20-8827-ab94eaf27702", "comment": "Malware payload (AgentTesla)", "value": "f92e6b13cd0ae67dccebdcbbcdc5634a1c66aae8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427792, "uuid": "a5edee59-3fb3-4e28-8dd2-a81fa9e83e07", "comment": "Malware payload (AgentTesla)", "value": "c82c704a726ae7de48f8bb260ded34f7e75ca83446c1d71f98d57bd2067b6b9f8c4b1e04b73b7df5f6cbecfca13df6a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427792, "uuid": "4a63e06f-1f57-49f9-93b7-2f5caa17d082", "value": "T1B12418F09F0B36199F4B3EDAAC6445928AF58195051238B5AAD817ECB383D2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427792, "uuid": "69b32c7d-c05e-4347-9e74-b1efa40061a5", "value": "6144:uYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfxqAe:j2dO9IT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427792, "uuid": "db6d799b-2646-4cd3-979d-b828c7a32a52", "value": 215511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427792, "uuid": "71da860e-bb32-4cc9-aeaf-d5da6c65089f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427792, "uuid": "7985a334-b129-441b-ade6-45fabefde736", "value": "Factura2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de365c6-fd8c-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1713448900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448900, "uuid": "6600f368-f821-4799-9d7a-9b749e505c39", "comment": "Malware payload (Rhadamanthys)", "value": "e33380cd66cb38cdf6ed3008e1c8154e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448900, "uuid": "a9e625c4-af6f-401e-a207-0615c88726ae", "comment": "Malware payload (Rhadamanthys)", "value": "ecdf70fe9c6423522d7ed26058a9c705413b923863eddc44cf406d55bbc8f7d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448900, "uuid": "fb95e411-d865-417a-a9b2-bc8e1f2e18fb", "comment": "Malware payload (Rhadamanthys)", "value": "961327ff23c8c578ad91902b03c2c0f61ebaa721", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713448900, "uuid": "8232b2ed-5bec-4341-afb7-30c7cd3fc2f2", "comment": "Malware payload (Rhadamanthys)", "value": "1c02a3a019f810a96cc4f88934e586061fd08cfe550ef209c1183fd03f98a663039e90a90614a5959443fb776c388063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448900, "uuid": "f9c4ee06-d033-45db-ab43-c7b5293f0247", "value": "T1F914E80973075878C08BC8F2F838C2BE25A95D811EF6529E12B43077A5BD44EEEB9775", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448900, "uuid": "b9f5c107-cf70-414d-99e5-2069d5a1abea", "value": "4d14d19b876bbb7a86ffba329be9d956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448900, "uuid": "b1984a89-6be9-4910-a470-82536731682c", "value": "768:lfGgTViahszDOtfGgTViahszDO0jzefGgTViahszDOHefGgTViahszDO:F4WsO94WsOsu4WsOC4WsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713448900, "uuid": "8f247158-c557-4f69-b4f0-519bae337e38", "value": 190952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713448900, "uuid": "bf3d1f9a-881f-48e5-b3ea-e99c91ec8aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713448900, "uuid": "41b3e427-17a1-4568-bbc2-b018b613d734", "value": "factura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1274068c-fd41-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713416641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416641, "uuid": "cd1aa1b5-e911-4b8d-89cf-3a46a89f80d7", "comment": "Malware payload (Mirai)", "value": "929e91d3194d76cebd75096e13f225be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416641, "uuid": "94f5c4c9-d573-4511-9f32-dae1c6a4a89c", "comment": "Malware payload (Mirai)", "value": "ed0784ef545e9667e5dca6ee56b0fd08abea68f3c2c85de757ceeab66f3d8ca4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416641, "uuid": "29296d10-f5c3-4a99-a1a9-db73968591f2", "comment": "Malware payload (Mirai)", "value": "7de0149131e962e782b7904905b7688df3fcbbf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713416641, "uuid": "929e768a-2cf5-48a8-8b81-bfa97211e927", "comment": "Malware payload (Mirai)", "value": "152af53de12c543d2788e272362597b476f1e196e1b10096bd1212b7fffaf32e1c8269cf622fd77f6724ecfba8fbcb62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416641, "uuid": "8dac2114-f476-4f9f-981a-0b461a82540d", "value": "T191E2F132AA4094B2E3D09C766F3C95653BB723FAD3C3311B296E0D706EC691059BE152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416641, "uuid": "8b2a09aa-f896-4fcb-95fe-2cc67ebdf5e8", "value": "768:+kh3G0p3VzqHc5J/EgCus8OvW4uspFgv2NUQs3UozQl3:+UWc39qHcTFs84ussAszQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713416641, "uuid": "1a8cb80c-9c6c-48a9-a596-7e614397fa49", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713416641, "uuid": "5bbac065-2c12-49cc-922b-bbf4aff40c3e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713416641, "uuid": "ef8443d8-3eb8-43da-b5d7-4940fcbff981", "value": "929e91d3194d76cebd75096e13f225be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ed4e4d-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450846, "uuid": "69823a9c-f10e-4334-a947-3ac638ddd8d5", "comment": "Malware payload (Mirai)", "value": "5cbbbd10f2d2de20267a3d2ffe430e20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450846, "uuid": "a69fd7a5-c54e-429e-a8b2-424a62c0024d", "comment": "Malware payload (Mirai)", "value": "ed418388580faa10eb08a655f57edfad8798312405e4575915b0604c7f65803f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450846, "uuid": "03e66687-92c8-4d37-85a3-93ea5a624186", "comment": "Malware payload (Mirai)", "value": "dc14de0dc7159bceb35b1d80a729009856218b7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450846, "uuid": "e4c29142-b4ce-4fe0-afa6-4486b2f8df34", "comment": "Malware payload (Mirai)", "value": "403a7499316d66fe46699f077476d995f54db2ab57d01958ff67c19d0435f6215e8d9f187c470c08d32ad131a2a17a62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450846, "uuid": "f29e4cbe-d270-44e7-8874-21f8acdf7503", "value": "T1FFB34A77CC2A6F98C159D5B0B0B09F792BA3A58182471FBA55B2C3B64083DCDF505BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450846, "uuid": "fdb36c7d-7a5e-41ff-852e-40044101483f", "value": "1536:Ka97/a/qUAm/u4Y3mOCRYKtKBhLfdKaqXzURDWUdWN4DJ+LhHK:Kyan24amOMftsxKa2sDWSWN+UHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450846, "uuid": "b5cb5c4e-69ee-4fc3-a1ba-46641ea42e59", "value": 116512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450846, "uuid": "9e433e10-664a-4726-87d3-c8826c58ed32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450846, "uuid": "8f2cb389-0241-4bab-b2db-e1773b49a617", "value": "5cbbbd10f2d2de20267a3d2ffe430e20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c61335-fda9-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713461534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713461534, "uuid": "27677124-39b6-43d6-839e-977d3fdbe256", "comment": "Malware payload", "value": "df0daae26fb3f58a6b9ce4d144a81b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713461534, "uuid": "34eff2b8-2f70-4317-9d74-798d11eecf7b", "comment": "Malware payload", "value": "ee9c745ec13fb4389968431701fecabaa3fd85f607e694e0d8747703a60fe0dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713461534, "uuid": "deea8709-1686-4f64-a17c-867cd930eaa9", "comment": "Malware payload", "value": "38e41ab0e2712f7762c6d8b56892362cbb1b6744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713461534, "uuid": "55785779-c22e-44ed-9683-13d063b26187", "comment": "Malware payload", "value": "a4c5f79d46e930a3a1cb6f4c253584de44fbab6d808b63e53b4ce05aae4f5f0d86c8ce6c28cd1a852e6c034537bb181f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713461534, "uuid": "a382e5a9-c0c2-47a3-b587-6825ce41d8a9", "value": "T124183351C4798FF9E8C7B7FB61142288B757D7340D144B8EAA3E278C9072EE66E1106E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713461534, "uuid": "45294606-3183-4970-a806-2a230e3e2cc7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713461534, "uuid": "50d24b5a-cbd5-4185-87c7-b435cca44214", "value": "1572864:rryVzqhVL3BFk9+mLcrnjgntw0aJxf5NB76Rj8zMK7/Q+Z+0iwGv:rmohVL3aqrnjgntgJxDB7Sj8Y8NZbAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713461534, "uuid": "fab22d7f-8488-4f27-8066-559b7b05e0ff", "value": 86971128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713461534, "uuid": "df463af2-b5b8-425d-95c8-97b1da02c69b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713461534, "uuid": "864f08be-39c0-4fa4-bcbe-43d991623ba9", "value": "SecuriteInfo.com.Heur.21832.3236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d28ff4-fd23-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713403943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403943, "uuid": "74b06be3-80c6-4909-a426-e37e3e1d0734", "comment": "Malware payload (AgentTesla)", "value": "f4babeed860c7952cb00bae31c4bfa54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403943, "uuid": "11db383e-5f36-4dae-ba67-089f38982f28", "comment": "Malware payload (AgentTesla)", "value": "ef171f71804fe96bf375379c691e1f93b3fe38a3535b24f8f19d104e5eecf7aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403943, "uuid": "8cd9ada8-14f3-4cb7-9aa5-4e9b9591507f", "comment": "Malware payload (AgentTesla)", "value": "c818efd3d709df2baa44767b1332bb2df045f7a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713403943, "uuid": "a58166e7-074c-4bb5-9d0c-6288d24bb83b", "comment": "Malware payload (AgentTesla)", "value": "3c188f4f07e484beeead29a07c982f5d99c3b31016387c1ecf0bd7b13860e8ac6a8de598659619871670cbeb997e9038", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403943, "uuid": "702975bd-f97d-487b-b0b7-c5433fbe532e", "value": "T1ACE4231DAFA4D60FDA3C96F60A2209884331D4D94883E3C9FCC465D65D697CBA8C5BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403943, "uuid": "55acc29c-0f47-478c-8ab7-33b8f607ee6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403943, "uuid": "981bac45-9121-49a0-afd5-4eb9563b9c25", "value": "12288:ejIBUOFFIJJzbCU6WQjXgoCxXU7pKa+aGzPPH44FZVEJJM3NrYK:2I1vsJPF6jC5U7pn+VJ5CJAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713403943, "uuid": "f74da469-f8f7-46f3-9ef0-cc96689ca02e", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713403943, "uuid": "163492f4-f195-43ae-a054-5bd63d4b3a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713403943, "uuid": "1353d416-6181-42f0-bfda-a703b989828b", "value": "SecuriteInfo.com.Win32.MalwareX-gen.3610.30636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4f34c1-fd6a-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713434620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434620, "uuid": "fce78375-defc-4586-85da-8cb702dacb51", "comment": "Malware payload", "value": "cef25f22744c9b6d43df33175f3eb1a8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434620, "uuid": "fd0e6d01-2bcb-4217-bafa-dd1fd9da877e", "comment": "Malware payload", "value": "ef3743904e7576c357dc7589a16b45286c37026b0696d5b52a6991919726f6a0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434620, "uuid": "a05b06cc-0f4c-496a-b037-e60cdedc9ef6", "comment": "Malware payload", "value": "ee28a36bf3bfa8e418fc6e13768923b62135ac80", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434620, "uuid": "bc474411-78a0-48f2-9c0c-16059575ade2", "comment": "Malware payload", "value": "8688b10ad3d349afc359caf17a81f1a5009a01d981014cb35cf0ac3147044f8c7e4eeab9007e7441a5383f1a1945ed42", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434620, "uuid": "f9537bba-8b6b-4b02-b933-e20fa7c8b6be", "value": "T13045BE0273D2D036FFAB92739B6AB20556BCB9250133852F13981DB9BD701B1277E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434620, "uuid": "602ee8bb-ce63-4509-a03a-a74c00fa645e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434620, "uuid": "872ec9f2-1348-4474-a973-c827df178494", "value": "24576:YAHnh+eWsN3skA4RV1Hom2KXMmHamdZoT3wImIkW5:fh+ZkldoPK8YamdqwR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434620, "uuid": "c0388fc4-65b4-4e50-ae5c-a0521c590b92", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434620, "uuid": "b4aed2b8-6694-4827-9510-99fc4fe98e69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434620, "uuid": "54381a1b-62ce-40d6-bc52-782583081bc4", "value": "DHL SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fc820ae-fd55-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425442, "uuid": "b5989a7c-e732-4125-9e67-90f30a82bc24", "comment": "Malware payload (Mirai)", "value": "7b3aff7ecfbf505b98074849c396c596", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425442, "uuid": "0bf33645-83dd-47d1-94b8-c2b45944f058", "comment": "Malware payload (Mirai)", "value": "ef678f884aed8699577d39ec5893c2cbedac3b6b867a484d4486e5ed125cfdd1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425442, "uuid": "8ed1b00d-20c5-45b4-b8bf-2b0c429a1354", "comment": "Malware payload (Mirai)", "value": "c0f7b9cad3e531ef0be3669296d42f1ba0c3b940", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425442, "uuid": "9d25521f-a972-4a8c-a7d6-d7573e1173a0", "comment": "Malware payload (Mirai)", "value": "f8e852a9967c91a03b7199a3fefb706fe20aa0d573d690c373b91149a59cbfda92c8b0b02512a66987f5a981c99b3cb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425442, "uuid": "bdf60aeb-809f-47a3-a908-622021ca9e87", "value": "T1A85302F168375624C6329179BE520382FE1D9D3110F635B158DA48A48BE39EFA839DE3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425442, "uuid": "523d8156-176d-4a35-a637-215931456d06", "value": "1536:8KxmLQKpBoYoaQn8/BRDzFYucdaH7yYsv7tI2maBwZlaLd:roLQKuQRDzz427MvC2ma7Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425442, "uuid": "22f2e615-31e6-4e57-b4ea-fc39c4c13dc3", "value": 64528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425442, "uuid": "5d954631-8d8f-4788-80d8-9a7dacc2dc5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425442, "uuid": "b60a4f27-a662-43ac-bd90-3629b76011dd", "value": "7b3aff7ecfbf505b98074849c396c596", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f6f86b-fd9e-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1713456882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456882, "uuid": "085c872a-b772-4117-8fb1-fc5689d41479", "comment": "Malware payload (Vidar)", "value": "0bb19eef181634dc1aea014783928efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456882, "uuid": "4151e4c7-352a-43ae-958a-391abd98e13a", "comment": "Malware payload (Vidar)", "value": "efb54ced1c0f4e2d143763ceec232d61d9dc5c41ad83d62a37eb630f209f0ca3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456882, "uuid": "0678d12d-4b63-4882-aa65-2c4f82839ecb", "comment": "Malware payload (Vidar)", "value": "45675a35430d2c9da1bec9fbb71278ead2307bb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713456882, "uuid": "ca8324e4-803a-4d03-a33d-22dc9a1d4d62", "comment": "Malware payload (Vidar)", "value": "7c6589f9b7e282f8617cc0f5bb1671f82316cea8ceb451bfa7203b531f7a55f318929e8be2462643a31056bcfc18dd3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456882, "uuid": "e969681a-03cb-4788-81fb-9ddb887905aa", "value": "T11484E00575C18072D577263106F4DAB95E3EBCB04E52AEDFA3940F6E4F31282E625B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456882, "uuid": "dfbd5687-52ed-4307-9fb2-ff59b4f54061", "value": "19233e39149f52fdb71945647d5026f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456882, "uuid": "9d70875c-94bf-4d75-9d24-e57113b3302b", "value": "6144:aawlim1k/G14hCN9OGY13/cpLJsX9s3B6aW4LD0qe30hLxScv/1TDIY6O0:lm1k/G12CNUap9oL4Loq/xSclQBO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713456882, "uuid": "bbd984ce-189c-40e4-befd-a1f1076cd472", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713456882, "uuid": "ba7a846c-ed6c-4bcf-86e9-d99894ccfd5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713456882, "uuid": "9cb503f1-8c06-4ad1-beba-2c32d338dd1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bcb588-fdb6-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713467113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467113, "uuid": "7ab172ec-adcc-4a33-a3cf-2e996989d6bd", "comment": "Malware payload", "value": "3718d169901d765c6d07f1a35f0eca02", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467113, "uuid": "b60fc7cc-99c8-4a23-b245-920c96383e06", "comment": "Malware payload", "value": "f047f924692687ac4365378a645fa8e2655e99a0d9015c23f8e413c99ecec707", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467113, "uuid": "00080332-601c-49f0-a6f7-e07ce731220f", "comment": "Malware payload", "value": "a50c4c25a7e29190de170365494887eb27cddce9", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713467113, "uuid": "bd8cfa05-9efe-46a8-8edb-c71fa46043bc", "comment": "Malware payload", "value": "5bd644e72a134358ffd5199fd83fda0938e5ab0ad4c93762732ad5991559266eb85d2610e3b204a6a7682256b140bafe", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467113, "uuid": "ba6cd69b-bd8f-4446-87a9-eec7b498d463", "value": "T154117BC2B3F55715F27642333E75C2C04B3322A2FA52CB1F41C1161C58A2905EEAAF27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467113, "uuid": "2eec6025-c87f-4770-a6d7-8326f445b5a0", "value": "24:8+NEnkXppKN+3U3zKjyA8nFjpx4I05aPgu3PokSX:8oEO3oz+R4FkI0aM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713467113, "uuid": "1077419d-aa9a-4f03-99ba-d429ee0cd8c8", "value": 899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713467113, "uuid": "52f5e4b5-ffbf-4779-900b-57c6babf8344", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713467113, "uuid": "33dd816f-d9c1-479d-af0a-32797f23dc32", "value": "parcel-label_photo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d5bfcd-fd75-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713439335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439335, "uuid": "951341c3-c8dd-457d-8ea5-ad67a93e5b18", "comment": "Malware payload (Mirai)", "value": "46f2f55666816815b665b42efaec4285", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439335, "uuid": "a0b96dc3-6ddf-4019-a50e-744c99e48300", "comment": "Malware payload (Mirai)", "value": "f0963a2dfb17a49c3233620cbca86f23d3f27b2e1fc401e515feb75e56f52ef1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439335, "uuid": "14865b12-3314-4f82-ab67-240a805fcbe2", "comment": "Malware payload (Mirai)", "value": "35e000386feb7487700af6cb9e8040a0cba70758", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713439335, "uuid": "22769115-1357-4afb-b721-b73cc1527e58", "comment": "Malware payload (Mirai)", "value": "2e346090e7df55f0e1c5bb3026ccb8a39fdf017086f3e65c7c882ffb9f8a64771626b547479ff9f003b8ce904dd43a2b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439335, "uuid": "a5491677-7d41-4a4e-b395-361554100493", "value": "T1C404E91AAF510FBBD86FDD3705E8071135CC945722A93B3A3678C928F54A94B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439335, "uuid": "6b5dca10-227b-4358-bf41-ae767c11ff25", "value": "3072:ZEo8/X/RRp7jj11XGMajswXvt+B42mLPPH3jFYp9UyXDjZI:6/vZjRtGMajswXUB42mj/CUyXD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713439335, "uuid": "5157be67-ee78-457f-bd30-03ebd1851a22", "value": 189712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713439335, "uuid": "da698307-a049-400f-885f-bef348c15801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713439335, "uuid": "cc41f0c5-0a0e-438f-9633-eeea772b3f20", "value": "vlxx.mpsl-20240418-1122", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d2c482-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713431094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431094, "uuid": "a46059a7-ecf8-4db6-abb2-5543a984bb7e", "comment": "Malware payload (AgentTesla)", "value": "73abc522ed981b48b4be2ba972900b68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431094, "uuid": "5c6a5772-c229-4aa0-87ea-f23cd9d50575", "comment": "Malware payload (AgentTesla)", "value": "f0ecd3e8f225833c8b6b7945c99e1f5c8a4ccb3332cfb4b7ab7b63d7d98d88f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431094, "uuid": "5dedcfa1-9b3f-4f33-9f12-dc41deceeeb3", "comment": "Malware payload (AgentTesla)", "value": "986995bde37b8ac4daff9b88e5d9bdf4f6b82d72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713431094, "uuid": "b6b067b8-7e48-466f-b0bf-7ae183f7234d", "comment": "Malware payload (AgentTesla)", "value": "eb1f1042135aa7102aa2eb09c19545880e096212b81679121084041e6cf158fa3c91211439a7b98e03b4f8bce506a3b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431094, "uuid": "7d3b980e-504a-4c00-ad20-ece262ce14d2", "value": "T15D2419F0CF0B36199F4B3EDAAC6445924AF88195051238B5AAD917EDB283D2CE3FDD14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431094, "uuid": "263868cc-e3ef-4466-afbb-a43f917ffc81", "value": "6144:PYBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJf3nqo:c2dOXQEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713431094, "uuid": "02e9571f-3e3f-4294-99c8-a952e1b70835", "value": 216069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713431094, "uuid": "fe071667-59ff-4713-8cfc-609b473a4716", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713431094, "uuid": "300efb44-dba0-406a-bb8e-797baa369bd8", "value": "Transferencias SEPA.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6a45cd-fdbf-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713470986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470986, "uuid": "c8c473a9-ff14-44e1-9d74-c9588d84a35f", "comment": "Malware payload (Mirai)", "value": "68936e4a34e3818f7d89a6bbc594e543", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470986, "uuid": "24828fc1-5982-4184-aef5-44b462244417", "comment": "Malware payload (Mirai)", "value": "f0f84fd8b5a7b7fd4491cacea8cfac41bc603da65be8442823db757fc4c174d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470986, "uuid": "c64ad971-054c-46f7-9ff7-77a43fa7075b", "comment": "Malware payload (Mirai)", "value": "786a11e7d5491290ecb29e0a925624143ceda088", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713470986, "uuid": "3c2fcaf6-aab9-4b0a-add6-daf8ec3936eb", "comment": "Malware payload (Mirai)", "value": "347a84648d7ae113ef70c0dfa34053bbe3c9fabb128405835a931ea8aa8d8dcc26c9f2ad28ec5163a731b6a2e77d6f42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470986, "uuid": "a8bdf00f-f9ef-4708-b77b-969dfe8d62a5", "value": "T116533A0173140587D5F25EB02A3F1BF1D7AA8AD224A4B249794FBB86C5B2D335847ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470986, "uuid": "598be5e1-3116-4239-bff4-97de40d9d6b9", "value": "1536:nWbwxerP3yVcAjtn6YDNhzqnWn74NKimb40QDvHBHGm:WbwU06YPqnWq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713470986, "uuid": "76f79cbd-d316-418b-b331-5a7e5034b0aa", "value": 62112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713470986, "uuid": "d24a38dc-3024-457e-845c-5693dab0789b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713470986, "uuid": "979bc9ba-c925-4944-b49f-f014fb8ba27c", "value": "68936e4a34e3818f7d89a6bbc594e543", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "625e20fe-fd56-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713425795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425795, "uuid": "d8f4958a-82f2-4554-bf1c-8889f2d02c99", "comment": "Malware payload (Mirai)", "value": "c586cc0f15ff0c92c64824e2ffcdacc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425795, "uuid": "c8e612f0-5321-4b26-b14f-9312ece70e1a", "comment": "Malware payload (Mirai)", "value": "f1b9e1f50bba2fc62e527898643c2baa25af8e264fc583a72694fdc5c31df697", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425795, "uuid": "91981d21-be14-4f46-b7c6-4ce9caec393b", "comment": "Malware payload (Mirai)", "value": "51d6789dae8b51df03c5e515a37912db46ed0584", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713425795, "uuid": "46fa8f07-f171-4fdc-b535-aa4a3461eeed", "comment": "Malware payload (Mirai)", "value": "eec358d80a92743d27cb62f0c4f084c59bbc54fdbce9a4249792e43559fe7574a220c2a9d37c1aa7fb491b153d75f8da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425795, "uuid": "1281de06-5aa6-4c09-b304-eeaee00a11a2", "value": "T1274318957C829A27C6E8137AF56E028D336527A8E1DF3227CE232F11B7C591F0CA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425795, "uuid": "30f13182-0c35-422f-9348-2bb85f57aabc", "value": "1536:+8fTuV2Xljs2f1y11LC0hBrKfHNJ2QfaAQ:+8ru5har24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713425795, "uuid": "a64619c6-d5c6-4229-9d87-4b5fe4a0b76f", "value": 57056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713425795, "uuid": "b8ab7dc9-045d-4fc5-b397-3e3a9843212c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713425795, "uuid": "fb27cd03-e4fa-47f8-83e8-73e1da534c62", "value": "c586cc0f15ff0c92c64824e2ffcdacc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0897f41-fd53-11ee-a120-42010a9c002e", "comment": "Malware payload (XWorm)", "timestamp": 1713424745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424745, "uuid": "c8a01ef7-5c41-4f3e-812a-c44d1717e0fc", "comment": "Malware payload (XWorm)", "value": "b69af8feb3cb1543d470243c1fb0bbe3", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424745, "uuid": "b87c1c09-de21-42ab-bfc7-31992cd16e97", "comment": "Malware payload (XWorm)", "value": "f1d7b6bf0210ff27b5262b1441f9408c0daf94151b464260093029b02bf1bf84", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424745, "uuid": "3f751100-5c9b-4631-8180-bfe9d33fe5c4", "comment": "Malware payload (XWorm)", "value": "5057534ea8b66a8c10e60de14cf2dae7202dd3df", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713424745, "uuid": "cb26c2df-56e0-46b0-8f31-e2f6ff32b85b", "comment": "Malware payload (XWorm)", "value": "0e68cf65b73f1ad0a23f8ca14ca63e279ca0f13ef0d977d6a1204f0f095757e051908f730d3665c63085684a02780111", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424745, "uuid": "1ab6579c-f8aa-47c4-8f43-a9cc80eb25d5", "value": "T1FA4348A29BD7BB22C0D68B75490F0D83D2E0A54FC14EB0AAC01FD8493917D995C9F4BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424745, "uuid": "b52366f9-5e58-4489-bd28-0125fef317e4", "value": "768:A5bL2CV376K0/Exy8ee2lBV6s8jV7GPz4etpJuJHkettvwszsuIijQgj4Yo3hIsu:A59tU/V6saV7Gr4H2KtYsYij7o39tx8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713424745, "uuid": "359f21c7-c5b5-4cdd-a9e9-eed27fa9b2be", "value": 58541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713424745, "uuid": "ca41fa51-14f3-47ff-b1cf-b701ca7d6be0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713424745, "uuid": "399b21ff-58c6-420d-b057-0536e55a9a04", "value": "Invoice Number INV23491-1 Customer PO 39014.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72728908-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433553, "uuid": "85dc9482-493d-4980-8d05-b85a6823ea02", "comment": "Malware payload (Formbook)", "value": "60e4f25fa64a0ef31ac57663a26da790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433553, "uuid": "a8d6b8c7-a6c8-4938-b039-5f648d8d674b", "comment": "Malware payload (Formbook)", "value": "f2664bdfd035d146843f1575528eb9694a98b32f99488058a0e04885ad62e9c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433553, "uuid": "e23a4566-7611-44e6-bc99-8a388dd71fbb", "comment": "Malware payload (Formbook)", "value": "26126c700f70de2e42a173214b52fe6a38c93bb8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433553, "uuid": "326b9fcf-e50e-4ca0-9b9e-f22a3e185025", "comment": "Malware payload (Formbook)", "value": "d08122841c569172b631e45fb4b9271e4680c9f31a05427f711da355d9d79cf1022349cab9972f528b484ce962d3d2ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433553, "uuid": "0348dba0-4a4e-475c-8a6e-7393c0d80207", "value": "T177E4232DABF8AD01C29E4B39F1A219018371F742621BE71F68E544FA0ED37D4D1E199B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433553, "uuid": "77209d75-9ab7-481c-ae39-3a9bafd40ee8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433553, "uuid": "af6ec98f-6535-4977-9131-217ca84d4145", "value": "12288:5rOrr4PrrF4LtCVp0Vk1zlFrhHn6SvUyma5+2wqxsKoLlD5fRXj+9Y/6wuz/CkR:pDimlFrhH6IUzBqxdEtRXa9Y/huz/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433553, "uuid": "74f23b61-c0ba-4f09-8b9f-74c15ebc3b92", "value": 722440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433553, "uuid": "64143073-ffd6-4303-9e49-0cb93cd9b2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433553, "uuid": "df95d9ee-9f2b-47b8-af0f-67fc688dc6ee", "value": "60e4f25fa64a0ef31ac57663a26da790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729c703d-fd8c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713449015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713449015, "uuid": "bc4135da-b0f8-4e91-9e4e-7da0756fb0f0", "comment": "Malware payload", "value": "67c2c11c382e2bc55195169d0efa2ae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713449015, "uuid": "0cfaf81a-ff1e-4f69-a8ed-78710f0a7eca", "comment": "Malware payload", "value": "f288b51bbbec3bc248342fd71d49cc759615f24251d02524a1e49b18f6dab7ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713449015, "uuid": "7af34729-509f-4338-8f2a-636a3bc23a10", "comment": "Malware payload", "value": "b9dff41f845f419df8a34ec0f3ad5211894e4839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713449015, "uuid": "fccb0f93-8b5a-4352-84fe-0350a6f950cc", "comment": "Malware payload", "value": "f28b21528d4d0f845d582a4ffadf8975b901b46b80ee66d5b29619482133acfa7ee8dc7abe66477366f319df8d8e17a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713449015, "uuid": "708fc872-ff71-432c-afdc-314055eb6d60", "value": "T191044D0943539948D19303F0F63088F812261E765E32868E127D356BA57EB9FDC3EB7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713449015, "uuid": "38d33f80-43d6-4b28-bc05-3933c8173239", "value": "4d14d19b876bbb7a86ffba329be9d956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713449015, "uuid": "528cda6a-5621-4667-b9c8-fcd42f5b88d6", "value": "768:lfGgTViahszDOtfGgTViahszDOU68n5SDNPxmfinvr4zEfGgTViahszDOmefGgTV:F4WsO94WsO14WsOF4WsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713449015, "uuid": "74eb02e4-e89f-461d-9dd6-1703aca0ba44", "value": 188560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713449015, "uuid": "d2c132a0-2b1c-4d86-bcd0-e7989c66cd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713449015, "uuid": "d3de0c1e-4dbc-4af0-afcb-d67a167e1b57", "value": "stage", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756bc99b-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713430981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430981, "uuid": "d49911d0-0430-4c30-b7c6-840419e33a91", "comment": "Malware payload (GuLoader)", "value": "180a5b7cf2e35e007a1e0044061cd2b2", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430981, "uuid": "093c3f99-e957-49cf-be20-c2ab5b7beb46", "comment": "Malware payload (GuLoader)", "value": "f2d8703d0b3ec39872caf5d17b2dd6258e73b2b87923524dec5a9f86d343589b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430981, "uuid": "a0988fbf-2711-4b1b-b445-1a732617bf0b", "comment": "Malware payload (GuLoader)", "value": "d5c71006c6e401a04c670d847d9d0d9f8d919798", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430981, "uuid": "53c91ed3-567c-46ab-a7b6-a73ec5e078a2", "comment": "Malware payload (GuLoader)", "value": "c1f6bda3c10341346d03ef32b71e295689533d08dc5b6b43fe6a4aec5aee49718eb22da38fbd8d5cef920968a84ede57", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430981, "uuid": "54d3c508-6918-47a5-a9ee-f692ecac9abc", "value": "T1A6543AA0CFCA26394F4B2FDABD60459289FC81990212247DE6D907AD7243D6CD3FED58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430981, "uuid": "7dc8150f-9b60-4671-802d-a518cd5648bc", "value": "6144:LwdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOdy8TeJ15UL:EnS2Imc7J15kAl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430981, "uuid": "77c4da52-ce4e-4211-aabc-905a26c0e727", "value": 285457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430981, "uuid": "f322cd1f-d838-4c47-9aa5-c247dc1a987b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430981, "uuid": "04739868-7970-4443-a366-69872728e47f", "value": "shipping doc.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73defa65-fd4f-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713422818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422818, "uuid": "9d9f946e-87b2-41d7-a583-9ce8162e3a79", "comment": "Malware payload (Formbook)", "value": "edf46e0240a7993d532633a83af664b6", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422818, "uuid": "ae286905-373c-42cb-beed-23add19878c8", "comment": "Malware payload (Formbook)", "value": "f3298ef809962d972156b31709e10d4af7ab11c9ea3e2ce3412f052bf9784d26", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422818, "uuid": "5f1848b4-3f5f-4a9e-abd8-237cc95a582c", "comment": "Malware payload (Formbook)", "value": "653317c37f159144151288716af4a4702eb041f9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713422818, "uuid": "3a881891-e9cf-4d43-941f-8438d51fd0bb", "comment": "Malware payload (Formbook)", "value": "ea9609e5631b3c12baf0393185e4462f7303e5e62abde0d53a5be3e24438459c13524c8ab9b6bb4675eafc62b508161b", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422818, "uuid": "00e5d876-94be-41e9-bb1e-8d906d01723b", "value": "T141D423F75762E88921D57884B8249FC384956F1F6178B2F035D7E52C836AFAE0D434E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422818, "uuid": "546aba72-b25d-413b-a238-580491b5337b", "value": "12288:FL9IVWGjXFZEIa7FtDlIBKL0vzQ7EmCzC28H0hEuAOTIG8HYaPDBEw17Z:FLWVW4fEt5tDl1LZRCzC28WpHEGUJlEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713422818, "uuid": "f1c1c8e4-f88f-4811-93a1-e306f8325eff", "value": 602543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713422818, "uuid": "93903715-8349-46a8-bbf5-93e7866aa4b1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713422818, "uuid": "8d3723bd-5cbb-4dc0-9d35-2845174ce8e7", "value": "Invoice copy.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bffca9-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713466843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466843, "uuid": "8451a6db-e807-4ef7-9a9b-cf88de3917aa", "comment": "Malware payload", "value": "7b17939de59fab7ff9532ef445c3bd22", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466843, "uuid": "eb160fae-f8c4-4e63-bbd1-4f1fa4eaa56c", "comment": "Malware payload", "value": "f41070930af5c1b92e7b55674536b626d7df01b7f295e9e7e16c16df107a991d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466843, "uuid": "1aad5a79-e553-47db-a748-462dac3cb3bc", "comment": "Malware payload", "value": "2bdd025656e0d8fc8bd051b2b4cb3beec0a21553", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466843, "uuid": "3d4c19ae-1482-4e92-a075-5c6643f6f882", "comment": "Malware payload", "value": "f3ff7ce1fc1641d1f7be0c823e9a37582759a5ef221ef9238671f42a30eccaeb471f14d2144da40a49de3ecb02808a7d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466843, "uuid": "6ac6415d-d5da-475f-a18d-1e3fa3108016", "value": "T19A66330BB6CB8B3ED6E286F15257671783A12424A513822713B9470D3FF6990F2B72D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466843, "uuid": "e46eee96-1ac9-40e6-99f8-82134eab554d", "value": "98304:+Y5A7SK1AH4K3YF058mR0e/KsutXH9ZgkeyC8Jn9fZz79kH4umccnlenTbsOS+cB:ESkAYyv8XrAylJ9fF7mYrnl6sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466843, "uuid": "a77aa453-b2f6-4ffc-aa4a-41bddb172980", "value": 6515712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466843, "uuid": "3e90c6b6-50f9-45b7-9166-ede6d915a925", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466843, "uuid": "d857f72d-61df-4b24-bbcd-ac33c6dc0de4", "value": "7b17939de59fab7ff9532ef445c3bd22.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e2457f-fd51-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713423685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423685, "uuid": "c6a64d68-4310-4807-8cf4-1f83c18d4fcb", "comment": "Malware payload", "value": "e8e193c463155c347c1a4cd828e5947f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423685, "uuid": "fd2913ca-4766-437f-9726-d4a0a1838cf8", "comment": "Malware payload", "value": "f4153f8494d015bbe6740d237a848dc9898726b4812f015d47c80eac08fe5e12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423685, "uuid": "b49041db-86dd-41b5-8b35-ce5dcb3a8623", "comment": "Malware payload", "value": "2c3ddd91660d4590ed48aad854d3568dea951af3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713423685, "uuid": "999ce5a0-531c-465a-be3b-74bd8269bcbf", "comment": "Malware payload", "value": "63667063f9249bcbd7f5f6e911cfed5109042f90b0cdfb6b7a8bf132cf089eb0805be19264bebf7ff7495c4bcd38287a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423685, "uuid": "74788e68-1adc-4c8b-8428-bfba34eeb8c8", "value": "T1DEF4220420D8EF2BE78D56B5BC91428113F8C1832E92F7D99DE134E599893E869523FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423685, "uuid": "4f192612-1240-4b73-9ded-812ed0db0266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423685, "uuid": "e755e570-9e43-4608-bf08-618403bf7244", "value": "12288:mAtH617FRqHXH2sfD+CXVTfnAnR0b7GPdfe4pFjKYGK/McCMGAJ76KLa0Tu3LU4l:cR0bfwZPGK/ZCMGAJ76KLa0S3LUQV6YL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713423685, "uuid": "ad5edca1-08e7-4ab1-a4e7-0415c44825a6", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713423685, "uuid": "14dcce14-c639-4428-aa47-5e3725aecd9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713423685, "uuid": "385348b2-eafa-4d25-bcbf-a7be7ed1e964", "value": "Document for shipping.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65b1d15-fdbb-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1713469396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713469396, "uuid": "f05d7ebd-5bdf-4587-a1e7-57cc7290d0ff", "comment": "Malware payload (Adware.Generic)", "value": "702b63d3eb93cfd393dbc7f5359a9940", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713469396, "uuid": "9ea02145-1855-4639-8db5-405f3c8f5061", "comment": "Malware payload (Adware.Generic)", "value": "f4cbb54e6a5970d9e63f345a24546262e478941ccb673919e1ce43fed75a8bb1", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713469396, "uuid": "24af5515-21cc-4ed4-b267-d203718c3c4d", "comment": "Malware payload (Adware.Generic)", "value": "3533be0ee443c84b2ddb66b39a9597209a6f0f97", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713469396, "uuid": "6a4db983-4a54-4a1a-9fe3-91b652ef2f02", "comment": "Malware payload (Adware.Generic)", "value": "2690d3774c49bd205cdf39a75354925c97d51755a4230d2298befa0f7f386685c275007e2d05bd95cd6cbcee3e1a1171", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713469396, "uuid": "14b0a4d3-9116-419c-83c1-abd0e060dabc", "value": "T13D85EF1273E0D471C56349315EEACBA4E2FAE6A35A328D0733CC1E4D6F709519E3B61A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713469396, "uuid": "8869f44c-1ee7-433f-be91-9ad9438f67a1", "value": "750c11ea2b916c5e2e39128ffe1d6a60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713469396, "uuid": "c3b64963-2173-4537-a235-0b66298ed348", "value": "49152:h55NuxHrnToReT+vPEYE5drWXm216k4c2SRyiUMBWht:L5IxHr8Ru+vPZkdy1Fx2SRyiUMBWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713469396, "uuid": "4de575bb-c525-45d3-865b-00470d64d3bb", "value": 1811312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713469396, "uuid": "038c654f-2931-4524-9e1f-03de4df95a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713469396, "uuid": "4b3dc282-1f09-4c7c-a5b2-9e389f0db807", "value": "SecuriteInfo.com.Trojan.Siggen17.35688.9477.7627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4d820b-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713430992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430992, "uuid": "7f5e002d-bff8-43f2-b30a-b21751438f0c", "comment": "Malware payload (Formbook)", "value": "4dbc97f8d5317c9d1dfacb195dbe6af7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430992, "uuid": "b2e85247-03ab-4e68-94d0-a7a898a0a810", "comment": "Malware payload (Formbook)", "value": "f544eba4ca4d129edc8c944d9b236ea7b92c71c0085617fb43eb3a451681c3ff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430992, "uuid": "410854f4-d481-4da0-877a-8272b7283054", "comment": "Malware payload (Formbook)", "value": "c50c88d61aed7ec85c31f18267bca471cf94065d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430992, "uuid": "842527e9-c82a-4287-95c6-54d0e37ed9e6", "comment": "Malware payload (Formbook)", "value": "4eda71c48b022ad99db2d53d54e361dcd886241333a6c10a9b71a5147391400aea2e5e02459edf1e9371b9588a64ed63", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430992, "uuid": "0c5c4610-5a6a-42d9-847b-69eb6f794a25", "value": "T119544AA0CFCA26394F4B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430992, "uuid": "3ef3dca2-c5f4-421c-a21f-93db732e3481", "value": "6144:LmdAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOKR8q3iQFw0:6nS2Im4WnPwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430992, "uuid": "f6a2f3d9-2d3b-47fa-a22c-c3d5ea54f8b5", "value": 285725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430992, "uuid": "8bbb293e-e7d0-4e31-a5b0-b6554dc93dcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430992, "uuid": "3b257f0d-d5f2-4192-86e0-e9596e128f97", "value": "Outstanding Payment Invoice PO 3400375980.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e124367-fd62-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713430834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430834, "uuid": "34dbcdf2-0056-4d33-bca6-8c7f0efbed32", "comment": "Malware payload (Mirai)", "value": "81b749fcec79dfaca59c8869ed9eeadc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430834, "uuid": "d17e59fd-c43d-4230-8926-80de53510f7d", "comment": "Malware payload (Mirai)", "value": "f60384bd5329b2f1d335290896c16efa87b8c9375110af057345f0824a367b73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430834, "uuid": "aa4c271a-6e27-42ec-b44d-54624c0bcacf", "comment": "Malware payload (Mirai)", "value": "e5d71394f196dddc6592ce0f6d306508af7386e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713430834, "uuid": "bdff4507-d5e9-4b4b-87a1-0e69c7bd16d2", "comment": "Malware payload (Mirai)", "value": "2b9a208ec2615b806d39c09eb681414f4cf9f1872f92e9405475a0086b222a47cf3d52d7395fcf6bfcf2afdd8b6f0a81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430834, "uuid": "a7c4cd56-73ff-4e21-b7f0-803eae8fda45", "value": "T163D2E01196D5E071C3F018B35E6C8B422B8406BF9ABC30BA29160D305EB54DA6BFF5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430834, "uuid": "39084dea-a115-453a-bedf-9e15589d07ad", "value": "768:7II/P6ce/g0LI3Jlnhh3Pwg8nJhsTC+Ot+f8Lete3g0xD3UoQ:716cUfI3LfX8nUTCf+kUTe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713430834, "uuid": "c76a7370-fcf5-4075-969a-6986b3b5447c", "value": 29492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713430834, "uuid": "9855318e-7e0d-4c39-939e-81509c6d1570", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713430834, "uuid": "89f73183-4a05-41c3-802d-eb1104d0cc0b", "value": "81b749fcec79dfaca59c8869ed9eeadc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4aa226-fd68-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1713433700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433700, "uuid": "1b3c8dc7-db77-45e8-8b7d-385ef6041313", "comment": "Malware payload (GuLoader)", "value": "a03e5551bf8b70078d614454d0443e5a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433700, "uuid": "f460226f-8b70-4ef8-be5e-57a86752b476", "comment": "Malware payload (GuLoader)", "value": "f6672be987a2a11d9653fe0d0c03d2dd7e75756ac88c0cf952872afe5a3c02b1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433700, "uuid": "e08b3fc2-39c9-4d6a-8d61-403569fc8355", "comment": "Malware payload (GuLoader)", "value": "fe998c6c6ea5dec7dea6a64ec5b859039ea376f9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433700, "uuid": "594277c6-5ed3-4bcb-b892-f8ad36666fb7", "comment": "Malware payload (GuLoader)", "value": "812a41332cbc9fb62ffc47ddb21537f219a546fbb58a3d6921f3be1c6e5a281b121c8d88a8797d64e62ca7388033d06b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433700, "uuid": "34fe33b7-031d-441b-a2df-34182fff9392", "value": "T181543AA0CFCA26394F5B2FDABD60459289FC8199021224BDE6D907AD7243D6CD3FED14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433700, "uuid": "aaf62011-1949-4705-81d9-1919e19d5724", "value": "6144:LidAYDLBLW+8A1ytW3xrbjsSFuHeEC57kdmXl45zaoGGqAP3MQ9scOSQ8UO1FsIF:+nS2ImHIYIq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433700, "uuid": "728b0f64-b514-4b97-b66c-d4596cce118e", "value": 285303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433700, "uuid": "517f6016-ae63-41d1-b195-4ffc2febdc8d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433700, "uuid": "d52991ba-534b-4b1e-8ff9-17a616abff73", "value": "QOUTATION FORMS_220707-400.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56dc39dd-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434795, "uuid": "b430d297-c2f3-4c41-80b6-e065eab724ad", "comment": "Malware payload (AgentTesla)", "value": "aa2ca798ad773515fa4147777032f081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434795, "uuid": "d2f02cf9-f3c2-4c36-8d18-9efd1c57d26c", "comment": "Malware payload (AgentTesla)", "value": "f6c77ac1c427fe9092c007b67b41402a471bd7726ce84e5978fdc953d08c9b0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434795, "uuid": "03d4ec4b-6f7d-4f67-b69b-1f38a3ca2d63", "comment": "Malware payload (AgentTesla)", "value": "5ea0260030deaf088fc4690e170aeac09dcedbf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434795, "uuid": "5faf203c-0e3a-4205-975e-c5e15616550d", "comment": "Malware payload (AgentTesla)", "value": "3edfad0df7ab50c094918e3914d3b963c1453c5ffd37bc18b9cf7ca33e7ef6a64abc425188b77d76d67d35494f27be85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434795, "uuid": "887ad7d7-b96a-4f16-bf67-3bf3de082514", "value": "T16564362ED34E02698F520273AB1B1E95A6BDBB3EB3905171342C433933D9C7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434795, "uuid": "3839df2f-8ec7-4bff-97fd-ca9b2fbbfebd", "value": "3072:asXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMEsluyI0WDGXCPL:vKMeKMeKMeKMeKMeKMHAyI0WaXCPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434795, "uuid": "7e7f6623-2ac0-4d30-9385-0396584dcc0d", "value": 328682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434795, "uuid": "7a217ec5-e2df-464b-84c7-1e1915c31d3e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434795, "uuid": "b5314741-a43f-46ad-b8d4-d825f2f7b3ee", "value": "rks18.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315b7a31-fd66-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713432585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432585, "uuid": "44444959-bf16-4ce5-9c78-c3fac6b1271c", "comment": "Malware payload (Mirai)", "value": "4e6a5abf42371ba4aedf2b96b555d031", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432585, "uuid": "01bf83fc-56cb-4c1d-9b80-37d9a40b2c72", "comment": "Malware payload (Mirai)", "value": "f7379528690b5ce121b7a813fc057d9d02df15e8f986f80d03b131da4f81fe96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432585, "uuid": "71cd4c6c-59c9-4bc4-ba43-baf2884416ee", "comment": "Malware payload (Mirai)", "value": "c43648a5d3927c3599635a437043086a6f940221", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713432585, "uuid": "f9109b98-bec1-4eea-9dd7-4d9263de6603", "comment": "Malware payload (Mirai)", "value": "8a6c9b640f9bcfb0ac2049ca3f8c913a86e05f6d56d8ffd52da51a586c641c1fa9097ec505b2d06b56c805df035953b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432585, "uuid": "7a24bfc7-64bb-45e4-a082-a32baaa3433b", "value": "T1D453020B13085257DDEA86F25FF62B698FD34F77D9829C880AC96643C44612EB963FC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432585, "uuid": "cdaa6cc8-53d7-4da2-b8f5-8ebf1e4c1b8f", "value": "1536:/r2JGCZXYO230d3RC3D+VdYAVx7OaENJ4+DfC8g+PVJu8T:OG6Ize3RC3DqdPx7O7JhfC8gUVQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713432585, "uuid": "cf972def-1fa8-4d81-860b-a1fabc4db3fb", "value": 65876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713432585, "uuid": "18e4e7c1-0cf6-434d-a199-b00fc2ed8e19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713432585, "uuid": "f46487cb-859e-4657-89c6-765eff86c25a", "value": "SecuriteInfo.com.FileRepMalware.20155.16240", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3b151f-fdb5-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713466449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466449, "uuid": "cef3a1be-d107-4190-89d6-aaa1989b29f8", "comment": "Malware payload (Mirai)", "value": "f4a2e178b2b5b6a5deb1d6c76de0a49b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466449, "uuid": "2c4ce5bd-832b-4e23-8f02-fe86c610dfd6", "comment": "Malware payload (Mirai)", "value": "f7f1973f6160bb4251ea95ebd1c3a5e6ef39c28a1a98e40aef7542b4daeb80a0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466449, "uuid": "b9c4c34f-ded2-4171-86f9-e590b2679fb2", "comment": "Malware payload (Mirai)", "value": "7d5826f9f1e4da77dc3130b1dd3c52fe9895236f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713466449, "uuid": "0d2189bb-4bca-473e-bad3-038ea65227b2", "comment": "Malware payload (Mirai)", "value": "c6fb60c691fd5803413ccfa26dadbd7dbbcb8e1bbc2744e0e9d1411487bb2299bba6e84483ba071301a2227d4dd8adc7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466449, "uuid": "03e6ce94-ccee-4a69-9e38-f454be6a21c8", "value": "T166042A46EB404B13C0D627B5FADF42453323AB5497EB73069628AFF43F8679E4E22905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466449, "uuid": "5fc569f0-b659-452d-b442-a0a091b7e4f2", "value": "3072:EZHZ1pjx3vAqTkgabsh+OcAIeLHSwBjvq2cJsoyM/Rs+qtK:EZ5Hx39ogabsh+nAFlBjq2+xyM/R7qK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713466449, "uuid": "9e63f988-e4bd-4532-95e3-74f6fcc73c85", "value": 179803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713466449, "uuid": "ae4662b5-67fa-4aa4-988b-01ce045195cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713466449, "uuid": "253b832c-bbbb-466c-b1e6-0922abb3be4b", "value": "vlxx.arm7-20240418-1854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f15a353a-fd8f-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450516, "uuid": "7c07cdb1-70b7-40c7-aa28-ae906f1e9a21", "comment": "Malware payload (Mirai)", "value": "3615b8182cbec384d884a9cfd43907c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450516, "uuid": "05193e53-463e-49c5-9144-7102fd643579", "comment": "Malware payload (Mirai)", "value": "f8852d5bc6a36dbe920ea1741724d74fc3306e705d82d6f4a76f10bb7b81ca24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450516, "uuid": "eb757008-4051-4178-92ab-a96051a652f7", "comment": "Malware payload (Mirai)", "value": "3f9ab307285b5a50cc2807a1c358bfdf4b656ec2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450516, "uuid": "05cad483-fd0a-414a-9d79-93c51856954e", "comment": "Malware payload (Mirai)", "value": "49c8b11b018f821f0b1da106c09fa9c5d13145fa4bc63d5ae6e933c1c5ff699462d9a01fc10e7be801e1b65793ce42be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450516, "uuid": "59ab2d29-dade-4798-9220-222ffb877b26", "value": "T102E329D7F800DDBAF80AE33748530909B530BBE245925B372257797BED3A1991873E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450516, "uuid": "86fd696e-111e-48a7-8085-31e3af0af31a", "value": "3072:SQsZaBZDirvG/TPPf9jAcMUlqDVrjbiRLyxV2OyiahTtN:JswNHfRAolqwLyxDyiQTtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450516, "uuid": "1b6578d1-1772-4cbe-a9d9-5f68f295d56f", "value": 150432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450516, "uuid": "6acf082f-e95e-411d-8bb8-26de78f232a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450516, "uuid": "61ec9dee-58bd-4e57-8329-59eb657b2636", "value": "3615b8182cbec384d884a9cfd43907c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e82867-fd69-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1713433936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433936, "uuid": "03c089cd-23ef-4d4d-ac58-e31898d98232", "comment": "Malware payload (Formbook)", "value": "a7d42c39d1bb1e64c8baea4d55ced981", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433936, "uuid": "9f5360ad-f834-438d-9ddb-fdeb8fa49d92", "comment": "Malware payload (Formbook)", "value": "fb4cd2f94eec2704d9a5599eb2038f5baeb5ff26edd05852a3bcfca6e132db8b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433936, "uuid": "c4c8862b-85a6-4dd0-8a15-5780295d0dbb", "comment": "Malware payload (Formbook)", "value": "1e988cd471c9d97e377f4ac636c61ebdcf9d4441", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713433936, "uuid": "29d112b9-803c-42db-8a03-dee4d8c1554a", "comment": "Malware payload (Formbook)", "value": "aaceba7cf804edb28632b3da4d53d381c7bf84dc0d89120a14322957375a3ed049a58ee7f2b2962907ba8d63fb7a3369", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433936, "uuid": "83d0ed74-8536-4ae3-bda2-63a92be35028", "value": "T1A52408F0DF0B36199F5B3EDAAC6445924AF98195051238B5AAD807EDB283C2CD3FDD18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433936, "uuid": "be229406-3c76-48a9-9e62-b034eea68325", "value": "6144:8YBgIjQvrMbWSR4WHUJJs9E87Fy4lZrUChpqKmjum4QlNVrDjXR46cCPCRJfSLqC:l2dOyFBzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713433936, "uuid": "ad1362f5-327e-4557-a151-d167039245a9", "value": 211437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713433936, "uuid": "8b85d9c4-5636-48f1-a766-dc64dfbf8262", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713433936, "uuid": "1ba4f54b-2362-42f8-b6e8-509e28b2980e", "value": "FAR.N\u00ba2430-24000993.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59c0c55-fd78-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713440564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440564, "uuid": "48e6ec7a-a4cc-4a2b-9893-5628f66b111b", "comment": "Malware payload", "value": "987afffc48e4f2f07ccd34609f51e2af", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440564, "uuid": "fbf7c7b2-642b-486f-96ae-263a74d28dc7", "comment": "Malware payload", "value": "fcbc47c05086a6ae45641ab4f48994ba58af0eaac140670184d050612f838df3", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440564, "uuid": "de76e100-055d-4234-b381-77dd983a99d1", "comment": "Malware payload", "value": "9c57f58607e3bcb8345b9291c51678b6024eaaab", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713440564, "uuid": "65c7cfbe-298f-4949-b5a9-535f3222cbb3", "comment": "Malware payload", "value": "3ffdbccc385c3539526e519da33b015d77fad658ff2ab283336911340c25cf2a0b6050e318349621927acca9309865e9", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440564, "uuid": "e7c69d43-1e0f-4922-bc36-7d7c92c457b1", "value": "T111F323423497E929BAC739F6CA7F85C1B257C226544C90CAB32638809F6B4A16D994F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440564, "uuid": "e95d5ec4-ccd7-462d-9128-84ba9b64fbac", "value": "3072:VUqIBRpbpiWFWwxnGWqpD8vKEUdUdE4yEEV1/3cSy/jxQ+RGp5pp7PZgv5cZcJ1:ivbpZowE18vKEEdhN1/MR/FzsLacG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713440564, "uuid": "cdaa5d60-31ae-4eb9-a7a4-9a5d647564e0", "value": 169762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713440564, "uuid": "69750842-2e54-44b2-b2c9-ff068dcea866", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713440564, "uuid": "875e4fec-7824-4d3c-8607-e6b96980b90d", "value": "Vero4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd7164b-fdd4-11ee-a120-42010a9c002e", "comment": "Malware payload (PrivateLoader)", "timestamp": 1713479934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479934, "uuid": "a833acbb-eaa8-4926-9c97-e44548f9b2a9", "comment": "Malware payload (PrivateLoader)", "value": "193692e1cf957eef7e6cf2f6bc74be86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479934, "uuid": "590bc8e2-f125-4733-8f61-3cb733a58c2d", "comment": "Malware payload (PrivateLoader)", "value": "fcc22a367ed0a8d8de94f5159ab12c32606f97326b832eb47327b7707ba457a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479934, "uuid": "b7e06fff-38d8-4e90-9c0e-1e393b8c0c87", "comment": "Malware payload (PrivateLoader)", "value": "9d1f849b57c96ca71f0f90c73de97fa912b691d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713479934, "uuid": "e4023170-2166-4f87-83a1-a64b0131b0dc", "comment": "Malware payload (PrivateLoader)", "value": "aa521abe6f9340d34a28530fe8f5d5cf0cde1b83bf39b221d1784931e10dbf25ccb7951c3932a1d138334f826235668e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PrivateLoader", "colour": "#73A0FA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479934, "uuid": "04eb3206-949f-4401-8f4b-41c09f7e7741", "value": "T1240622467E8B0AF1C01DCB74D84220AC7127B781DDA24E273AC911189EEB6656F7E3DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479934, "uuid": "b92707df-e580-4a62-b66f-6047375476e9", "value": "023aae353653db016d3a89da454d1d86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479934, "uuid": "f68d0014-ce4e-404f-a368-65dd7b4d3e83", "value": "98304:agjjIlB/cHzyG0hlcX8fjr3oS6QLErN4QkMvqs:agwUTyGR8rqa7QkMis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713479934, "uuid": "685afc56-c212-4473-b724-cc14c78f9bcf", "value": 4008384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713479934, "uuid": "cae18ae0-0580-42c4-8447-f0b2eeb0879a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713479934, "uuid": "bd675e80-c5f8-4ae7-b851-962b447a32d4", "value": "SecuriteInfo.com.Win64.Evo-gen.32634.31069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc87563-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434776, "uuid": "6278c414-1885-4e52-8732-483a1ac3edcf", "comment": "Malware payload (AgentTesla)", "value": "b818e0d521e1cd9a4a09dc1a76706275", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434776, "uuid": "554c1490-23af-41ae-bcb2-0fd7753359fd", "comment": "Malware payload (AgentTesla)", "value": "fd0e3829a55672c4fc6b9a3eb1634ddfed1ee4c8b5065d6eae506b0b32ace601", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434776, "uuid": "b42b97a3-5066-421f-a1d2-fddf4d00b7bc", "comment": "Malware payload (AgentTesla)", "value": "372eecccf3fdedc74a27737384090bd5f79ffead", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434776, "uuid": "e2035abe-0eed-4e66-a83e-78115b2b1dbe", "comment": "Malware payload (AgentTesla)", "value": "61c97373756344e34008eba55e553fe26957b337d6177096ace023193767dbff83f1f6161b9e695a33a2a1ce106774a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434776, "uuid": "09056b42-6a98-492f-a23e-797e5b5a086e", "value": "T1A835AC0273D1C036FFAB92739B6AF64156BC79254123852F13982DB9BD701B2273E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434776, "uuid": "a810c8cc-4f15-47f6-ae99-3139044389d2", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434776, "uuid": "ed05ad76-bbb2-44dc-a77e-2e4b2259d3cb", "value": "24576:tAHnh+eWsN3skA4RV1Hom2KXMmHatUegDaa5Ik25:Mh+ZkldoPK8YatDgDaIIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434776, "uuid": "e28bb83a-e052-4b8f-9730-21a94b9f35d1", "value": 1058304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434776, "uuid": "6fb0fca7-f2ea-4c0b-b07d-4cbc06f379d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434776, "uuid": "74d777bc-450e-45e7-9a0c-aa4e8d8896a7", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d21ca868-fd9f-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713457336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457336, "uuid": "4cef0958-38a8-4b9e-a000-1fd6465878b9", "comment": "Malware payload", "value": "f4f731777157f1bc59369be4b286b5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457336, "uuid": "d7205928-d57e-4475-a919-485a6a5c1f02", "comment": "Malware payload", "value": "fe6328938db1b9c8e3e8b1a92f0cc5ac28a6fd5e0c7e40c521f7b0f408e63c3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457336, "uuid": "463673f2-d7ad-45a2-8932-d7fe6d8d0ea4", "comment": "Malware payload", "value": "ebce4a1a3b15bce601671867d36965b15ef4108b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713457336, "uuid": "c4c33a04-a482-4bf2-bffb-cb05bc7b63d8", "comment": "Malware payload", "value": "1b603fcacb27a9f017ad05688460f8ad586d9f96c745d250b8eadf4d6f30e3d6b245a7a77b13196cadead073683479d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457336, "uuid": "3540e6ab-29d4-4841-b9bb-24cab9082ca7", "value": "T1FF04644A91C354B8EC7398F0F838C07A75519C814A3A429E6B34B6DF26FC066DE27D76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457336, "uuid": "0169bb1b-d51e-473a-b941-fb28af4393cb", "value": "4d14d19b876bbb7a86ffba329be9d956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457336, "uuid": "511280ac-b224-4a56-a4a0-2293825f84f4", "value": "768:lfGgTViahszDOtfGgTViahszDOCBsMEzKzaiLFOJJfGgTViahszDOmefGgTViahZ:F4WsO94WsOf+LFS4WsOF4WsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713457336, "uuid": "fd2b0b4b-d7cf-430b-a78d-ef92957c5409", "value": 187372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713457336, "uuid": "702d3684-53f8-48f7-b17c-7db0a6b4c9c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713457336, "uuid": "05950a60-8ebb-4fc5-bff2-99ca603b7548", "value": "stage2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d883bf78-fd5a-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713427711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427711, "uuid": "aa20925c-f400-4cfe-8dd0-56e60170a692", "comment": "Malware payload (AgentTesla)", "value": "36fd7195da0b7562c04ba8e3f055e6fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427711, "uuid": "f8b0e1f4-2549-4efb-bbc8-688a7bc9d9d2", "comment": "Malware payload (AgentTesla)", "value": "fed5aa29002c173014320d6fd24304d0bd94089c51a06d06e35a66eef84908c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427711, "uuid": "0b4169fa-ef9f-4886-bb92-4ac3f7d0e82b", "comment": "Malware payload (AgentTesla)", "value": "dac1a451343920a8591606f34d1e04872dcb1ba1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713427711, "uuid": "36fdbe7c-7234-4e34-a907-0f1c8902fb4b", "comment": "Malware payload (AgentTesla)", "value": "5e745bbc44aa1e5489be4de0cee44c5941cf52c4d25ee895270c6264778598db2f4e7328534c57ae29cd4216f60d49b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427711, "uuid": "96215768-2fce-45e4-bbce-423acafbfb32", "value": "T1FF74362ED35E0269CB520273AB1A1E95A6FDBB3EB39051A1342C433433DDC7D52266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427711, "uuid": "1170b5fa-c9eb-4402-9294-bc36a95e388a", "value": "3072:ssXvKMEesXvKMEesXvKMEesXvKMEesXvKMEesXvKMELIGB719Jsn87w4XeW:tKMeKMeKMeKMeKMeKMCzBCn87w4XeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713427711, "uuid": "b646bd5c-c047-400b-b2a7-6b84edf39169", "value": 345045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713427711, "uuid": "bdde319a-db03-44a8-a397-4d9472295dfb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713427711, "uuid": "25cce914-9cfb-48c9-ad15-ab4275d5cddc", "value": "Remittance 18042024.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115d811a-fd97-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1713453576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453576, "uuid": "672ab7b5-4624-455e-91fc-556fe1b18ea3", "comment": "Malware payload", "value": "786be6d28662a66848ca7495777596b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453576, "uuid": "660dc8b9-a736-410c-bbe4-458c3e9f6fa9", "comment": "Malware payload", "value": "ff5d54630fd8abc7e71b8ec9fe575b995160b4eef96688775faf2cadc4f731c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453576, "uuid": "bb3baf77-dc2f-4368-a7a4-80498d2f5560", "comment": "Malware payload", "value": "346a900cc135fa606d83739b09cc87a39ecfbd55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713453576, "uuid": "2891b69a-b4b7-4a08-9ee4-034b1906713b", "comment": "Malware payload", "value": "19b4a9ea221255f36e10e0d57d8ce9150ad596c22f8e5883f91cbd7734aab0ac3acdb892132ecb76a47aacac36de9d36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453576, "uuid": "8bf588e5-d48a-4c91-8304-06a9ccf17b70", "value": "T12BF4391BA59160BCE42DD27486D75631EE72F8688AB6F74E8AD013520F7DB902F1E334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453576, "uuid": "4165aa26-bdbf-4164-979f-e063ef44e184", "value": "7e7d53d50cde087bbec1e11952e1efcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453576, "uuid": "d7d3b7f4-387b-46e3-aa06-a9c833a38ec2", "value": "12288:gRygzJ7rsFxp95jaZzhXeGdyr3KaIn60b5xxVDS:gRy7KZzhXVgbrydb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713453576, "uuid": "6c7dfd41-353d-4988-84d6-0c7052c60cb7", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713453576, "uuid": "85dded7d-b3c4-44d3-913b-87971f29cb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713453576, "uuid": "9b850a94-cf5c-4ee4-98b9-f733e54c4897", "value": "netlib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc05dbf-fd90-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1713450857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450857, "uuid": "881a2850-0487-459f-aafa-6a3343e76854", "comment": "Malware payload (Mirai)", "value": "8ab9e5097af5b534ae8474120c39e41c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450857, "uuid": "0d3f2807-65cb-4c68-a511-13ea2e4c8ba2", "comment": "Malware payload (Mirai)", "value": "ff67d150e20671b3f93f516f8e3d2164e146b976c725907d9e269971e8f1f40f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450857, "uuid": "59bf6f47-d00f-465c-9fc5-5e5b794b32e0", "comment": "Malware payload (Mirai)", "value": "c6f98430a9e4cc3aa3944210859cbb54b49a2a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713450857, "uuid": "693170ba-b7e9-4c88-8da6-1a9f8f33df56", "comment": "Malware payload (Mirai)", "value": "6ba779b9f399dcb465c2735ca2afae5f1d17d981bcaf5c6a9bccdd554f8d8443d8089647d96384d1a07cb330cd7ea9d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450857, "uuid": "ec206858-9784-4726-b759-27c4b2eb4494", "value": "T148E30A56F8819B12D5C111BAFE1E128E37131B7CE2DE72129D246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450857, "uuid": "188b4165-d9ae-4c25-912d-9c89307a7454", "value": "3072:dUIK7jkrUmWbz0+X4DmPwtaHcJpjvqC+3CIRF7:dUrvkrR1+XKmPsaYAX3CIRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713450857, "uuid": "452bcec6-4334-4d9c-a93e-7c720d29794c", "value": 143228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713450857, "uuid": "c8e4ea25-03ae-455e-ba12-a14c24ca8fac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713450857, "uuid": "7702df23-ba1a-4ed2-aa55-8e895038c898", "value": "8ab9e5097af5b534ae8474120c39e41c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dd7330-fd6b-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1713434686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434686, "uuid": "f652994d-e8e3-4cdf-ba23-5941d77eedd2", "comment": "Malware payload (AgentTesla)", "value": "00bad192ae9a95ceb8036a24cb07d9a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434686, "uuid": "3c4625aa-730a-4434-8e18-d3dd4e0ce058", "comment": "Malware payload (AgentTesla)", "value": "ff996f57f789c33a0bccca470b496639007e76c6f19d0fc17253ffddfa039a3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434686, "uuid": "47094996-0663-4edf-91ca-273b4fba0097", "comment": "Malware payload (AgentTesla)", "value": "3a0cbe87048dc1351dfd41594712fc4ddaea7611", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1713434686, "uuid": "c6496219-b3cb-4831-be1c-8cb6fc046b61", "comment": "Malware payload (AgentTesla)", "value": "913fba0f0fbac0a5f31f55bd1cf36913c61994bebbb49e4dbe28b4ecee6f5e4f3a2562190a445c2c3ed55a21f8e7562f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434686, "uuid": "e8bc2b72-5775-42ef-98b2-b996ace80b58", "value": "T1E145CF027391C062FFAB95334F5AF61156BC6D260123E61F13982DBABE705B1163E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434686, "uuid": "db636269-f57b-47e6-ac61-07a845392d27", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434686, "uuid": "49635111-0d4e-44b9-8b95-48dc871771a6", "value": "24576:/qDEvCTbMWu7rQYlBQcBiT6rprG8ao7Y80riEoy+ENS:/TvC/MTQYxsWR7ao8Nrcyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1713434686, "uuid": "39983490-4106-49de-ab0a-45d8e7eabbf8", "value": 1189376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1713434686, "uuid": "9e59ad6e-338c-4816-9a0b-3860f28c6b3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1713434686, "uuid": "98a80109-1b6b-4763-9c65-4f2cbb6887d9", "value": "dhl shipment IS00O105560 INXPECT- 4123074 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }