{ "Event": { "published": true, "date": "2023-08-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-08-22", "timestamp": 1692748981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6a48d700-f0d1-49da-be21-c6315206e9fb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458301b0-4086-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1692665593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665593, "uuid": "d64c0aca-9ad3-41f4-8866-14ca974e4f08", "comment": "Malware payload (MarsStealer)", "value": "8b6381e7012b5af6f496088eabe38ef2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665593, "uuid": "aaf822d1-179b-4ecf-b8e9-4de971ab727b", "comment": "Malware payload (MarsStealer)", "value": "0044ef132e6113d649ef27f1864c350ba16cb7ad5b4257fdb24a8cf9ec670310", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665593, "uuid": "6da6e0aa-01f8-427e-bbb2-e47bb506ba2f", "comment": "Malware payload (MarsStealer)", "value": "fdcdcef4ab1a741d3c720b76d5b99a8440c2a6c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665593, "uuid": "2b58f661-b3e1-4b42-9d5a-9c0487e252bd", "comment": "Malware payload (MarsStealer)", "value": "cc018f981c3d8c61742341b1f183b42d2f848e6659c4961fbca561232feff48157dfcbc7424ad110c726ea8dba9e7e8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665593, "uuid": "5caeb6ba-be4f-419e-87c5-800e21a4ac20", "value": "T1B734AE0262E1FB36F5674631DF2EC2F07AEEB4615F559A563314072B0EB02A2D66F312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665593, "uuid": "b324bf8c-a4a1-450a-9ed6-982258efba2c", "value": "369416073ed39eb88716e6b4aeee9423", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665593, "uuid": "e9bfa9b2-6a06-48a5-b5ae-993dbd49b915", "value": "3072:9+MYUoB6O1L/sfZ4ToXOYju1CA+pkqU26Vf2O7OXxJiEA4Of5g8pjFx:joBNL/sfZ4To+F1Cvp+tV/6Y54h8pjf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692665593, "uuid": "bab20ee7-097b-4e0e-9f36-c4cd2d97170e", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692665593, "uuid": "248f49e2-6d97-4cd8-b178-2dd63fade6c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665593, "uuid": "0de10279-c97b-498c-9ace-5e76a8762958", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2eb6fb3-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687358, "uuid": "8c937e45-9e92-4c4e-89ad-682032915bd9", "comment": "Malware payload (Mirai)", "value": "18444bc11a60041dc261fcd105694da4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687358, "uuid": "014e5a92-2d21-42df-a862-4534a3cdb355", "comment": "Malware payload (Mirai)", "value": "004e1515bfe0ac81d286b3172dec9e2159e13613fdcecb34f01aa0c40d7cf823", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687358, "uuid": "a1b90e89-e24d-4cc3-b15e-b71cc50d3d83", "comment": "Malware payload (Mirai)", "value": "a525f6898c8e4e0d3950117f01f57617ae2832bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687358, "uuid": "a25819d3-bfe6-467e-89ab-a9422c44d454", "comment": "Malware payload (Mirai)", "value": "1474469b86a6e2b7f398d7627b1608dd6131772e45bed6d571eb3b6643ef9be338d39c21bde1032ee7cbf2ec4d78167c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687358, "uuid": "63048d9f-bea1-43ad-b90f-1353b9e03c38", "value": "T1E4C2D0DFF4863985CD1C5CBC219D5AA116A8A2C7234B9B0837202DCCB97645EB8AC4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687358, "uuid": "eb3f7ad1-f31e-4462-91d6-a22a00e067f7", "value": "768:McCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBKTWe:3CrJgHiOJrfwmQrct0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687358, "uuid": "c8c5e02a-0031-4078-a3ae-e9eff6ccd8ab", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687358, "uuid": "e74d3329-57e6-4461-8332-34cac612f9ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687358, "uuid": "02e06cce-c3cd-4ba5-8a87-51baa5362a47", "value": "18444bc11a60041dc261fcd105694da4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6416b004-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738658, "uuid": "b13158cb-c578-4414-9f04-a1ad473aee00", "comment": "Malware payload (Mirai)", "value": "0f4c4c65bb8aa6258cd24650733af475", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738658, "uuid": "30249a1c-54cd-47e7-959f-93749283e813", "comment": "Malware payload (Mirai)", "value": "016ea7f818c8989de237f2738eab607bf4901f7f69ba7af7379bc636808ce28b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738658, "uuid": "c1b36172-25a1-4cf0-b97e-935e101c722e", "comment": "Malware payload (Mirai)", "value": "f6b16e8aa81bbbc7e3988dd377087718fb068435", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738658, "uuid": "a7b4e3de-1ed9-421f-935e-c222418a85ad", "comment": "Malware payload (Mirai)", "value": "e61be2a33f98bb4ba437852a484aa3e6f147c4c5549440b2638b0f1c842c6c9b8c56bc560b176d885b99bf26b14e36c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738658, "uuid": "9dde245b-f4d8-4af9-9a67-ee4df7f61c3b", "value": "T19F539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738658, "uuid": "84647092-ae8e-44cc-9bed-628e42dba4f8", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738658, "uuid": "28d3852c-7e15-41e5-b637-ff41342bc32c", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738658, "uuid": "66391b8c-3c41-4eba-8059-12aa54d0e419", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738658, "uuid": "8c00d954-b4ca-4faf-b5db-51ab1c4dd9a4", "value": "0f4c4c65bb8aa6258cd24650733af475", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa8774c-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715960, "uuid": "3f56664a-f647-418e-ba38-b0837547aba8", "comment": "Malware payload", "value": "7e3b2b10d66955465c12da9f2ab43e36", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715960, "uuid": "312fe470-8727-4b95-8540-c64828563ff2", "comment": "Malware payload", "value": "01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715960, "uuid": "6bb9ca39-4e0f-4fbc-8f17-e0f4284d1042", "comment": "Malware payload", "value": "2ee3d7ce4ec3461026e910fdfcf9d18dd43eb380", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715960, "uuid": "c6c52cd4-e09c-4fc1-a213-8ebc65aca04d", "comment": "Malware payload", "value": "44d6773b571efbaafd57df1a29f4a73561753ab508fe7df4ea6daf1d7b207ece468004889f3bbde7b1fa99365527d29c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715960, "uuid": "b11f190c-f7fc-4e3e-8829-ecb42b453b51", "value": "T198F38D1971D1A0B2E4F30976D5B8AF11846DFC111BB07CDB72E61A9E19320E3AE39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715960, "uuid": "a709fa1a-2b84-47ab-a884-3ee77c9f075e", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715960, "uuid": "9612e38b-a7af-4c6a-99c1-da9bfea0cc43", "value": "3072:l5K/B0toLuSNJilZHQsozTS+SMqqDL2/TrKLOG:lcytw7a1yTS+xqqDL6HKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715960, "uuid": "b4f09041-16f3-4826-97b4-2b208e7cc13c", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715960, "uuid": "227bcd6f-2d5b-42d0-8d80-23b4294d74aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715960, "uuid": "dce3e706-26dc-4de3-8a53-6d06979cdbc4", "value": "2023-08-22_7e3b2b10d66955465c12da9f2ab43e36_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea30818f-40fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692715691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715691, "uuid": "1446e42c-9ba4-495f-8dd0-f1f8368fe7db", "comment": "Malware payload (AgentTesla)", "value": "9fdfcb1374b6a120821bcc03f1e7a8b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715691, "uuid": "c9ec3a2c-be37-4c3e-9afb-aec1aa0fe8d1", "comment": "Malware payload (AgentTesla)", "value": "01c4f0da8b68b7403b40106d39a8b1d2eac56cd22f48f5fb808e3496e9722c37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715691, "uuid": "b8b4e6c3-f6bf-4e3d-a779-8ab09e40985a", "comment": "Malware payload (AgentTesla)", "value": "21e6310ac892218167cfb0adcdb041f311b53208", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715691, "uuid": "3575d9dc-c869-4b2c-902d-b94190e4d9c5", "comment": "Malware payload (AgentTesla)", "value": "ca2c4901feb4036c9342d249bec669c57443eaec24e44d3a77e4a1f7e84ff6fe361f7bb7187b6374dbfc7dd3b00794e9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715691, "uuid": "f0f407a1-6d08-40d8-82af-81f33ab7d3bb", "value": "T122250227A1AA9F05C77C83F560512F8463AB06CE2171F2780D8674E6B2E67D24E925F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715691, "uuid": "7ae06756-3572-45b3-9100-7dc64b23939d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715691, "uuid": "97db1f22-cf35-4519-928a-4cdbd9f9771b", "value": "24576:iS+lCe9qhJDl2shE1rsCxON3rKMm4+iGNiv3qLxj0:MlCe9qhJ814CIN3N+436", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715691, "uuid": "c76da45e-9074-4dd7-84c7-9175503cc925", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715691, "uuid": "52b0a0b6-686f-4b35-b78a-e9ba9240a760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715691, "uuid": "acc92384-028d-4dce-8948-8a29372e0cb8", "value": "z4978GaHYWd1W58KzB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0201fc06-40f0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692711006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692711006, "uuid": "c6612f6f-8bb2-49ff-a821-9810b0968113", "comment": "Malware payload", "value": "cd4a9c369b35d920500732ff87acaabc", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692711006, "uuid": "1608a52e-fff6-4a28-b53d-c019251c7b88", "comment": "Malware payload", "value": "01edc46fab5a847895365fb4a61507e6ca955e97f5285194b5ec60ee80daa17c", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692711006, "uuid": "beadb4ff-0004-4bdc-8e69-62e9252e0009", "comment": "Malware payload", "value": "0e3dc5c468eca5802a66c5f2033af9fa87408c55", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692711006, "uuid": "27ed396b-ca70-42df-916a-69a69302d411", "comment": "Malware payload", "value": "c5661a6cc8318b5b9fc0190379f037be34ded08a270e8dcac28f9eeafdb099b7fed1d857b148d8c969bd241081dcf5d5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692711006, "uuid": "103500e9-46b2-4bdc-af66-ff45376d0293", "value": "T1C565F186BBC5AC2FCD7384354F8A8322A2529D57C243E70759D07A3C6E7B7E44E49AC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692711006, "uuid": "4fb35e6b-6ddf-4f5b-9f93-6a6b678c3715", "value": "24576:ma4Vre444rHTUGeHKMOKH9lWLgo0CS7BUvrMUgU/BXrmdBgw3IZh:ma4VqL4joGeqUDCS7BsMJUpXSdBgw3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692711006, "uuid": "b6cccbcd-f9c2-4743-8149-bb832d6a778d", "value": 1469450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692711006, "uuid": "a59b5201-7209-4299-8c48-b70eaea9798e", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692711006, "uuid": "759cd599-19d8-486e-bbe8-bf5186d48d16", "value": "01edc46fab5a847895365fb4a61507e6ca955e97f5285194b5ec60ee80daa17c.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7c1ae9-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692704526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704526, "uuid": "ade5ef54-63cc-4577-9922-d64e2874b730", "comment": "Malware payload", "value": "be8a6e334ebeda54cc3091658f201b77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704526, "uuid": "def8b695-3117-471f-a496-ba169f7676a7", "comment": "Malware payload", "value": "01f74dacaf2d8cdf26cb2bcc418088c67993bd05cc15978c7ea337a19b7ed8a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704526, "uuid": "a894c1c1-d8b7-49eb-8558-15f89dd161b9", "comment": "Malware payload", "value": "c2ef69491f22610007349cd70bde212c6245aeda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704526, "uuid": "ff715844-0230-490e-8bd7-4170ac54f96b", "comment": "Malware payload", "value": "4289e993f6e1841707104540ef5411989841adeafe417ef981742b4e4037ac04b46153202c2b68f9ad015e4243c26841", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704526, "uuid": "aa6e5264-6199-4a1b-86fe-c8fac4c3b835", "value": "T1ED738E41B6D1C871E67E1A315464C6A16B3DB9114EE09DAB3B8A063E4F313D0EF35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704526, "uuid": "7afd872d-1d15-409b-aff9-c6fec805d690", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704526, "uuid": "0d60eb57-bd65-4031-9f99-425f1c1069fa", "value": "1536:xNEi7fdKoQocShCBPFvh2X/ciZceSsWfcd5X3//PK7:3lQoQocNBPFvGek5XPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704526, "uuid": "3b8186e6-ad33-410f-b906-5662594bcdc7", "value": 76288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704526, "uuid": "7b7a867e-9cc3-4221-9e56-bcb81fb7bc33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704526, "uuid": "020a3288-a3df-4e91-8a9b-98dfa4d6494d", "value": "SecuriteInfo.com.Trojan.Loader.1704.26279.15283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d70f54-4114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692726604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "3370a9bd-6057-4526-a181-ee5d4e73336a", "comment": "Malware payload (Mirai)", "value": "1b1f305c6a15bb2b1fa11a9c1e25c38e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "a7af6906-abef-46d0-b0a0-0899eb98cb2d", "comment": "Malware payload (Mirai)", "value": "02fe8ee02d44c99addf33f0d9700022b94502679d212fc960b4bd7b4ba83f5b2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "c016b5eb-670d-424d-82ac-a560fbf1cd25", "comment": "Malware payload (Mirai)", "value": "7abd9fcd444a6e7de5677528c3cdea9822278f7f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "ef58c085-e6cb-4e3c-9ae3-82d5ab8062eb", "comment": "Malware payload (Mirai)", "value": "24234e72d6a008ae5c4501526adfb09f76251de2549c7ff4e9205f523de2def611b5364482a1e3b6670efe83d18615fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726604, "uuid": "cdc5f02f-81d2-4bf1-a586-cde182473f9a", "value": "T1C9C2F17FBAA56A67FA5C333EE035811B03A4F51C57AD275B27444132E94E81D7532CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726604, "uuid": "174b35e1-eced-4be0-b3cd-41dbf9d74f19", "value": "384:MX1DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHOwIK2I:qMwxdyoEUnDz+Y8tqHWXmueg0NB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692726604, "uuid": "e94f868d-eb3b-42df-a572-9e5a94437485", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692726604, "uuid": "cdce9902-749d-41d2-96ed-bd9c01a48526", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726604, "uuid": "0c263ad2-be8d-4291-a8c2-ac3ed1a65b56", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473b5ae0-4138-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692742046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742046, "uuid": "3c5c6eb9-86ba-4422-bea2-c476eff90225", "comment": "Malware payload (AsyncRAT)", "value": "37950f1c490168d8c52bde11799fa40b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742046, "uuid": "b2bdf5e2-9e45-4f69-bf10-2abf60b9f3e5", "comment": "Malware payload (AsyncRAT)", "value": "0467d797db1facd534f6d1e0093dbfc95de214e09bb180eb3d18ed24c474163d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742046, "uuid": "b38d0c32-666c-452b-ac6b-3308b0851ef4", "comment": "Malware payload (AsyncRAT)", "value": "6d050595ac9e9c7cb36c2db3f5649ddce801d623", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742046, "uuid": "7312fde4-b597-4303-94e3-438245c296cd", "comment": "Malware payload (AsyncRAT)", "value": "ad7e0d452f518ae7593bc33545cb093c203faa2b8d48e6f3f56eb5ab324f5daad222daea8ed5f546306fddeb28d291a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742046, "uuid": "7a73fec6-b808-4ec0-ad77-19aea4f72f2d", "value": "T10353F8053BE9812AF3BE8F7469F365854AF5F4AB2D12D91D1C8501CF0632B829941BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742046, "uuid": "d81a04bc-ba43-42a3-be3b-d40644bc943e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742046, "uuid": "d06434cd-830a-4b65-aef1-106c8281fe9e", "value": "1536:kmfWSqHdykrVMKuJUYFPbAOz5bGAPYidD23rQTG1x:kmeSqHdykGKuJUYFzAq5bGAQG2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692742046, "uuid": "eba6f7dd-927a-47f6-b7af-9b7c574b044f", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692742046, "uuid": "500cd3f6-13b9-499e-a298-78e7910c6b4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742046, "uuid": "b8e02a1f-fefc-40fa-a52c-db78c902e7b5", "value": "bPe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32c934a-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692690687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690687, "uuid": "ed6de400-edfc-4e5e-915b-8132688e9e22", "comment": "Malware payload (Formbook)", "value": "ed56d4bbf09db46fcc63047843556dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690687, "uuid": "2570edff-5afd-496a-a346-4dbe4b73934e", "comment": "Malware payload (Formbook)", "value": "05463569d730f634de1bb2f9a2cf9f2cb0068862398bb6b151185c4a44ab9228", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690687, "uuid": "0c5b1b00-580d-436b-8204-6e69ddad9d9b", "comment": "Malware payload (Formbook)", "value": "6ac507c9f0b5cdb2239f428b82213fe50c00698b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690687, "uuid": "719e0922-2c9b-4f7a-ac58-de25ccf72f40", "comment": "Malware payload (Formbook)", "value": "c40e2d9bf585e7652849cc5e3b3f78aed13597a3d7fc2cc7018d560e20a16b56a7de84def051c3edcdbe44047345add3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690687, "uuid": "8201cf62-6266-4bcf-aad8-fd0e1a35cb56", "value": "T16E54122692E1D4A7E9D707712EFD0B2BAAF68427445CD30F1B209B5E7C76192830FB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690687, "uuid": "26dca731-1cf2-4997-b939-9dee6878f3fd", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690687, "uuid": "db118b49-fcd2-421a-95ad-566c1cbddc95", "value": "6144:PYa6YoQAXvgQm9XrP+reCSrhmGOTJ52iXZB29NuPTWZ+PNo+t6:PY23AX/m9TDCChmGkr2iXK907W0PNlI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690687, "uuid": "aa3e42f7-5213-4b6e-bab3-f078374f14ab", "value": 298741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690687, "uuid": "82672097-dba7-4eba-9f4e-1bc4fafac1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690687, "uuid": "6edabf72-ae99-4dc7-a19a-ee601c281beb", "value": "USD126,052 HSBC Payment Service_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785f91e2-412d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692737404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737404, "uuid": "703fba6f-b8e5-4c9f-8af5-a5d130f8474b", "comment": "Malware payload (Mirai)", "value": "ff1df5b36dd86e2e800304508bcc8be9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737404, "uuid": "1e98ebc8-9fdc-4dd5-9579-c03c62583801", "comment": "Malware payload (Mirai)", "value": "05c6951b0a1f37bf12383fd1bfbc9fb1812807e722aaf20d07b635560627d149", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737404, "uuid": "e1925cc2-19c8-42e8-b840-77514be16119", "comment": "Malware payload (Mirai)", "value": "23b80f0dbe532ad077121fb43db77fa0ef9aab75", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737404, "uuid": "c4bcb5d0-e357-455b-adc8-816f15aed3c7", "comment": "Malware payload (Mirai)", "value": "2cfd5e2d81bc9e4d6d435a1ab7b46a9bf1b57b36e302bbe4a24aaf106fd8d0dfd584390b50940ccdeb996cbe5f491c67", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737404, "uuid": "8c965536-d03d-4a3b-9987-8e1501bed213", "value": "T165230271890EDEF124303C72DED99793B6E11AB1C627311396280B386F75A131E5BE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737404, "uuid": "49f02759-27ba-4679-a82b-e472124366b8", "value": "768:q/TYCoIxdEk+AxoTZAZHFeq8b3k9q3UELbUXfi6nVMQHI4vcGpvP:qECFd+A6YHAxNLRQZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737404, "uuid": "1e3151bf-5508-47ee-b104-114e9dbc7ebf", "value": 46616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737404, "uuid": "39a78c8a-0b84-42cf-b4c3-9e922887dc49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737404, "uuid": "f9c5219f-06e7-49ee-9cf7-82ca4a49bd6f", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de1c9ad9-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714811, "uuid": "048da6fd-64ff-469c-a47b-322af304081c", "comment": "Malware payload", "value": "1a08cafc575492abf970f9a9ac0f2851", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714811, "uuid": "8afa5a3e-f8c3-4e06-8f17-5a685116fc14", "comment": "Malware payload", "value": "05f59eeb301bbd987399ca25f65e18d227eb2345822299f519c4e53bfe800236", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714811, "uuid": "446ef27d-9b87-4588-9b84-b28087b75c2d", "comment": "Malware payload", "value": "48be5fd882c29db24c0f1a6c46560fe36eb58b5c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714811, "uuid": "5073dde1-e811-4361-a218-a36697a109a0", "comment": "Malware payload", "value": "308d363f6b5235ac594ef685d1e12f01c17876b95c14027dd1cd8f29dc5ce7bd78f02f0c04549ffa61a95639788493dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714811, "uuid": "386eb6d9-f49e-4a88-8062-b6363319135b", "value": "T15C66336A39CE91F1DBC92474410BBADE33F94AA5468449347FC5AC83A952FF4B027C63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714811, "uuid": "a55b8b25-4c12-40fc-b099-02220f2a88be", "value": "b4e326ee1aa5d1359dab5b06388eafa8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714811, "uuid": "faaa36b4-0024-4cd9-b3a3-385b45862271", "value": "196608:jrH2CwsYwGa5eEKbtXr1evtB8R8U4IYQs:jrWCrr5ertcwRSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714811, "uuid": "826fbfc0-571c-4c25-99de-95368d209ca5", "value": 6623744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714811, "uuid": "969cb27b-7d77-4194-9730-642d670bb35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714811, "uuid": "60c833c1-bf22-4731-a160-7b98cb41ab5e", "value": "uszs.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c72821-40e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692706043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706043, "uuid": "2154cbb1-1ef1-49cf-8991-c09edd3d5a66", "comment": "Malware payload", "value": "b1995203d3326fa0a4776187aef9f4ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706043, "uuid": "7c415880-8554-41b1-a9fc-22e14acc5806", "comment": "Malware payload", "value": "07bd5beb8d2042ce158e3debe0e63d1494816827384d31c87361ba8fd24b2d55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706043, "uuid": "7998a4bf-1c98-4887-a8ac-3ba13490178a", "comment": "Malware payload", "value": "66a350c7cc6fe01bb6276e782e0d2ea61f5a431f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706043, "uuid": "1c900b12-0df4-4703-888b-f1a1f9c6e8bf", "comment": "Malware payload", "value": "358b2336807a29a7298a7085d54db2bd19d3d35f48807ef4ca23e2826f5f389f464fccb6cd2f0a48423962fc80b07b7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706043, "uuid": "3da99b28-bfbe-4090-8297-a6d034308c9e", "value": "T1C6B40118D69BBB9ADA7D83F90163400803F1A492F772E9AF6FDD48ED166B7908905313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706043, "uuid": "893bd216-8898-49e0-8fbd-03a110fb4bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706043, "uuid": "5004c765-5787-43d5-9d75-dfab9e2432bf", "value": "12288:I5y5HZ9ZJ8PRGV65kzk8hiM1jmqNvKvbW+aj:55HZ9ZJ8ss5kzrhpzKv3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692706043, "uuid": "cb6c2498-845e-4b48-b363-8f99d07a3d44", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692706043, "uuid": "e4dbc249-2ca6-44b7-b65c-fefc184ed93f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706043, "uuid": "7efa93e8-5be8-4a14-89a2-637734fcd924", "value": "August updated SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edad5d96-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1692683484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683484, "uuid": "1f875d12-abd5-4f28-89e5-09f047e98743", "comment": "Malware payload (MarsStealer)", "value": "c62fc680b998cfffe61bf5aeb5f34d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683484, "uuid": "bd457db8-8e3d-4276-bdee-6c075304af1e", "comment": "Malware payload (MarsStealer)", "value": "0851ca9694add5c2ab4fa61f9c2cb94d563179e8d39d39de6884e0200d8355a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683484, "uuid": "82f041be-2dd5-4d93-8282-1a5ccf352f99", "comment": "Malware payload (MarsStealer)", "value": "aa73c31e8cb1218364effc94ea8b72b5f6f0a0d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683484, "uuid": "5f1d762e-ff8d-477e-9bb6-5bd10e7a28bd", "comment": "Malware payload (MarsStealer)", "value": "9fe8ebb5e8244223c5c0f9eb7cf094d94e348fab332825874a1fd77966a247ab279b6629cf18d95d2eaed74954f52eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683484, "uuid": "f1611110-3426-43f6-981e-614272b90cb8", "value": "T19FC5C405FA5B1AA5CF997DE79157B82F8204AE60DE72DCDCC48E11C1341BCB8091EB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683484, "uuid": "6f787ddb-7c79-4202-bbe6-136762818bf6", "value": "95044a3b7211cd3123c3b40cc373a41f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683484, "uuid": "be56d1a5-279d-4f0b-b435-37c3a81205bd", "value": "24576:RnAn+1BA4d5HD909sV4FRECRzvDEzTK8Q5VA0w:Rnv5B0FFRxvD0G8Q5i0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683484, "uuid": "c2a088b0-6910-4917-a816-8e45deb248de", "value": 2524840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683484, "uuid": "f5efab8b-4fe7-4332-8c30-f158a1307a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683484, "uuid": "2f1a10f2-1ce1-4dc3-bb5d-64ac51b548ea", "value": "Allergy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c24e61-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690611, "uuid": "58863072-7821-4f4f-a335-693ca887a3db", "comment": "Malware payload (AgentTesla)", "value": "c0d867152678c70b2270d6df488ecead", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690611, "uuid": "07faf501-6af9-4264-836b-194025ecc0d6", "comment": "Malware payload (AgentTesla)", "value": "08a840677baaa0b14152850e1e0923aaa819ae8a2ecd7923f9510e1141962f16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690611, "uuid": "bbda17a9-c9d9-4dc4-98fb-a986ef5d0fb3", "comment": "Malware payload (AgentTesla)", "value": "6c7d0acd5933d2edceac81e0f8619139b23e3500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690611, "uuid": "7a9010b9-dbaf-47e4-81ff-35d9960fdf5b", "comment": "Malware payload (AgentTesla)", "value": "c530c7127828bc9a45d3efbcebefd1f7852a45c5c5aded1162fbfffbe8c5245c72efe3107060954185444be1b3417300", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690611, "uuid": "3be075f2-c85b-4bae-b295-15bcdc990c90", "value": "T1F9F446EBB31041DCD8E589F15B2B0CD1013D6BFE5091570829C9A84B8AE67F6317BE9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690611, "uuid": "011f11a8-2874-4b6c-822c-88435e55f20b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690611, "uuid": "e281cc17-ecbf-487d-bd81-8747b48419ba", "value": "12288:8xffDCbcfI2TNUAJy2LIaNe83W7gBgRhxO+01xJ5H0ItESa:8tfDCbcN+AJ6+pW74ga1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690611, "uuid": "5147ae62-dcc8-424c-98b7-f703d2527106", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690611, "uuid": "7de711d0-ee5d-49d0-be76-05abcc699f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690611, "uuid": "dd1eb6b9-bd4f-4b0e-9a22-217282476cfd", "value": "Yeni Sipari\u00c5\u0178_22.08.0234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb7ec55-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689762, "uuid": "f0fd8155-18b0-4a3c-a022-5a2b062a0b83", "comment": "Malware payload", "value": "8dd3e3dab122c407fe22ed7a47e9d053", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689762, "uuid": "637f8457-3820-4d00-8fe3-46cc0c71e5dd", "comment": "Malware payload", "value": "08d5854552ab50e43d7075de03e0474647389e63e985f0c5b9cc1e756d78048a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689762, "uuid": "0351a796-82b4-46ba-a50d-05920a1e99d9", "comment": "Malware payload", "value": "317bcf03237a3a10151a6c6544c0014789eb937a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689762, "uuid": "3ea4a880-8905-4012-ab8b-a4ac0de51503", "comment": "Malware payload", "value": "4bd9f8ae72351c60b02302a23c082ce4cbaeb79de9063d860020432fda8e17ea15b5bc81faa5f0cab177da9ed6c45d5c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689762, "uuid": "cde260f3-e657-4681-a1be-0e5695f8be01", "value": "T17E65F0039810AB97C40D87F87E631ED91F1F7F09E895ADDB14663F873B316A2195A20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689762, "uuid": "a7f91a48-d119-4c3a-824c-b8caec2bd03d", "value": "24576:1rTZykw6VsAXZSTYZyCw6VEAXZSSqro/IRrxbyUATAhKw1x3/RZn:1r1Q6VrE2K6VTExriq9yzT1i1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689762, "uuid": "268f572a-58e8-4982-bbc0-61e39beb8a59", "value": 1418240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689762, "uuid": "68bddde8-e99e-4566-8962-2794ef4967e1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689762, "uuid": "192dd060-6e45-4394-a832-07af6660a7ff", "value": "New Order 48206.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c65bf5d-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693119, "uuid": "45304ebc-28ae-4ebf-b98d-12de7bfc7db7", "comment": "Malware payload", "value": "f6421c527caee004689e2f1cdcb3940e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693119, "uuid": "71485df3-bc11-4e88-940d-408e3e53445a", "comment": "Malware payload", "value": "097288c011d8ccbecb54e4e6f25ab0d23000b23f0199043a40ac8685406b55a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693119, "uuid": "0e20cbea-7271-4332-bd0c-4336960aff20", "comment": "Malware payload", "value": "28ab967d788743de0c09a09c088375de18ae5cbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693119, "uuid": "8f771906-aca5-4cda-9b6c-f3aa3b196726", "comment": "Malware payload", "value": "c1f2699fb442b2426db9943a6b551c71fca1a83abe08d4b475f09dd4479d4021fb7650ddc4a0458370ea5cda334dd730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693119, "uuid": "546ca264-eb3b-456b-b011-c9cf7e93b018", "value": "T185310F95A6D04DBDC8E411BFAE570310B37D9F84E0CB7223820C63A8AC1EE789D26486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693119, "uuid": "8b154bf1-749f-4ccc-8704-ee9c4759f491", "value": "24:uTAJqoKGpa7Urz/jlfuBOXK1hnVev3gRGaJ9iZBBuLlx/j7dQhY9gZgS:uTAJqoKGpa7UrLZqG+JqBuD/j7dQhYcF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693119, "uuid": "aa148a8b-b1c1-4d5f-a425-03a49af5300a", "value": 1496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693119, "uuid": "c10f4d19-a8c7-49ea-b387-08ace7347c0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693119, "uuid": "60d6d2bb-3c4c-481c-92ae-619b4c84d708", "value": "f6421c527caee004689e2f1cdcb3940e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de69e3b-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692683109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683109, "uuid": "14ddb15c-81e9-41e8-be37-7e04f439a0b3", "comment": "Malware payload (RedLineStealer)", "value": "6df85f9ce7a3ef3f4e8385a03f05fd22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683109, "uuid": "435e8db0-596e-4f62-b8c6-ce5566562a56", "comment": "Malware payload (RedLineStealer)", "value": "0a89e325a80cd3ec3b1bdd75df1436bcd5afe256eb260b4d3bb35c0173390a10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683109, "uuid": "617dd4c3-e5f8-4931-ab10-d0033e3bf55b", "comment": "Malware payload (RedLineStealer)", "value": "7983b881fb2781c3a0ad07df892352b1b878a357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683109, "uuid": "d39e4e72-2582-481e-8bca-b274524b01b6", "comment": "Malware payload (RedLineStealer)", "value": "82c23d18c91dd9f028e4be515d56dceabe049d157316a5fac184fe4e6a87ea78dc1f4ebfff7fba768b552d560b65cf8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683109, "uuid": "570d979a-8495-41da-98af-4cc8fa58c583", "value": "T19344BE12A7D5D432F62389318EA9C3B05B2FB8716FA6A6DB2744463F4E713E1CA75301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683109, "uuid": "b978cfd2-da3d-4a48-9888-70990a5c7300", "value": "e2432ef21843616ddefcfdd02654b31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683109, "uuid": "a54c5ef2-229e-423e-8727-8be8e4fd1e24", "value": "3072:Oq/QIhdfqImReb/yOcF/Cfr0hgZRmYmI1wIXp02D31XTnKJHZCljHATyjMdC:L/DfWwbKOcFqz0hg6x0fRKt0pEaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683109, "uuid": "6a49f8ac-8d73-4a6c-87c7-f733e24f6b51", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683109, "uuid": "2d2cb518-8d32-4fec-abce-3bece73593ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683109, "uuid": "d46148a4-2c3f-441d-a8e7-4062d223378a", "value": "6df85f9ce7a3ef3f4e8385a03f05fd22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f8cbd78-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693178, "uuid": "44e3559d-9ccc-42fd-ba34-0893225a398a", "comment": "Malware payload", "value": "917c1e5e87c4da15d0cc737855b1f6c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693178, "uuid": "1049d65a-8912-470a-bfc3-3653cdffc959", "comment": "Malware payload", "value": "0aeb346d435b6d7bf9f6b33dd77c514421d9429e7cdd38cdb9b2a85cf2e7d0ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693178, "uuid": "18665a24-a114-4fd5-8155-7444acf69367", "comment": "Malware payload", "value": "ad3bcef3d995624e4efb4875cd352caf6015c443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693178, "uuid": "7f51d846-2ea8-41b8-a39e-53449f0c7e84", "comment": "Malware payload", "value": "e0135326d804d8e0c0606550781ff80ba2a29d873bdd519b507304d36706fec709b5714304592d31326c72c8ca9f2657", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693178, "uuid": "e4c869c2-fa38-4b5a-8336-4dc1ce8bacd7", "value": "T1F3438688FE69922EC7E172FBF70803CE373E1BD8B3D9B1265D35065173C8A64656A124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693178, "uuid": "bd945974-8713-460c-b986-89ec9aa27f2b", "value": "1536:x9HOigI6iKNVQ2Nf1djgbUqlzVkWoL/fN4YV8w+:jOiC31djgAqlunN4YV/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693178, "uuid": "6767fd24-4925-49b4-b2a0-d0504ee3371a", "value": 60248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693178, "uuid": "034ca21d-2113-4331-87a7-397bf8fc7d9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693178, "uuid": "712129c6-078f-49d3-828e-bfa78437c611", "value": "917c1e5e87c4da15d0cc737855b1f6c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bd8986-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693131, "uuid": "61187efb-dd4a-4e3f-9b6f-ea4d9b44aa4e", "comment": "Malware payload", "value": "10732d0b20e2f8230fda008b58291c7f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693131, "uuid": "f37c4a22-2545-45bc-a1a7-06acc45b4b50", "comment": "Malware payload", "value": "0b271cabbad463ea02d24c3230ab4abee69315470151afd72be7f9c8b9f1a629", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693131, "uuid": "32371f78-6b89-4ec6-a4c5-cb7ba2de5c32", "comment": "Malware payload", "value": "56ed63deff106c8df412399c656b85ad499da33c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693131, "uuid": "b7f51c36-a9fa-4df8-8bc9-b787feecee12", "comment": "Malware payload", "value": "b1e2e25f657c184aeb37132cbb44d6c09d018ba108fb1841cc461bd0bb4561a6837d1f212c242d8d1349e616690cb18a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693131, "uuid": "18bf6b5f-64c0-4c52-8db6-a0b24154222e", "value": "T187219B9AA7E36D27CC550237DCAB6710E322BF84869FF513E75112160C6E21A1F22089", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693131, "uuid": "37996aa1-5117-41fd-a95e-e2e900ac7903", "value": "24:JJJ/0gP9qD0at6EoKGuBrUlFSy48zLCkIddx2H0QIs7dzhVNfC:JJJVFqDPttrkFSy48zLVIs7dzhVN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693131, "uuid": "0f9046f4-30eb-48e2-a1b8-9d2f753e1564", "value": 1164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693131, "uuid": "9f9d356c-c4ee-4ea3-b159-0ef15e3f34b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693131, "uuid": "eec718c2-45d9-4dc8-9de6-cea92375041b", "value": "10732d0b20e2f8230fda008b58291c7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49717b9-40bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690233, "uuid": "b9d8261b-dcb3-4941-a52b-177263e91ff6", "comment": "Malware payload", "value": "bf16483c7239de986dc28079acbc1863", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690233, "uuid": "e83a735d-240e-4fc7-9ea7-7f0d2133a408", "comment": "Malware payload", "value": "0b4b19bbda4afb4995873b9df1d19c9d3fb377f412308a93273a30f156fc71af", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690233, "uuid": "74ba86dd-8d1d-403a-babb-a076abc07134", "comment": "Malware payload", "value": "3fe458f596d06a039d841fd7cea64c54203927b8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690233, "uuid": "13ed0b14-2819-47ad-9927-8570d2ed9754", "comment": "Malware payload", "value": "959abc154eb301559ce232c3f8a3c61ec628c642192586b6ce8cd95a1b00b8cc863500c145c66fd20ecdf508bfa05bfb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690233, "uuid": "55627ecb-b722-4b3f-be09-1beeb5483c65", "value": "T124B1BF7FC9FAAEE30B5BB1C4000D3776105F430FB395439EF9C81A6A62309698979169", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690233, "uuid": "8c027b52-fff4-4870-a784-8e67113967eb", "value": "96:gBqhU6Yp4bX3sE3Wd1xJq6fuNYeYqYMMZi3YPoBQ:gBqvy4bX3sE3Wd1xJq6fuNdVP3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690233, "uuid": "8665ff4a-ac25-4796-a89d-53877024a249", "value": 5290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690233, "uuid": "78a0add1-1764-4b8d-bfdc-a9a54899c7d2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690233, "uuid": "b7c911dd-d47c-4eef-8a31-5cac0666ad76", "value": "purchase_order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374011f8-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690479, "uuid": "09e3a9e5-fcf3-4a1e-b950-9f0ca6da1174", "comment": "Malware payload", "value": "c35a31ffac0fdaad53c76ee67b5d943d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690479, "uuid": "5ac092df-b0d0-447c-88a9-a74d52710111", "comment": "Malware payload", "value": "0e069d1c1b135d8a521b2a425e2ae19072da592cf6919e913cb107c666eeb71b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690479, "uuid": "ee9f3a22-02fa-49a9-8c54-0234d1fd6a05", "comment": "Malware payload", "value": "559f8cb19c576a3ca103bd073030405c551a2b96", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690479, "uuid": "94addfaf-935b-40dd-86ce-24a270341565", "comment": "Malware payload", "value": "2f37085c8023682e4b56c0899f7a57b097721ee55be7f1394351a97646250b2a4e634f38ad8dbd127c42881f1f980849", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690479, "uuid": "86037178-aecf-487f-8885-e570982bf217", "value": "T1E8E42322C92196A15B1B917710B81EF0CB204F94528C1583A9B7F3F79B98CB8B5F7F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690479, "uuid": "d115bfb5-b852-4740-bd36-62050a96c9e1", "value": "12288:3UX0z+8zhYC1Bxdm4ONtcN+fhDrM3NSIyoZd59QuuPi8us0ajyi/n:J+8zxZtouUf23NSIRLGNPixs9jPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690479, "uuid": "46456f3d-fcb2-4a47-88c6-89a2e7cac987", "value": 710285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690479, "uuid": "d7f8eac4-2c3a-4595-8bf7-c3632dc8ac30", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690479, "uuid": "8c32cb38-732a-45a9-8e31-4dc15cd2c5d8", "value": "BOQ MXN9900.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ec197d-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692728942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728942, "uuid": "06e06c5e-e4b6-4a13-8b76-2a4985f5f61b", "comment": "Malware payload", "value": "edbb6e9dfe384da264bff4a3d5641fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728942, "uuid": "0caaed88-3e13-425f-932a-8dbce8b0f79c", "comment": "Malware payload", "value": "0f14c6121e3b605f7885958bcd39b9fd0852930ddf00406a68c041a999c7c4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728942, "uuid": "dbfb9fce-7259-464f-8b24-bf64b735b127", "comment": "Malware payload", "value": "8a331e256d9b2d849f4886c8f8ba5b75a3dcec96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728942, "uuid": "ec0bcf37-d644-4c8a-aa1e-7e224d0979f7", "comment": "Malware payload", "value": "8a3da6b98f577608dfe48868ee20ed21b796efb2c4c2348aa680e0edec70d76a9adb7182c4e2e39bd9fd2a76ecab9a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728942, "uuid": "78f27e46-1ddb-48da-957a-b1f1ebd457b0", "value": "T10FD1D823A3DC9336D97F07379C77A3C1177AF780A896CB1E6C88110F9DA271549A2E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728942, "uuid": "dbbad4df-8bde-4dd1-8dbb-96c48b95bb0b", "value": "96:rpELCuOLYBF2saaeAZ0kC4zm7dYkfqlBxzNt:rpEWWF1aYZpCgm7dYkfUBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728942, "uuid": "c9c38950-f99a-4111-99c4-ebe633474759", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728942, "uuid": "267bc407-1cba-4628-902d-3dd39e0fb1da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728942, "uuid": "20ca2de6-b4df-4848-96d5-1b570868beb6", "value": "SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.24681.16604", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7f7b88-4100-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692718162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718162, "uuid": "e440244b-2faf-4070-aaea-81f78c0068c3", "comment": "Malware payload", "value": "744d7e10e74617636ccba77d1eab22dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718162, "uuid": "c439ded0-afea-4d07-9f17-31fef3aa0953", "comment": "Malware payload", "value": "10777dc56ebaaec36933c08b94e99719ae447d6b8ec300b42773aa74d467de06", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718162, "uuid": "6be49cf5-d320-4324-aa2b-9f25f36afe06", "comment": "Malware payload", "value": "110fb3617edff36759d8cf036f250697767f3eed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718162, "uuid": "7f122dda-f399-48c3-828e-4448323f6cab", "comment": "Malware payload", "value": "a740315ba0b3b060875de31ee336fa5fddcc47c8eabfbaba888f1e32f65bc4923c282594b813e59b478f2b5baf78d261", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718162, "uuid": "e4366861-0332-4a68-a1ed-b66003d78696", "value": "T188236B057252C0B3E6CA063869B98661077F7D939AF0945B3FED020D8EB16C07B2D3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718162, "uuid": "90f26604-461d-46c7-90af-ceea35750f6a", "value": "07ed6970d80772ff905788fa3e1463f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718162, "uuid": "103a5273-b4c3-4961-b4d2-acfece28c084", "value": "768:XhTxc0Je3ufiM9T6pf+zU4bY50EcQISWYNKGIPsQyddj5z+gxw:XhTxTyIkf3ISjIPQf5z+gi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692718162, "uuid": "1a36d60e-be4d-4096-a031-64e543221c85", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692718162, "uuid": "c0129988-37e2-46c7-ad71-17764584b624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718162, "uuid": "fc951322-7e77-4f7d-a0e6-af88e6c81a96", "value": "SecuriteInfo.com.Trojan.Loader.1705.24190.1041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7023f52a-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693152, "uuid": "8a82a144-192b-4cf0-b252-e4737146d833", "comment": "Malware payload", "value": "9ed2e403000c6c397b3e848ed5a1ca94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693152, "uuid": "e4996cf9-0fc4-4ca4-bb7f-8c538cafb5df", "comment": "Malware payload", "value": "10cf3f4cf51f3d5e8f6bd6fa82108ec0aea46d80908b95074e8a556b8ee4b9ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693152, "uuid": "74033c11-07f1-46e4-97af-3f440bbf4a25", "comment": "Malware payload", "value": "79aa399f6edef079b25eb9432170858aab03ef93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693152, "uuid": "93974f0a-9a0f-41df-9cc1-63810430d1f8", "comment": "Malware payload", "value": "b1e32cc88e8b955e545d49a662dcae9d8b43198b38b17b25187ec8fba973abfd1736fdd3ca2db000f64973930ba67ea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693152, "uuid": "0309b46a-8031-45ce-880f-ddc48de4ffa9", "value": "T13521EDAAA7D36D27CC440233CCDF5720F362EE84869EF513E32212250C3F20A1F2218A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693152, "uuid": "19557fcd-7e01-4c12-9562-f8748c7e527b", "value": "24:JYolMlgP9qD0at6EoKGuBrUlFSy48zLCkIddgHiGIMpd9Nfc7:JYolMOFqDPttrkFSy48zLTiGIMpd9Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693152, "uuid": "8bf73a84-c35a-427c-ba11-0324494171c6", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693152, "uuid": "4c7ec0da-08c6-4a8e-a3cf-87db5475227c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693152, "uuid": "b6cefd69-a577-430b-bd98-d3af90d567d5", "value": "9ed2e403000c6c397b3e848ed5a1ca94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a838654-412c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692736817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692736817, "uuid": "a27502c1-33d0-4e3e-ba32-786e13ea4d0d", "comment": "Malware payload (DCRat)", "value": "2003435de53520ea7af35d67eccf05e4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692736817, "uuid": "8cb56d0c-1f4d-4e87-a22d-a26cbc624fb3", "comment": "Malware payload (DCRat)", "value": "11f5bc34360a728e2d71e3387947a398546732f4b3b748e5cd7e883f57d855a5", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692736817, "uuid": "96bb8d2a-cc7b-418b-8621-54ea248dc5b9", "comment": "Malware payload (DCRat)", "value": "09c0d12d91a224b5fc8304957111ed95f75e13fa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692736817, "uuid": "cdaf9f56-e4c6-49e5-8af5-ea271321c266", "comment": "Malware payload (DCRat)", "value": "3b317f440e9a4e25a3a3ee7d067a22af328a637f1969dfd74116cc6fe4a340b9d2b73370bdbd74460bfcd9eb60009472", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692736817, "uuid": "d6026968-a29d-4f03-8e2a-3b2bbb503235", "value": "T15B56336D22C318A4DF3BC5355E152B21F7D22139EE243798B96720AE683F175BC939C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692736817, "uuid": "5506dca6-3dee-43ee-b480-21db67a6f3bd", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692736817, "uuid": "4232cb11-b4c0-4e83-a509-002c8688cb5d", "value": "98304:EmYLrrMkTKSa+OrmElnpp6UmBOrS61ngCiuN+s:EZLkgKS2CEZ6T0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692736817, "uuid": "22539540-2906-477c-8d83-4ea75153b4e0", "value": 5910528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692736817, "uuid": "66287ed2-572e-409c-82c0-889c5a3e408c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692736817, "uuid": "7235f29e-67d9-4f33-93c8-b6b2dff1cf8d", "value": "2003435de53520ea7af35d67eccf05e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85a52979-411a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692729266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692729266, "uuid": "5dfebd95-6ec2-485d-9819-56d5cf0e1af5", "comment": "Malware payload", "value": "549b22eeb538376e7b2c63f30f137075", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692729266, "uuid": "6d2c3d8d-cf4c-4f2e-a3c1-45847a06aa55", "comment": "Malware payload", "value": "12334a40680a030287e4cea05814bd6ab05e3b2f2a62aec82fc6361cc829c702", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692729266, "uuid": "5acf7ed2-e7a3-4c06-8149-f1878aaf39e0", "comment": "Malware payload", "value": "9aaef66898d85b521529e3894ddf36cf09956534", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692729266, "uuid": "124256cb-91bd-4d90-bab2-57ced81d9cdd", "comment": "Malware payload", "value": "b37bfdc6f081c9abb6a44bbd99d19aef6e76a667b2792d36374efb1cf57e98662d6e767cd7fbe015f0348a5a2eeb45ae", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "DoNot", "colour": "#144538", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692729266, "uuid": "a8d212c6-f150-4a31-a846-4c3676801f8c", "value": "T14B93F1F9EA76C589CA75ED34309B7B3BAFAAC10BED6B14433A85D8311D5210F050E268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692729266, "uuid": "7b77c7c1-c7ff-4f33-88fa-e25f786eee07", "value": "1536:ShmtdtKPA0eNmWq5vYm8y69aUMBjyTxFBKozOPndxOxDJBoPJv130SE3F:SEjJ0eO5b8ynUMBudFBsjOXBoPJv130F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692729266, "uuid": "2367e216-1391-4a80-9543-694790d0f82e", "value": 90234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692729266, "uuid": "d4061fe6-deb7-44f1-a6fe-e1ce3b84b9c0", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692729266, "uuid": "f4817da9-4274-4d61-b278-d029fece48b2", "value": "UAV.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ba7f47-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715873, "uuid": "1663a162-0452-4b23-805a-735994139ba3", "comment": "Malware payload", "value": "98609373390936c6bafa41a5ae8607d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715873, "uuid": "093f6d74-13a1-4fe2-8da7-bda5d178f9d1", "comment": "Malware payload", "value": "12399c230f71bc6374bfc5ed7db16660bd1487d912983d67deadd91f4ec028d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715873, "uuid": "f61319fb-4e62-4207-9d03-8ba464bb8cd3", "comment": "Malware payload", "value": "36898ddfdeaba752134e7cbc9a64e4b71658a534", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715873, "uuid": "c9a2884c-8f85-4cb7-91a5-e2e8c5662413", "comment": "Malware payload", "value": "39d522c67cc2f9fe06f87825fbef2df39dded211349de1e4d9f4237be049f722082de8bd5bdcddd0fa9d6958574401d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715873, "uuid": "c09e2122-c82a-4093-bf69-67fbc74f9e07", "value": "T116D4F04037BC2A47E5BAD6F955BC525047B67A2A6124E3DD1DC630CA2AF2F404BA1F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715873, "uuid": "bc763638-c789-4e21-a0b7-5069e5030512", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715873, "uuid": "51e3608c-16d9-4240-974d-048f465f474f", "value": "12288:3NmHFFDt7qLz1ehMIh+guYgdw8no6sniaVx9N43UY9SJC2qP:9mXxU1ehMIh+g2meo68iaH9NEz9gCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715873, "uuid": "eb07269c-0b01-4bd8-bd75-8c89007a82d2", "value": 653312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715873, "uuid": "e0fba57e-9cd7-40c2-80b8-1d2016e64594", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715873, "uuid": "1c7e5f7f-80e4-4c1f-b60f-b93961a688ee", "value": "rffA4q7W845OLroa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bc5593-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693166, "uuid": "4a8200af-40e5-45d0-b35d-1e52eb154021", "comment": "Malware payload", "value": "4731393b4ff956c905c11ec27bf96bd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693166, "uuid": "2d675af4-08ee-4f25-9dd7-f59093729ce1", "comment": "Malware payload", "value": "14cf5dcb6d514b373bd9fd2b8ceba9380890ae0651ec13dee02df2e90a0b20ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693166, "uuid": "1a9f00ee-3e7a-4fc9-85e8-daa1db32fe4f", "comment": "Malware payload", "value": "a5155c2fd67e9caa8874b103a6a224a9d4f3d22c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693166, "uuid": "18aed28d-a041-4be5-80ab-3187d7b2cc52", "comment": "Malware payload", "value": "2db18e1455087d0bd21173ea2c05ec6a30258aa24502c5cb6271225fa95ec7a4b303789510f4d866daaba962c3cb2710", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693166, "uuid": "42990440-09a4-4ef8-a89d-9408225c344e", "value": "T1C7217247A1C15DA4CF28EB3C4AB116503B01D938C84FE3CE0E0C57B6292F3CCA694094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693166, "uuid": "36308fe1-f926-4223-9802-ea495d0f25aa", "value": "24:wCVm4llns9wdGtSnUpzzbBWpzmIiKLnB5gDrmCMvGgkC7m17wdmNfu:wal/sOdxnUpzzbBWpzmIiwgDrmCMvGgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693166, "uuid": "ea3ca150-c6b1-4ede-b805-366ee88190e0", "value": 1192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693166, "uuid": "16d4f0e8-4b7d-4fd1-ba28-c8f66820d97f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693166, "uuid": "ae8549bc-040d-401a-af99-a75905051c84", "value": "4731393b4ff956c905c11ec27bf96bd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de6f944-40e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692707322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692707322, "uuid": "5669d522-abbb-4233-b86e-623e04859bb0", "comment": "Malware payload (AgentTesla)", "value": "5c01dad215475198a7166e4f2dcea3af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692707322, "uuid": "a0967b87-b637-43cb-9579-24189de05361", "comment": "Malware payload (AgentTesla)", "value": "16d662bcb526f0bc319671cb02488c7d37a70925d73a04d79c25e3ce0abb5253", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692707322, "uuid": "516fb520-8b3e-4c49-bc77-4094b7d33b38", "comment": "Malware payload (AgentTesla)", "value": "9a12a7ee13d038fdbaafd42cf734fd1e57c150b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692707322, "uuid": "f69c6b0b-65b3-4e17-9478-484c2b5108d0", "comment": "Malware payload (AgentTesla)", "value": "68b07f2af3d831ca0ced8af8d9443f556bd69200793eea803099430df0b1243ebdfe0002ffb2848dd1916388e2b9cd7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692707322, "uuid": "1dadd516-aa11-48ac-be20-c8827c54a098", "value": "T1A3F4DF10A6BB4B85C97F93F53F21160C07BEA95A13FFD2207EC5A0DA5561B804A5AF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692707322, "uuid": "07d92910-b71a-4381-be72-aca2fb5f7ff5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692707322, "uuid": "3d145232-7611-46f3-a725-350964f61485", "value": "12288:M5FgaEww2d1mbTDpA+JoS+mVD3nHBnUwiCObHxufRqEVrlqf7+OjTFN4XvkZg0dD:jaEw0iRZmVzHBOFuf9BZK5Wc60vDEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692707322, "uuid": "3b348c8e-7057-4260-84eb-45c4c8de3c31", "value": 778752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692707322, "uuid": "5fbb0d86-0b37-4d20-aeb1-06a7b012be34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692707322, "uuid": "09158e4f-35f9-41d4-a4a2-b2cda68a2f5f", "value": "PO5690-00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc9fd59-4094-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692671757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671757, "uuid": "ebc36cc7-37ec-41df-8b95-37d592c8dbed", "comment": "Malware payload (AgentTesla)", "value": "01e5965d1f24319ee4e7a9047f234f6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671757, "uuid": "f2dd38b3-bb0c-4ab3-93bf-9672e0a18813", "comment": "Malware payload (AgentTesla)", "value": "1870568f702f6dace356e56e859fa30674e6388dfdfd76c056e446f12d356128", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671757, "uuid": "4b7183e0-11ba-41bc-a74e-e4e7e05c5e74", "comment": "Malware payload (AgentTesla)", "value": "1c0f59bdeb5c340d6763f3d5e0a041386949817d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671757, "uuid": "07bc760d-2a17-4ae7-9f5e-9ca19c089112", "comment": "Malware payload (AgentTesla)", "value": "4e24852e422930bb2babe614b69eca626c0c07e2c891982d80733af2b112de8fa67566e9ec9fb3ddc9b1c752a90a6f08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671757, "uuid": "0619a132-b7ed-4e39-a47e-abdff54211ad", "value": "T1E6058BC1E27ADBD7D47A57F5245106000F767FCAB569E2944EA230DA35F4B402A83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671757, "uuid": "cd0699a6-e42d-4f24-a7a7-9ee9b6e773dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671757, "uuid": "d263bb08-a162-45a3-8632-557099ca222b", "value": "12288:iTD+2d1mbTdaAeSE5PrF32NxKjTghe8inGZE/vzoH4l70N4:iTmdkByJhBCnzoH4loN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692671757, "uuid": "bb1a0962-3f63-46e3-8d9b-7782788268d7", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692671757, "uuid": "523267e1-354a-4dd1-a609-4d896e85c968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671757, "uuid": "8b9533d3-c173-4710-96b3-2e39035c7030", "value": "SecuriteInfo.com.Win32.PWSX-gen.30139.3556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea71a81-4094-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692671755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671755, "uuid": "35003359-6cc6-4e7d-9d39-fd18c286c0df", "comment": "Malware payload (AgentTesla)", "value": "d8d53148c42f7202183a3c6620151544", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671755, "uuid": "15c906b8-43f0-404d-805a-107a7a532b21", "comment": "Malware payload (AgentTesla)", "value": "18882d60079bbd389595e9b68042d1dae0074c21d90d90459cdf16aeac81b492", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671755, "uuid": "dee43a08-c709-462f-81e5-6bbd1d55f9bf", "comment": "Malware payload (AgentTesla)", "value": "f282af3f6a7475c4acb393148a836e4f79e41f67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692671755, "uuid": "2d9f01e6-56e2-40de-8f04-6822bffbc7a4", "comment": "Malware payload (AgentTesla)", "value": "97e3a0f75d4dcec2bfbdadee885dc0d9191e0990fcb5ace2513db33f9f278ae518af91604109355caf24ce26d67d4bec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671755, "uuid": "8e4f9acb-f1e1-4df1-8013-99a41e592c9d", "value": "T11AE10915638CC377D5760B37A973B34113BAF3059896CF2FA8C8203AAE6331097A2765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671755, "uuid": "0ef35234-9112-4709-9cfe-06c6d5ac5654", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671755, "uuid": "3f3e3260-9c8c-44e3-803d-e49f68566801", "value": "96:MtJfWgiA2C/pTDctlawDZOvlUdst4J2uaCHzNt:MDf6A2C/pTAqwVO9Uytuae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692671755, "uuid": "347c2f6b-d90c-4cbe-a3a5-8fdaef5f1940", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692671755, "uuid": "f0669432-b6ca-4c98-bbce-4d4d525f074c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692671755, "uuid": "8a765397-ff25-43dd-8800-7a0538286f4e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.32217.32213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1fdd85-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692690674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690674, "uuid": "6a652bef-7386-432b-881a-9f1573ee2a0b", "comment": "Malware payload (STRRAT)", "value": "f4cbcb943615d6a06fa98fbd85391ec6", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690674, "uuid": "6a4cf53d-702a-42de-9de6-c97c90eb2659", "comment": "Malware payload (STRRAT)", "value": "1a00e2edebb19f088ef0ea74996298f12fd7897115e1ca6b479b43f53b0cd91e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690674, "uuid": "0d1e78d0-1a32-4dd9-9eef-ff1ee3e828ec", "comment": "Malware payload (STRRAT)", "value": "145a4c635cb8496d0120df91bf964140dd280df8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690674, "uuid": "922e3f6e-fd1d-4c0e-a5c8-2f06758855bc", "comment": "Malware payload (STRRAT)", "value": "46143a7cee0665b52c64648822a379c1e601ccc7e6fd827b8f4d2e15f0a53bfedbbee015783f6a1048ceec76a8da0bd7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690674, "uuid": "f0c00827-66c5-4cdd-83e7-ff18fbff7d40", "value": "T12D63F1022FEF9C7DD07BD536604A96011948D1CCAF4AE1538C9D4CD68B29CEA6B0AC8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690674, "uuid": "3b54fef4-bc7d-4dde-9748-41af50c8eaf5", "value": "1536:Ex2GXHS/Bjqt0+M4LYK/TRJ8pEekYsOu+fMLi7ZVDDej3E3YNcef:ExVAB2Y4MQlJ8pplsOGi73ejMGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690674, "uuid": "cbdf6193-c6dc-43d7-a650-cc12caa2d2d5", "value": 69660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690674, "uuid": "3e55934f-a3f5-4278-9a6b-8c2874d4c898", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690674, "uuid": "562421d8-78b1-4f62-946b-4fa26aebab6e", "value": "T T Copy.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b187bf1b-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692690685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690685, "uuid": "5063384d-f42c-4c16-a69a-18a318d040ad", "comment": "Malware payload (Formbook)", "value": "222c56f40262a08ebd568c5dc5f534b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690685, "uuid": "08a505af-15d0-45ee-b867-a31dd2937d82", "comment": "Malware payload (Formbook)", "value": "1af55c95620f18d4ad92ff28e83dd14ce1daaa77b7709beaa4cfe8652bde6f36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690685, "uuid": "8526978d-83c0-4873-a5b8-1cfecb516dd7", "comment": "Malware payload (Formbook)", "value": "82fecd0e349c15094f2c7c04851e537b5abd6dec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690685, "uuid": "88a58f11-4f17-47b9-9cf0-4d5091dd8513", "comment": "Malware payload (Formbook)", "value": "4f4ac95aadeb7f52173fb3cedf28baae216b008c7a27e392cd0039b86f9fcbb4522aa5787e11a3f56bd36487f8c37412", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690685, "uuid": "f703eb6e-b5da-44fd-bf0a-37364a846e09", "value": "T18254139826F5C03BD8631A321C65C2AD7FB59A72583CD70D8B508BB679921C3CB0E75E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690685, "uuid": "964a4cdc-de33-4b73-b013-41c7825e8624", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690685, "uuid": "f05a9f1d-24cc-435b-a5b4-db4d035e5d9d", "value": "6144:vYa6p9aTDk5HCb7eLrNnlPmkQtimkQrmfheb7zmOixpD6w6ADfnlkL:vYT9x5ibWRnVpQtim/ifMb7zy3DPDfn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690685, "uuid": "7e9221a4-1076-4042-bcfc-7377a399d268", "value": 298795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690685, "uuid": "95df04fa-4c09-40d8-998a-eeb2b3584212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690685, "uuid": "0f52d126-0ede-49a4-b4f7-62bcff6c0706", "value": "USD120,052 HSBC Payment Service_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3283cfc-4141-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692746119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746119, "uuid": "d64dda3a-cd36-418f-831b-85c316345037", "comment": "Malware payload (RedLineStealer)", "value": "2be299295a33d8a9bce937805000427c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746119, "uuid": "62d50e28-b80d-4682-8a11-d8f2db0115a6", "comment": "Malware payload (RedLineStealer)", "value": "1b005ca538b2c57e47b156ae6e9b4fab58ea1eb02b3feeef2da6d08b74775330", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746119, "uuid": "4bebc906-3157-4a65-a6ac-aa636ebf2e38", "comment": "Malware payload (RedLineStealer)", "value": "e336ed92503139991cad3752651ceb4cf70862dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746119, "uuid": "1657a3eb-8b1f-45ad-bc15-ec4f635e6d4d", "comment": "Malware payload (RedLineStealer)", "value": "fe3f38bfc0e24d4dbbe8efd00e05df303b5cb1a1e2a77a4ca254cc245851cb62364103b67bbdde354317a807015b0f6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746119, "uuid": "e67e8419-bf77-4f3d-8c65-5f5d65fec6ab", "value": "T1BC84E4782784AA9ECBBF8874D5604C549770AC731212A637847274E4ED3AFFD9E131E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746119, "uuid": "f57ee48f-5094-4b8f-8110-19a149538fc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746119, "uuid": "72d3bb38-2b9a-4ced-88bc-ec3dfbf07014", "value": "1536:zAfH2WnFne36sv0W7TJTc4PQrHS1zy8Ce9L7IyhHvGv5uExNAzYQrDbuCQLEVdhR:0j94t71Opm3IyhHvrExNhy7mOdhqFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692746119, "uuid": "0be03606-406a-49a2-9a2b-787674a2048e", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692746119, "uuid": "008d71a7-864b-4d14-b344-779494c01226", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746119, "uuid": "ac00422e-c4c6-4aed-8623-da0df24228f2", "value": "2be299295a33d8a9bce937805000427c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e176f116-40ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PovertyStealer)", "timestamp": 1692710951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710951, "uuid": "578db75c-6190-4a9a-88aa-7f15efee30cd", "comment": "Malware payload (PovertyStealer)", "value": "5db85d975cd395bcd3301d63adba461e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710951, "uuid": "03f17f04-ee3c-44c0-b276-d8e51f55a10d", "comment": "Malware payload (PovertyStealer)", "value": "1c06a90840409f4635e8f9d959f482ed40379571595e2546926429f974998d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710951, "uuid": "fc7a0888-1eb8-491b-854a-4f793639bf94", "comment": "Malware payload (PovertyStealer)", "value": "e6bd002256358467cb9220317157d3902c408894", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710951, "uuid": "d82659e6-a39e-490c-8b25-df1452940b64", "comment": "Malware payload (PovertyStealer)", "value": "49184e5194c57819d48d88c0b96497fb46957a2dee66e399090f2685a082ad142dcb542aef9c745bd206e9569a5fd1cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PovertyStealer", "colour": "#D911E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710951, "uuid": "c8a25381-069e-4db6-a1f6-407465b54708", "value": "T14B162850F99F14F1E907547018A7A27F67302E098B38CBD7D5447F6AF837AE60A32929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710951, "uuid": "62c33732-9bba-4207-9ae2-8cd9c09a0a39", "value": "6475411a5936d3a669471965a3aab834", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710951, "uuid": "fba203f0-3619-4ed0-8d33-a0d6f20b765a", "value": "49152:R5BBQL/doIn0YVBG7RTbRUyJqm0GROldHv01xUUIyHVBu8MHUaFRfhicatpy:LXodoIn0r7RXRUy46adflica/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692710951, "uuid": "e8f82466-e3b0-4a8a-895c-82901904b185", "value": 4067328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692710951, "uuid": "0f576840-23a4-461d-a57a-568fb4fe3fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710951, "uuid": "7b3b2f62-7066-4b20-b39f-7757e6bc4be1", "value": "SecuriteInfo.com.Trojan-Spy.Win32.Stealer.etij.7517.29876", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88008192-40e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692708224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708224, "uuid": "6bbf13fc-08a2-4118-97ae-47e74e1324bd", "comment": "Malware payload", "value": "535a56f01fbe16a3b0cff4a5026e481d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708224, "uuid": "4e276204-2f83-475f-a494-5a7dc34e90de", "comment": "Malware payload", "value": "1cab0e8d2c1a8665bf293b4046663ab9fda7158883b19087e7c4fa56fd01acf3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708224, "uuid": "9b67b92e-7991-4314-a3f5-74e95ffcb064", "comment": "Malware payload", "value": "09eefbb91187a5c4c71bdcb24764e9e07d621027", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708224, "uuid": "cf21cb2a-f57f-421f-a668-1e09914ff848", "comment": "Malware payload", "value": "8d487f4b8cd6524f2156b4ddf7257b1aa175570e68fcc4d982727eb89ba9e79e67e4278da0757688e8a27ef19bcd9ce2", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708224, "uuid": "ed701056-43bf-426a-9e5d-bab614fcb078", "value": "T1B945014BB395C747E87DC2B986A6B6A15617BD108FE6475BF41C332C64733E08F82988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708224, "uuid": "d8948105-a627-4b91-8586-90c13fc26142", "value": "24576:paULsALkhIyBQQtmk3KeJUpx6Ew9OFQ/ZDkvoyOfr:MkByBQQtmAKeJUpAEw96Q/ZQhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692708224, "uuid": "19339130-7f3a-4396-a9b5-da89cf74a7fc", "value": 1269055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692708224, "uuid": "86a20705-cb29-4659-b46d-674654a479e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708224, "uuid": "b5386b97-b84b-406e-91a8-adc9fec1d624", "value": "craxs.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96fcd1d-4107-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692721219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721219, "uuid": "3270ae02-5850-466a-a42b-131415940793", "comment": "Malware payload (RedLineStealer)", "value": "9941fd71b8e698ed5994e0c84bf3b393", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721219, "uuid": "95fcb0be-82f3-46af-80d5-e4cd4162bd17", "comment": "Malware payload (RedLineStealer)", "value": "1d59250f90f7146e8181c11f7a731e381d22a07675aafeec48c46b7b0ae937df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721219, "uuid": "dd263ebf-7edc-4ed9-839b-249ddc60f6b3", "comment": "Malware payload (RedLineStealer)", "value": "4b38a6acbeb8dd42c3dab1f8148a8ad2ec9619b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721219, "uuid": "3102c1c8-e192-4ab0-ac46-a02af74754f3", "comment": "Malware payload (RedLineStealer)", "value": "fd159f0d03e6cc864e8f23491f16ffc06cc95f0d9ab743d7da81fd28a430ab150c28dc0415045af099f7c36d22449b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721219, "uuid": "e9874a00-8cb3-490b-906a-8e25d11c56bf", "value": "T104946B415EFE44AAFB0A4F7C9214FC89C674DDBC835DD95F2A5149FB3AC6705AA32020", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721219, "uuid": "6cce8798-721a-44ab-bd92-9e8a260b068d", "value": "205b5a26282a28fd3b95bae3e604cb79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721219, "uuid": "c8ea651f-71cc-4c53-9f46-69d083ed35ea", "value": "6144:YNBwS31Fu1bc8STMJLhnIkxoUPEtv46x+EcwC5D2zocv3BHunibP7Qi1Ar6/j4:YNBw21N2pe3BC5DS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692721219, "uuid": "1a1d997f-f054-4815-b90e-4219c10e95c0", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692721219, "uuid": "0ae5fb3e-1939-4793-b223-7d0a53320bd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721219, "uuid": "f4c9c5ba-5559-43e2-a895-0a9a5654eaef", "value": "9941fd71b8e698ed5994e0c84bf3b393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56d92ea-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689805, "uuid": "a691d35d-d6fe-4f03-8267-e02ae9f096d1", "comment": "Malware payload", "value": "7c90215f0d0009098d22bd289c116cf2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689805, "uuid": "0ca1a987-3cd6-4339-a3e2-a8a0d07c05af", "comment": "Malware payload", "value": "1da248bbbf7b7c49e64a597931477eb7ba370a67ba32d0858483391cfb0252ad", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689805, "uuid": "56f0f01e-e5ac-4020-8971-140fc1df7481", "comment": "Malware payload", "value": "1497d13480c9bb55a9d3156bf7b93f61b7557ed4", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689805, "uuid": "460d8c60-ef4e-41fd-84af-6f79658cbbf2", "comment": "Malware payload", "value": "c2938ab55e416992cdc47e8a17fda1f30fc62f646d94677ae91cc48dc20fd3f7f9f1554beffdf7810be0c4aa9cc32369", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689805, "uuid": "279cd085-e63b-406d-8e28-298da6dc3587", "value": "T110C4125033B685BAE85397B84CC8B29B810DFC209B42D597755AB38C0573BE2D733A97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689805, "uuid": "1de6b608-1ffe-4b07-afe5-37e760a22b06", "value": "12288:HvO4rj3Wg0dhTVSOewrjlEwtM381W54N6cIVi:HrbAXZSOVrmwtM3+rN6HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689805, "uuid": "d87f339d-2ceb-4ea9-bf54-12e5287db268", "value": 559104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689805, "uuid": "a5934ea4-38f8-45e4-90b0-e2bc0ee2aada", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689805, "uuid": "f7d03388-b900-4258-8f14-0ce9e4c34a07", "value": "MV TRANS-ASIA II.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5436ad4-408c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692668411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668411, "uuid": "8b3e60a4-e73c-47dd-acc1-83cff74abcdd", "comment": "Malware payload (Smoke Loader)", "value": "998dc2c3d2f2c0f6d847c506fed46f8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668411, "uuid": "f6217c8f-64b0-4995-a34b-fb98672e3cf6", "comment": "Malware payload (Smoke Loader)", "value": "1e662d2a9bc77dc09ff39c21dbd8f11968da7c1dea6f4bbcfc5216c0d8f8c8fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668411, "uuid": "37f13905-597a-459f-bd42-571a9135cf73", "comment": "Malware payload (Smoke Loader)", "value": "1474a98d04b18f769fa47ef2db80781d16a40cd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668411, "uuid": "41617b5d-060b-49b1-a439-d7340e67f6cd", "comment": "Malware payload (Smoke Loader)", "value": "3a5ddf9215d896bcd5a1e7d5fdbe8adae9bfd95b1fea1a3926680893bb3b6194c8560a2591361f33a8e1eb6de96c970b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668411, "uuid": "e9d8e3b6-6339-44df-a2c7-9fcecd0f13fa", "value": "T10326EE06893722D4A171DEBB2DA07EE38D7853932F958A00C825134F5FA9F61DCE1B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668411, "uuid": "e2c08b43-28bc-4d08-80f9-cfbe33406159", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668411, "uuid": "5b4fac67-f326-4607-8991-4276a116d4f3", "value": "98304:RHvpSqD9OLIdhBhdlBA5iqokpuqqmzZum0S463h:RxSzkdhBhS5vMHgx0pG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692668411, "uuid": "68c457d7-5d6f-49b6-8a79-9c9baa0ff97d", "value": 4841984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692668411, "uuid": "5ec63b28-67a5-4fb2-ae04-aa3d80329066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668411, "uuid": "79d98a15-80ed-44af-b609-14fc2563436a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf44752c-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727215, "uuid": "b03c1890-2f63-4334-b83c-34a8dece532a", "comment": "Malware payload (Mirai)", "value": "1b71cfb42f50ab936a80a0213101b0c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727215, "uuid": "95b8bf6b-5682-4287-b243-5a2bd4d19152", "comment": "Malware payload (Mirai)", "value": "2061401d2e4c9e834a14dedddb1f91e2b0a62fe9c4249951f9109edb19fcb6df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727215, "uuid": "90cb9da6-a6b7-4348-967d-a08632562f80", "comment": "Malware payload (Mirai)", "value": "9c81a77c7f4c0d9eb81701932c07af3be94623d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727215, "uuid": "fb249f13-9cfc-4a33-8d44-ed38ec269a00", "comment": "Malware payload (Mirai)", "value": "d94404e0a9a190e737ec342e91b1ba11ab930de8af8b46465df48aff4d6ea376a54615768bc4de3e3e26311404fd7bac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727215, "uuid": "b3a24b3c-a0cf-476d-853f-55c3641fe76a", "value": "T1CB535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727215, "uuid": "48e3834f-263b-40c1-ae4b-4b680d873241", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E83:N1GjR8EVGOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727215, "uuid": "c240bd7f-2504-44dc-9dee-50356b4b2928", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727215, "uuid": "9a3560b4-4f4a-436d-b838-2e4883e85da2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727215, "uuid": "7ac55d0d-e8d7-4aac-bdf6-f5573039a331", "value": "1b71cfb42f50ab936a80a0213101b0c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f31c7b-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690657, "uuid": "0f9f1428-a990-4240-9097-50db0253d6e1", "comment": "Malware payload", "value": "25141726900145ce9bd36d714b8380c7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690657, "uuid": "f53e8cbf-23bf-43f4-a521-04ff3c6e0290", "comment": "Malware payload", "value": "20b2d5a39101af38975699be025261539c346b58e2c210a3afae4f10cbbf013c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690657, "uuid": "471439b9-7b6c-41a4-afa9-ebb4c74ba427", "comment": "Malware payload", "value": "ec2eaebcbaddefbb0cec79602e2b47df2cfc12c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690657, "uuid": "46a1caaf-0ac2-4b72-b357-cca35ce5025d", "comment": "Malware payload", "value": "40905e8ae07165f665eceac2b4dfee9b880d4b42cfb0542de13fed03edd26aad6ef12abcd0be98583d99848ee4638091", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690657, "uuid": "0344dfde-064d-4976-ada1-6535a45b01f7", "value": "T159A4126F3FCBD478DB076036900084A6971EB0A4B157116F5BEEAA9A0C70DDC1B99DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690657, "uuid": "1ebd7e8d-136c-4a70-b7d0-a203377ebaa8", "value": "12288:98QlP+9NW32j29pBucycBSvwznel8YGbQnVeHhNP:98YSjyFBSIztQnVkhNP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690657, "uuid": "c8e8b07d-3b6d-4cd7-b6c4-4cc0d02b2e71", "value": 456251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690657, "uuid": "bfdc3f16-da85-4adf-8ff7-9d17c8d738e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690657, "uuid": "eb9d0bf3-3269-4e07-9226-ae6cd1fc39ab", "value": "Invoice no17684.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e063f7-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727260, "uuid": "55ad9b7c-4c1e-4ffc-8d7b-88f613d0da06", "comment": "Malware payload (Mirai)", "value": "c8bb89f4da11457bd7e17eeae59fd39e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727260, "uuid": "179d4efc-6673-4b8f-ba00-bb55e25ac1f9", "comment": "Malware payload (Mirai)", "value": "215ab39f32317608bb029130027755b375d69e1a50eb67dc5ab3e6ace1bac4c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727260, "uuid": "1ab9044e-3994-4317-a3e7-84ef6e6708db", "comment": "Malware payload (Mirai)", "value": "2b60b98714ec09bd193dd74fe5aa7067ea326045", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727260, "uuid": "c927e306-5340-4b50-8677-b6bf2f70de52", "comment": "Malware payload (Mirai)", "value": "30d8339219882b304d03d0df622bbc549ca975cc05d49ff3567693d25e7e8b629c89b044ea3c7d8970b870c0434c6ee6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727260, "uuid": "e93545b5-36c8-4da3-b974-1d001d82d883", "value": "T15C539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727260, "uuid": "239a860d-8cbb-4926-800d-d0ddb2cd2e9f", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727260, "uuid": "35dd72c4-86f8-4652-a1b6-9ef105f665c1", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727260, "uuid": "2bc73abe-8a21-44de-b681-fa7871f920f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727260, "uuid": "03032fae-f7ef-4f52-b534-ca99d787f75c", "value": "c8bb89f4da11457bd7e17eeae59fd39e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeaff7b8-40e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692705820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705820, "uuid": "2724db44-2990-4b4e-b015-fd67da8fd3ef", "comment": "Malware payload", "value": "3a138c9415d11d92c5d50c2ffc8394de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705820, "uuid": "a9685d3b-13dc-4926-86f5-1c53172adf39", "comment": "Malware payload", "value": "226f1fce2b39e4769507402b282864222d091d786344511d4fdf4cf9c3d2c049", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705820, "uuid": "7516e173-5a99-43b9-a051-f07203e3c2be", "comment": "Malware payload", "value": "b8fdc9611fe8db1069cbe8b6df6aba178f3edf8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705820, "uuid": "02506a48-74d4-4753-b2d9-df0a6119a051", "comment": "Malware payload", "value": "a2c4b00a03ee369cc511129c1180bf6ae521d2b7432c6244a2697ba07e9dc54e81d03f5166a1d6ba23ad081f2ee990fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705820, "uuid": "45bbc88d-e5dc-4862-8deb-108f81f981e5", "value": "T19AC402099A6FFF63C57E43FD0623485443F1D066E3B6E65B5EDA34EA1212B808E81B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705820, "uuid": "335c92b4-6471-4b08-b13e-f4ab7cd7cc9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705820, "uuid": "9fd6aab0-e54c-43a8-a766-8d0e0e003f6b", "value": "12288:dkUMosWNP9BMl8AURFZn7hsFFPJQghQKGTcIVqXTMt:V9BW8AU/ZVsfJQghevVs4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692705820, "uuid": "cbd29522-7a29-43c2-99da-9c4c7a36c27c", "value": 574976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692705820, "uuid": "4f9800dd-c76c-497a-8a0b-7f69e7431f02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705820, "uuid": "ca830e09-cc66-4e05-8d46-1a74dd78c8d9", "value": "PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69489963-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738667, "uuid": "7e043808-0dda-4874-8515-9c65f2a56495", "comment": "Malware payload (Mirai)", "value": "bfaf877968fb23ffebae2d48df053706", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738667, "uuid": "eb0ef929-53f7-43cd-bfe6-c9c6ef1452d6", "comment": "Malware payload (Mirai)", "value": "22f1a0d6a4e9d2edf251816feffac078b25a61326e0aa09f8750acaf72d150ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738667, "uuid": "a6514b83-d33c-485d-a334-b518c5e7adff", "comment": "Malware payload (Mirai)", "value": "ff04e6312f16c8b960e45c3691b551dc241fdad6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738667, "uuid": "9c7251dc-b0ff-4718-87f4-a3ebe489db3e", "comment": "Malware payload (Mirai)", "value": "1187118fcd42297680d104b435c432a0432509870ac776ad77d34ee008a7e83d0b338b2965e8226e687f2c2e002bb975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738667, "uuid": "57226051-414e-4fc5-aac7-c9c94043d1c9", "value": "T177535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738667, "uuid": "37f94b71-0e84-40b9-847e-16d34ac76ede", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E83:N1GjR8EVGOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738667, "uuid": "ac64c755-a642-4e13-8ca3-c40728762eb8", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738667, "uuid": "d07497a2-1ebc-4ac0-a02c-5ebed6140aa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738667, "uuid": "4bca1db9-06be-4b32-8508-f2e19c999550", "value": "bfaf877968fb23ffebae2d48df053706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8eab4f-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692690624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690624, "uuid": "ca596db6-304a-4f09-954d-b54da99e6170", "comment": "Malware payload (GuLoader)", "value": "1ca6ad16a4d2deede0baf1dd6329c585", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690624, "uuid": "56e7b49a-ef34-4966-ad16-644c9e7885f9", "comment": "Malware payload (GuLoader)", "value": "236c73a241d229cc820b4fa2aa914403151deb84b90939ac4760460fc107dda4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690624, "uuid": "2551b3e2-c007-4578-94bd-a41223a0a1f0", "comment": "Malware payload (GuLoader)", "value": "21a6f5c5545ad757a41da4fc9e4a811325ae47be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690624, "uuid": "022f19bf-212d-46dd-8413-bacab72eb151", "comment": "Malware payload (GuLoader)", "value": "bd3f870ee5c0379b3b1e68e1b9ff072eb37fe7a8cb758a22110ddabf63e22d53717d7b23272f03e950d7f6688fb327da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690624, "uuid": "788841c8-ee79-46d0-89ab-ff522ac73df2", "value": "T180741232F5A0C4ABC1A2277209751BABEF76C53A74550B4703C09D5EBCB16D6BB0EAD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690624, "uuid": "7967c1d8-6afd-45e6-874c-4841901c5fad", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690624, "uuid": "8e4f32c0-31ce-4c5a-9869-38bb108940ab", "value": "6144:EQ606ximo8xiNQm7hqnf9oPESPVnR25FdsNF/N1+BCfWUviwYVr2EMKedJLn:/mo8xiNN0Fop9R0dEpN1+4fBYzevT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690624, "uuid": "581860b2-fe4c-4dba-a906-f83bee49a513", "value": 360792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690624, "uuid": "52b3caf1-6922-452a-86ba-d35e88dc13d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690624, "uuid": "059f336e-542a-4989-9e17-faab7140e16e", "value": "Akbank Hesap \u00d6zetiniz_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a4ab83-40ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692710467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710467, "uuid": "33c441e4-f027-4a16-bf6f-50b7235b6f47", "comment": "Malware payload (AgentTesla)", "value": "49927348ba414e5723e9a901951884d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710467, "uuid": "8ae5fa2f-36ab-4b79-b591-59c38e47ba82", "comment": "Malware payload (AgentTesla)", "value": "23a188b67111d6c67ba62e1588479154ca23c4c65d768a662b873757a3419ed0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710467, "uuid": "bf99c7d1-624a-452b-bfbb-f0bb120a7320", "comment": "Malware payload (AgentTesla)", "value": "3a68cddbf24f08a1bc5b1dd94b0f76f30afe6cb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710467, "uuid": "b5925f09-71b0-4e2d-a12c-854133b2d040", "comment": "Malware payload (AgentTesla)", "value": "bfc336368cb222e985d910ef82d0fbf8eaee17d1602a1b1ccc7ed5f1da0c57241c86b8855b07fb18c9e80811f3627271", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710467, "uuid": "37d2d485-bbd3-45a2-85f9-167e5d1a4643", "value": "T107E4CF10A2B79B45C87F93F53F11120C0BBEA51953FBD264BEC6A0DA5961B804E5AF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710467, "uuid": "8aab2a90-f42d-4f4c-b844-c3d17c2539fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710467, "uuid": "90aa4e66-b62f-4ddb-9cc7-b65243a14469", "value": "12288:75hiEww2d1mbTq7BrpDTVSwyPCfKdBLXXFhUVal1c0SxMgvJBvY/S0f:HiEw0yjTVSwyP3UVabv2BvY/3f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692710467, "uuid": "89342885-e805-4df3-96b8-7d4e206baed9", "value": 699904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692710467, "uuid": "258bc205-50a4-4a41-84ba-77755c887de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710467, "uuid": "627027d4-9cb6-4be8-ad75-90ee9c94f0a5", "value": "Factura comercial.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dc26222-40f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692714918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714918, "uuid": "e4b26beb-6338-4306-847c-185d881c301c", "comment": "Malware payload (STRRAT)", "value": "080c556e081261209e5fa5d75d9fa4f2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714918, "uuid": "e260473e-afb8-4d67-883e-cbaba1e27da0", "comment": "Malware payload (STRRAT)", "value": "244cb4d50566a9bb1156798ecd88aeb108f4c1ea7daaf51ed7374ddfe0f305df", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714918, "uuid": "b842d826-c514-4dd2-8000-4114320dc338", "comment": "Malware payload (STRRAT)", "value": "4ea6c70baa5899beeae00b361d104e5fb41f45b2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714918, "uuid": "d28b679f-e1af-48e3-94f0-411376dfe3cb", "comment": "Malware payload (STRRAT)", "value": "016c511c4c5fb5acf6bd9f7694bfd80f65f2d39808afd6dfe298739cb00883dcb236ee9c57db7281ee97d508d53ddfd3", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714918, "uuid": "a11cadc0-4c76-4dc8-82d0-862523834941", "value": "T1BD63F2E5F7B68830F503B1B99C16C82BECCDD34C8E8D520B0B9B694D28F16845F569D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714918, "uuid": "8eef0f44-3857-4290-bc48-91c5a8fdba80", "value": "1536:xMm0V94iYfeEiyPBoy3Wq4YM9RzPb5JyBECgjlYrAcy97wBZXxoCXT8JJ:emk9nYkypobZlTGUlSOFYZXxDoJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714918, "uuid": "db7ae36e-8938-4741-acff-f2d1d44558b6", "value": 69664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714918, "uuid": "e73187c5-2159-4d32-951f-ebaeab938512", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714918, "uuid": "5b77fc38-3070-4fdb-925f-ffa4c6c360a9", "value": "Pago-08022.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e17ebf-4124-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692733749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692733749, "uuid": "e4b76bba-18e9-4d49-945d-cb1605bf009f", "comment": "Malware payload (Formbook)", "value": "92f39004939a97c8ce5eb4346e0f09ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692733749, "uuid": "eee21153-14ac-4b2b-bb0c-b1380d34104f", "comment": "Malware payload (Formbook)", "value": "244da7e5507e828266a961e3f4bd165f1b8c408463157d6c1e01bef1cf162034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692733749, "uuid": "c178c670-05fa-4475-a703-a82315a806b7", "comment": "Malware payload (Formbook)", "value": "e09b69e9b87e029962e0734db32b9ef4f9c4af4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692733749, "uuid": "36d721ff-1a0c-464f-8896-53d06a2d0ce8", "comment": "Malware payload (Formbook)", "value": "cb86d53613fbcec35d21f0e5b4fb74b6db5671d451a10e320819535524914b4e2dce9186f89208e6756d660819d2d3b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692733749, "uuid": "51e43d2f-7c98-4418-afe3-14d1e153cec7", "value": "T1B64412A414E4D15BE9F242B22EB50BE6BFE595062C68D70B3304AF1DBD361C1E42F366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692733749, "uuid": "da272fdc-88f5-47e3-87ed-646194d8847b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692733749, "uuid": "2d28dcb9-801e-4747-8fc1-6bdd2117177d", "value": "6144:/Ya6orng5+UXg/4CblAVFZLySPXxWFs6r6U5sk/N4fYyHl+sHs:/Yuj/HqFLRXAFs+6YN9is", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692733749, "uuid": "bb229b45-7857-4a24-b962-037a43dad45e", "value": 273774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692733749, "uuid": "f89bddf3-657a-47ce-b10d-aa6368226e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692733749, "uuid": "cd91e446-0cc3-46de-96d9-b18111c5ba0c", "value": "Doc#230822TRF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93bcb48-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727232, "uuid": "82341eb3-c0bf-40f0-b6dc-f3def1f76095", "comment": "Malware payload (Mirai)", "value": "e54c8e8a98f3ccb967aefd5bec8d1b58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727232, "uuid": "a58735a6-abe5-461d-b198-7e81835005ff", "comment": "Malware payload (Mirai)", "value": "26b903cf4c828251e86d1994bf1451640f93a13d39e13f62d7e3e6b9a85ee386", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727232, "uuid": "da6e26f6-ca48-492a-9ed0-7c38ea891883", "comment": "Malware payload (Mirai)", "value": "91e7d6a1511d61966393d49fd43ceaf0fa696fc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727232, "uuid": "000eb291-448a-43ad-933b-bb6c3842366d", "comment": "Malware payload (Mirai)", "value": "83cff77c9843b65a8a709a59c72f4041306347410e762b3933d3bf53ef1e3c2e7124db3510e0255936e11c1ca9487a3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727232, "uuid": "d9bfc78c-ebf9-491f-a326-8d4095e3bc4b", "value": "T101B2D1E497905706C2B0B435E27CCF935F3B15A0C6F639261B1092AC96954A733FDACB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727232, "uuid": "10ef3da6-71e1-4645-ad0a-ba20538de8ce", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BbfVYWhymdGUop5hu7S:4GaKQFH0rs3zWoDDRsjt7LB9U+BbNJsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727232, "uuid": "fbf8f4d1-25ab-474c-9d8e-d30ba256cefe", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727232, "uuid": "27f43627-ca98-4345-8224-b004bbcce96c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727232, "uuid": "eb47846f-21be-4c33-807a-9024501c31aa", "value": "e54c8e8a98f3ccb967aefd5bec8d1b58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714dc6fc-40b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686711, "uuid": "3748f1f6-d3ed-46fe-aecb-0a6f2d748920", "comment": "Malware payload (AgentTesla)", "value": "2483374de3b9e1386df35da0c6d367be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686711, "uuid": "e1e35541-ab56-4793-a795-a3db94dd9bd1", "comment": "Malware payload (AgentTesla)", "value": "26eec7bea99973fa7a59366d0603196099cec54b0e20f89876fd1dcbc6ea1e94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686711, "uuid": "b2401cff-72d0-4534-8fd0-887367a8bce4", "comment": "Malware payload (AgentTesla)", "value": "148928f085158a4900285390a6609cd965fed724", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686711, "uuid": "afff4c1c-5846-437b-bc58-9e2df319b4c7", "comment": "Malware payload (AgentTesla)", "value": "afcbfc9b927d21ad4670d4e39530e77830644e1eeebd0c8caa09776402039b318c03b11839c3af737fa3b3f8e295db0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686711, "uuid": "0c0623aa-4ec7-43fd-8ae8-712e52f7c8a4", "value": "T13AC412404EC8D56BFCEC5F7421FA0F055A707A711ADAB62CAA2C31487FB23A1741DA67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686711, "uuid": "accc7b75-73b0-4cb0-bdf4-9df3abd69bde", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686711, "uuid": "77f38347-9309-496e-849f-34891b558991", "value": "12288:1ff5y/NQkoSlKdowPbaE5YWqYFKSrbv4rNPUdhZiMc9wSSR6:1ff5y/WkoWKdosJT+SrbwhP4Hc9wST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686711, "uuid": "78cdbcc1-a340-4d22-8b16-96123d6d125e", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686711, "uuid": "075186c9-e71a-49ee-8217-ab5295a0bc4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686711, "uuid": "ee7b56ef-a4b4-4d77-a8e0-5c697d786e14", "value": "EST20082023_KTK1818.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4e88f5-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693172, "uuid": "b02c9818-c2f2-4ce5-9eeb-c454ad5de739", "comment": "Malware payload", "value": "eee3ce7d5c237ff37b1bc33c8c321b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693172, "uuid": "78f57271-673f-479a-94a7-88b98b4bf16b", "comment": "Malware payload", "value": "2762bb90126e2540dd3bf73d594f2189a29f3d4c4902a714fafb3ff0e73983c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693172, "uuid": "906d3608-23ac-43b9-a559-e0bbdeb3db19", "comment": "Malware payload", "value": "b55a6beccdad8351aef40449246582c038054665", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693172, "uuid": "73184855-5e28-48e9-950f-646bc1d8f094", "comment": "Malware payload", "value": "2dcd670117d4afb3ffd6d42c4376585e6376834d9bcbc648b751e87ca63335b54bf2c312a3535d3377a1544a891ab50a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693172, "uuid": "3982bace-3618-476d-839b-593e035c27c9", "value": "T10F93ED2AA7B1DEBBDC0DCD3342594506518C995A52D92F6FBBA0C118F78BD0E48E3CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693172, "uuid": "6de4003b-b974-47c2-ba6f-348f38b10483", "value": "1536:jLXjrihmdJewUwXJ0XRu9N5PKcMT/DMcpaqr1tZq/K5V5Mw+B:vXjOsdJewUwXJ0XQPi1t9v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693172, "uuid": "d6a6e53f-b51a-42d8-be64-ff3094df713c", "value": 94560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693172, "uuid": "e9053d41-374a-49c6-8bec-a79f2a430577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693172, "uuid": "38b5fbe6-2ff5-4e69-8fd0-aeee50de3b65", "value": "eee3ce7d5c237ff37b1bc33c8c321b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2466ee-40b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686087, "uuid": "d8ba3c4e-3b27-44b6-af36-a0e9ea6a2f0a", "comment": "Malware payload (AgentTesla)", "value": "7d376759740184c6feaa54d14329dd9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686087, "uuid": "e618a52b-b8c3-4cc1-b8c1-9b4f4061f293", "comment": "Malware payload (AgentTesla)", "value": "27b0811f1a22296d17285add8557ce3fbfd823f9de7e20cbccc55908d514eeea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686087, "uuid": "585cec57-91fd-4f48-9bcd-1f630037c2fb", "comment": "Malware payload (AgentTesla)", "value": "c2fc8cea39ffcd30bc574de61eb319e400f73c91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686087, "uuid": "8ccf54a8-d2ac-47ff-b383-677c93795771", "comment": "Malware payload (AgentTesla)", "value": "22d08c92b48de98be60827de89b75d7981e403933ff84a1081b5132b5af6cf3a668c326da78e92e3a5b2e07d1b8e2965", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686087, "uuid": "7dd8c2ad-d0a7-4a07-844e-9b39f2fc42df", "value": "T192250227B6A5EF04C67C83F090512F8453AB45CE2175F1790D86A4E6B2EA7C24E53AF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686087, "uuid": "d866debc-1fca-41b8-a1df-9404986f1c36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686087, "uuid": "63f4784e-5938-4945-8769-f495aecc1bad", "value": "24576:RSwlCe9qhJYloDnvJwd4gapZKV0/vZtfBPuV6KIu8VPQ:nlCe9qhJYCDnhwdf0ZKCnZ1BPyCu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686087, "uuid": "fd577fb1-832c-4b29-bb80-42da26caed25", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686087, "uuid": "b75b5adb-337e-4b91-a6b2-6f9c55653ecf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686087, "uuid": "4199de9b-f298-46af-a334-b318b13ff546", "value": "Payment Confirmation Copy Euro 76,853.61.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8508a9d3-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692689751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689751, "uuid": "5c3cf32c-4d37-440f-82a9-9164c2f2a72a", "comment": "Malware payload (Formbook)", "value": "db59cf47ecf4a407d5e55d68efff2603", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689751, "uuid": "24d96e09-6aca-437c-afa5-897f8a8a351b", "comment": "Malware payload (Formbook)", "value": "29240d6d67f7b32f761c90cc21b158e7d2c3845e7f832193291ccb9ee0467062", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689751, "uuid": "3e916077-414b-4b82-ae1a-9504d9e495b0", "comment": "Malware payload (Formbook)", "value": "181371aaa5e15a849cb2d38b05035517655512dd", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689751, "uuid": "8398bb3a-a479-4883-a51b-f0acd861af25", "comment": "Malware payload (Formbook)", "value": "14a726bf3978a2901f2b51e65a03113a78b6127beb215c3b3de213ccae5b48a2b540a9a04257159cd44ea0294b82d5ec", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689751, "uuid": "a4c1d1d3-112f-4247-a011-7a520ded983b", "value": "T12153E92EE34F0919DF56967B435A0E4A45FCB73DB28140A139AC973437EDC2E862297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689751, "uuid": "1bd3c3ea-3c5d-4061-90b5-39ebaea8ee9c", "value": "1536:dwAlRNFEjmaTnV008YZLhqwSzIrcySHxZUhPRtXnVmQTiV3lMuYLGthxdVgECBzo:dwAlfKjm2nV008YZLAwSztySHxcDlmLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689751, "uuid": "7cb41189-1305-4b7c-8351-1a13a8477f59", "value": 62238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689751, "uuid": "ffe0b40b-f977-4866-8cf4-c73e20886243", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689751, "uuid": "9c95d53f-1da6-4e13-95bb-37958deebb42", "value": "PO-20230822.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff5488d9-40b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686091, "uuid": "24748ae8-0e3e-43ff-99bf-1232d276257b", "comment": "Malware payload (AgentTesla)", "value": "7cf09376d2024f2ef8495f81d402ee90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686091, "uuid": "7910b3bd-77c3-42c3-a496-0239d9f828fa", "comment": "Malware payload (AgentTesla)", "value": "2a68cbab81994c92289a653251749b7c40b6bd089e2f78289e7f78461663bfdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686091, "uuid": "50366e83-49f0-4f4d-958c-653a88acc42f", "comment": "Malware payload (AgentTesla)", "value": "e4b9cbb4f7f6d81295b3fbe5bd230d907f1355e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686091, "uuid": "500ddad7-343a-403f-9c6c-362347b246b6", "comment": "Malware payload (AgentTesla)", "value": "1cd9fdf6567fe5c8dfae0378b72d768ab23f951c98672a3f08dd0cf3ab8ee95de98429fd89994f8c8aaf3cd309b6da00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686091, "uuid": "2bad0578-c09a-4cad-ade8-f21250d33b1f", "value": "T196151206F6D07EAEDC1707389C76A893004F7D612A6EE49715C972523BF3AD36B26B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686091, "uuid": "e83a5311-c05e-4d97-a524-c5d1038a96d4", "value": "24576:Pra+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXIVTmrtAXZSr299MCwL/:PrD6bV6ryEGl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686091, "uuid": "87b3654f-39a6-4429-a173-e5e4422eb9d2", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686091, "uuid": "ed340e0e-2eeb-40d0-97ec-579325ba4a6a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686091, "uuid": "bc8e6a76-d555-403a-bd28-58c009fb71c5", "value": "Swift_MT103_10.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1048f1-40a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692677710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692677710, "uuid": "885a7aa2-e054-4a5d-a116-fffd7926ae04", "comment": "Malware payload (Stealc)", "value": "a7caaabf9627865778471046c0cf5eda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692677710, "uuid": "021b7b10-4f0f-4892-b3d4-873eb37eb87d", "comment": "Malware payload (Stealc)", "value": "2a8c4927c673ae53fa0b99c0f2e8dce3b09ea7f6ea9855c4140f198b9789f916", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692677710, "uuid": "20aacb54-510e-4ad2-9768-c1f0515c19cd", "comment": "Malware payload (Stealc)", "value": "2c90ef3cdbce451aabf5b4290bd41b33900e1b76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692677710, "uuid": "f5357201-06b3-48cf-88a6-aebf53c30922", "comment": "Malware payload (Stealc)", "value": "364c0b651d4107d5989725f3b32458f547655f7328b68c3de6dad9db6d66ed6f7eb4a7f39e663983359bf002d35c1ac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692677710, "uuid": "88fc36fb-673c-467a-a07b-661a3e9dbd27", "value": "T1FB34BE1276A1E873D7574630DD2EC6A477EEB4204F99969733180B2F09702A2C26FF76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692677710, "uuid": "bbc84713-7b80-46e9-ba7c-4dcf256b3bc6", "value": "83f305571af3bad4fd0b459ab4b0a012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692677710, "uuid": "e31a46b1-45cc-4953-8d5a-f327b0ce8afc", "value": "3072:mtLMZVLKWGG37DTTNjuB3ujkS4W877VQE7tw+qBuL3UmI5XGLF:mKZVLaG378NuQWiemXB6GL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692677710, "uuid": "ce97067c-b1d1-4d8d-8a0a-6b1560220860", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692677710, "uuid": "12d7fabd-4d78-49d6-b131-4df05ccd7474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692677710, "uuid": "f0989f92-6606-428b-9fba-86fc4bf0205e", "value": "a7caaabf9627865778471046c0cf5eda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d23c75e-4133-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692739908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739908, "uuid": "85b54818-4766-4ad4-8738-b85245f0475d", "comment": "Malware payload", "value": "e05b79a3d56be842eb9eb6e361f10354", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739908, "uuid": "06dbb764-c76b-4c56-8c89-ab34ce989ebc", "comment": "Malware payload", "value": "2d06c112b8b8b5f995f7cad148079a745cf43a2fd085c1f089ee83ca6dec9193", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739908, "uuid": "91840c61-4338-4669-bbd5-ce15505dfb7b", "comment": "Malware payload", "value": "90faec46da40c41a4a745f5b9b27584968017eb6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739908, "uuid": "60c33a94-20d1-4c83-850b-d5cedca7a847", "comment": "Malware payload", "value": "377f8e64c67728e92f3a5149012dba8d031922071619c985fef03ecff3c34d3504548edfab9612494aac4ef9fa92fcc0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739908, "uuid": "f2020db3-d789-4bea-b621-e341ed11ab75", "value": "T163A42307D9917DB3E29390363111B4F65D257D036A08DC0AA6A3B87E4A03BF5FE72D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739908, "uuid": "70f87048-9d43-4d44-b558-f1e9b89e6387", "value": "12288:6HZfYGp/u70N4ZLWpSVrCJgrecaEYGQGl+TBUh1qcJ0egQW:OQGgFLBG6YEp3uSxJ0egJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692739908, "uuid": "1a462719-7abc-4542-ac8f-0f505570a613", "value": 487130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692739908, "uuid": "dd2b3325-ecda-4ffe-84a7-15b0aff2ee83", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739908, "uuid": "6f296db4-c95d-4619-8cc1-74a605d215f0", "value": "DOC0803215.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be79a188-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692683405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683405, "uuid": "50915a43-5cda-416b-82a3-2a8c0dcf3adb", "comment": "Malware payload (Mirai)", "value": "35edf1ec44e02f1bc1d8240a56c51721", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683405, "uuid": "47302cc5-a758-43db-afc6-baa05a2e196b", "comment": "Malware payload (Mirai)", "value": "2dedbbbcebb7f1954f9ce787cabcba603e1342206481811147eedb5ce9da697b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683405, "uuid": "cd37527d-bec2-4791-a0f2-7008fb155b7e", "comment": "Malware payload (Mirai)", "value": "9e45a403a4112d82b98e85cf6b2a7c4724eeb200", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683405, "uuid": "cbb1eadd-9c46-4e4f-8f52-da038e348417", "comment": "Malware payload (Mirai)", "value": "91acf14f00368770e48ebd3fdd9cf154e752a3a260a695bbee95da6d084a6e3f1298d5871e420c30a2c879863c948b4a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683405, "uuid": "28932ed6-549a-4127-a40e-5190d5053991", "value": "T140A2E019BF18828BC836393455E9FAD21293FC62F2ECCD4D2940C15FF1A33A96430E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683405, "uuid": "16d07115-f423-4806-b2c4-5093cefa84a8", "value": "384:Mg4Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oTK:M98o08kxofBE+ZkXaITbp2F2TWul0c5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683405, "uuid": "1fccac7d-b50e-436a-8e1b-b8361e58a1d6", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683405, "uuid": "b95fca2e-35da-4789-84ea-382b4b253d4b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683405, "uuid": "c81cbbfb-a558-4949-bc40-4677521b99db", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f1d2fa-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693162, "uuid": "a7636942-5d2e-4ac9-8a55-dae4e09fe3c0", "comment": "Malware payload", "value": "f6c8fb77f707e8954ca9f318c8737840", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693162, "uuid": "be6dee3a-0341-4f90-b39b-00fee56b7fb7", "comment": "Malware payload", "value": "2e5e755010803ccb6bae988fefe0f3ce652df359f8b6480b298ab5cb09b0e7dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693162, "uuid": "676908b3-6530-40b0-92a8-679547053fef", "comment": "Malware payload", "value": "ca533821501e95b7f0f0eeda2335eeb2c84713d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693162, "uuid": "7084db3d-1cfb-4164-ad83-81ed459b9fc1", "comment": "Malware payload", "value": "9d18cb0351cac106cc3923f696ca74e8518ea7ca2e146ec38b2f020de3130f1713955ade9e9110f3fcd96a8f207d7802", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693162, "uuid": "f5af60e0-a287-4522-a588-9e820acd849f", "value": "T142211400F2190823E6E17E7033371B5067BACF03161E55089B9FE29ADCBCC315A4D49D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693162, "uuid": "e03be085-dc0a-4fad-a9a9-d51cbd1bcf4a", "value": "24:3KopWS9nSWZ6S4/KSwISBd6oTKP5tAFlD5CqzktqPvy5gaaTo0YijdOuq6VF:wgZVbXGAP5Xz2qPvy5glfdiKF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693162, "uuid": "37e2365f-ef72-4ae0-a96d-a35c965ebfe7", "value": 1400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693162, "uuid": "1628b283-9edb-4695-968e-b913ac03c22f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693162, "uuid": "98398977-d31c-47ee-88b8-15df06f54313", "value": "f6c8fb77f707e8954ca9f318c8737840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58aaa9b0-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692714587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714587, "uuid": "754cd2ee-b658-430f-a10b-6e21d21aac2a", "comment": "Malware payload (AgentTesla)", "value": "fdd9d093dbbc40b507ebd8a3e6e492bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714587, "uuid": "6253bfad-2b12-416e-ba67-df4195aa3ecd", "comment": "Malware payload (AgentTesla)", "value": "2ee41490283fad1457d4870ff08f65cf2a6fd2ff0632fae5e365170824111f36", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714587, "uuid": "d5b45a2f-8cd8-4023-b35f-eff4a5a2678f", "comment": "Malware payload (AgentTesla)", "value": "1c4782ac63ef551bbcc0d7cf4a57ab32ca1ae78d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714587, "uuid": "decf2f00-05e1-4e14-9f3d-07cf0ae1b395", "comment": "Malware payload (AgentTesla)", "value": "e572e4ac3603a2396dddbbfb3c5ed0f08b1804c0e606fc21ee5b978151e2e4506207c8beef195f93835bd2b84c43967d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714587, "uuid": "817afec4-b457-408c-bc60-7088cd46411c", "value": "T12C05CFF05BCCBA60CE148BB5978E7A5377FF16CB0E1311569E17383B6C9235A820686D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714587, "uuid": "592e9889-fd69-45e1-b45f-c0028f2bad10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714587, "uuid": "e0d856b8-7290-432b-b42e-ec02104f5df3", "value": "24576:3r9xhC9k9/xwyq714X0iBiib7hDaPQq+j9n:sGq714kq9yQJj9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714587, "uuid": "c27a5ec5-800a-4580-a010-5add12f4252f", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714587, "uuid": "7801edaf-98d9-4615-a7d7-fb2e8ca39346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714587, "uuid": "ee5ad114-5a8a-4b03-a545-b7239995dfb2", "value": "SecuriteInfo.com.FileRepMalware.5882.13667", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f9c377-40eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692709125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692709125, "uuid": "275c15c3-3289-430a-80e7-01fbd43d9b20", "comment": "Malware payload", "value": "386d3c07219f85bb7a235f05ef0fa15d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692709125, "uuid": "d6e5aca1-8b5c-4572-9415-544c3d3420d3", "comment": "Malware payload", "value": "2f86f8b37ce86cfe16419d0fbeb1d0ef2f37032f6c630ed1d14649f327c27aa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692709125, "uuid": "925c30dd-16b9-4dce-b04d-fc6cc346efd0", "comment": "Malware payload", "value": "89863cbdd6b9c0b276d236623d7e5b0fa703dcb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692709125, "uuid": "30e3d387-5e53-4e0c-af41-c5b31eb62a8d", "comment": "Malware payload", "value": "5e49b73396c5b882fd0388453793d03a9495e59e6cc05fade2d99c7ae6a1d10f323ab5c27e56ef8838e5aabdf4247c88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692709125, "uuid": "808ebb40-c6c8-4fcf-9c5c-7523dde1e7f3", "value": "T1E115EA5CFA09DA3FD34C8C3950F9DB2B69B99BAED0E1E351C01191B518E6CAD0DB6063", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692709125, "uuid": "8fa85a05-6557-4a80-be7d-478bfcbfca90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692709125, "uuid": "b6961b54-0a89-4e96-abbc-86e72af4e754", "value": "12288:iMMdZxCSWrpBS4jYWRwzCEA7JtuU7cNQUQUw:iv6G2YM0aDcl7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692709125, "uuid": "ff68cec1-683e-4f90-a0c1-ddd175bfb02a", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692709125, "uuid": "0935c3a7-8c74-423a-99c4-dab8ab4a9daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692709125, "uuid": "35905e0e-124f-4622-aa43-ebed72372dbd", "value": "SHIPMENT DOCS 2X20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f2885a3-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692704317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704317, "uuid": "f3106a23-5c7b-459d-92bf-73ef762305b6", "comment": "Malware payload (AgentTesla)", "value": "12938f71f455f7e8085db0e928c381f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704317, "uuid": "b43ab54a-30a0-4927-861f-73aec1260dc4", "comment": "Malware payload (AgentTesla)", "value": "3008b5ada1c9e1aea092551c39ab392e16885e2a19b088d611eaab6507c2d65d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704317, "uuid": "daf4fa73-f43f-42a0-9aff-97adf411c98e", "comment": "Malware payload (AgentTesla)", "value": "8613e7c3745e5f9a3127529beabf7e1aefca681e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704317, "uuid": "f67905d2-5b5f-41e4-b5db-5a1b87ffb16c", "comment": "Malware payload (AgentTesla)", "value": "8869432e05d2db58eae5e77ba115e6ae7b9656259b2a4f85cd5dfce3aaf3f7d6dda92211915b50b73385e90c3ab97200", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704317, "uuid": "f4e73b64-a48f-48cd-8c2f-d6f33cc57cc6", "value": "T1ACC423203F95D877EED348B04A1867A1EE99A329381415C71734BB9E3DA2742DC4FB4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704317, "uuid": "437cb52d-6167-4473-a221-a22210b4e3b0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704317, "uuid": "cbc743e5-62ca-4f92-ae50-e6e072a4a964", "value": "12288:C/+v6Wtmis97YdfbywP4guXEHZVeyO+Sl8ZHDmZhZ:C/ymisedfbyEQE5MyODsHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704317, "uuid": "0082f98a-8516-40ea-a8e7-5887156e24c4", "value": 544680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704317, "uuid": "e5412f34-4745-4659-a932-f77e5d247a6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704317, "uuid": "2f1ca9e9-8307-426e-b1be-92874180b45c", "value": "Anfrage INQ0981 xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8d4186-4126-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692734490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692734490, "uuid": "72876ba2-4520-44b9-aacd-1049f4824824", "comment": "Malware payload", "value": "bafd23730360a9472f6ef48ec5282d0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692734490, "uuid": "51052e3d-b947-472b-b8ce-e555b6da71c1", "comment": "Malware payload", "value": "306d6bd23ada083d65c640baab9ef36eca957d155c055deb38c4f912421ad4ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692734490, "uuid": "cd633129-9016-4780-800e-ca1adfef0bb7", "comment": "Malware payload", "value": "43c2e6e75de89d764611fcc5a505066abc6546a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692734490, "uuid": "be6f19a8-1267-433c-a035-ada0e19a305e", "comment": "Malware payload", "value": "7d41e0ea798c445a048c5d59f092b17d3e3e4240d53160dbbd79349f8496d969017387ca5cf46f1f9f27c1a2cb55fc4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692734490, "uuid": "dfae4d3a-3f9c-4fb3-af8c-4bcd73f1750b", "value": "T18D463359DBD05833EA0783B06D88412841EEFBAD2B6FE7902E8447DC6CEF995528D317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692734490, "uuid": "60bf1323-a780-4f91-bfe1-43a3fd32e397", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692734490, "uuid": "3a838a8d-2616-43c5-ba72-a5aadf9185c9", "value": "98304:FibYe0pZw8uqrRqLgD5ks6X3T0+0ke/bqk+KS/n5zENJYTW3jds2dHa4IXTO48kk:cMDigRi3TVZS+j/O0TW3J5HadOr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692734490, "uuid": "2ddd65e3-3e9b-4170-a1a7-c9e0e564aa96", "value": 5491800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692734490, "uuid": "35a42cd0-9296-464f-aeb7-eb060f7364c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692734490, "uuid": "e8c653d0-1fa0-4dba-960a-27f10c9262f2", "value": "days-and-tenoke-x28tleLRE4kk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b14db28-40ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692694808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694808, "uuid": "7c8fdb2e-7ffa-442d-9576-b3222480e07f", "comment": "Malware payload (Mirai)", "value": "da0c7ef979c79902c964bfbe249a6826", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694808, "uuid": "e4fb5f9f-d916-478c-945a-ff5c58118a64", "comment": "Malware payload (Mirai)", "value": "30b52cfea5420e9bb52c7436db58cdbf27eadb365e1117e701eb4e80307879de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694808, "uuid": "ac14744e-ab3f-4aae-88f6-685e0941e3cf", "comment": "Malware payload (Mirai)", "value": "aa9535ae539843c97fd7a312af1e06af92e0a02f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694808, "uuid": "e407e09e-1dc0-459c-a476-e26fb9fcd2e6", "comment": "Malware payload (Mirai)", "value": "1d3df38441c3c70c22d27ed5068be254f2507fa191b1be81abe720ac5643ddc138a9a69034989639f4497bdc46cbc471", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694808, "uuid": "1774fd01-650d-46cb-87fb-1331af623431", "value": "T111C2F1A55228D072B1B49936FDBF01036736CFF8D6AF362662144734A087D26A6B4B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694808, "uuid": "8b080db2-5f94-4b56-a551-6735cf39e6fa", "value": "768:byNUQUfhQllxlaH0MFjlOnGsyyts3Uozz:byWQUKljlEDt8GTywzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692694808, "uuid": "1af1da73-5e16-43c5-8d7a-a3d0f0aa0d53", "value": 27344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692694808, "uuid": "c6c96eaf-d501-4ad5-8f2e-b99aa7f865f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694808, "uuid": "3b2bce0c-4c84-41f3-94a5-ff1978f75ee9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9391f570-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689775, "uuid": "8f25af5a-3164-47d6-9cc1-d6396ec3c5e1", "comment": "Malware payload", "value": "b9199ff65b5e2ec8bc73deef2e7edc32", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689775, "uuid": "301c4d69-a7b5-4cee-bbfe-f9ea15b2e560", "comment": "Malware payload", "value": "3175b5a15f1d5a2a522f38ffaebf0ee65831a1e202e7a6f1634ca53233c4fc47", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689775, "uuid": "54fcb4bd-a471-48d6-93d9-a015ff1c1608", "comment": "Malware payload", "value": "eff8502149520de101598267dd9618978d734f65", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689775, "uuid": "985537cb-ef98-4c7e-9739-3fa3c761ed85", "comment": "Malware payload", "value": "f300a45575da4f1912adfbfff5eac3d82464489e4fadc30657c5b52e3ac384f7f0a41547f8e4aa4aa398af950d5c5d60", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689775, "uuid": "0ad54117-e019-44ee-b180-28b7c976a5f1", "value": "T1D305230577C7C4EAD4E68A788C86E4D7490CFC215A4A92D730E6B7BC0132F97D7AA346", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689775, "uuid": "0eacd181-4811-4ba1-8cab-c882902ef8e9", "value": "24576:3r9+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXAg5rBAXZS7frBPaZSy5TF3OGmup:3ro6nyrWELrx9y5x34ueS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689775, "uuid": "e59b188a-97cd-4917-8d5f-3d5b9e4bbd68", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689775, "uuid": "ea6757e8-c678-422e-8fb2-b0844f119142", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689775, "uuid": "f4054d64-22c5-4606-9d34-164f130a84ec", "value": "pago.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f529482-4122-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692732557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732557, "uuid": "0ea4a40d-2159-4509-889a-92b8fd9f4e70", "comment": "Malware payload (AgentTesla)", "value": "bcc6ebddb86efdcce490348a0c45cb16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732557, "uuid": "9318591c-6e9c-43e9-ab73-7148eec135ba", "comment": "Malware payload (AgentTesla)", "value": "3456c2a7591872eeebcc78dc3c1b54b04ad66492db43429fd6bdca1dc8595684", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732557, "uuid": "ae12741b-87da-4563-a579-c2b05b40474b", "comment": "Malware payload (AgentTesla)", "value": "c7e45c162453d39a68629f8ae1d5dba912dade1e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732557, "uuid": "30d200b3-881d-42a0-9acb-7d222718f4f4", "comment": "Malware payload (AgentTesla)", "value": "ff7736780de3591017054c9608d441763293e29f645a3a4a7afdae592ceec8c779df1a92143a1ea3a6030be41026f4d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732557, "uuid": "da1209a9-bd19-4ad5-a470-e407cf6085e9", "value": "T11CF4F14172B95F0AF83563FA1B51624143F79AAA3076D6C99DC234DF2860F828F51FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732557, "uuid": "9d9443c1-da04-430e-ba9a-d50595963720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732557, "uuid": "dfd034ee-1d3d-4e5e-ae78-923b7733e253", "value": "12288:Ev+2d1mbTc9t9FalZViMcgNNX2+Ujsqc5Ad9m3rFSYxxpoNzOgr1vpg:86y3FGiMcgzm+OKEurFzkNzOMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692732557, "uuid": "be5b30d1-04ea-4a2c-a332-3834c0ffc802", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692732557, "uuid": "ded64d5b-d0f8-47f4-bfb2-c7407c093124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732557, "uuid": "e145261b-3a86-4ac9-8373-d828c98888df", "value": "SecuriteInfo.com.Win32.PWSX-gen.5362.6664", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "681e0bc9-40d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692698722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692698722, "uuid": "20d130c8-ab46-45a9-889e-1f66ffd950d6", "comment": "Malware payload (Stealc)", "value": "cad2343aa241b7c47a41404ad14b7b4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692698722, "uuid": "e30db177-69ac-42d6-9ec6-deaf420c644d", "comment": "Malware payload (Stealc)", "value": "34a0f848bbcf609398fbffbc14a3b070f6e5c15c4987785c29db8de7d46f9bd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692698722, "uuid": "60f80861-9a6d-4e39-ab88-95c486c5ed97", "comment": "Malware payload (Stealc)", "value": "9a8d4178faf1f9e001420510be5273eb75121881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692698722, "uuid": "512ecc30-146f-43a9-b5d4-fe9af5443ca7", "comment": "Malware payload (Stealc)", "value": "041d3c688d91657992b855bf83aa6c05f76eaeed19d8c5a1f5d02cbd5bed449b63120f7fd3c53ac980b938f48e634d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692698722, "uuid": "bdb26630-a0e9-4356-9ed4-33c5c5fff2cf", "value": "T17B854E017BD08741F06D963BE0BE541407F5B98B66B1E31F2DE432EC86D27752E09AEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692698722, "uuid": "e523cbf3-9286-4215-9de3-5222c1f07da7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692698722, "uuid": "adeb75ab-ad0c-4877-aeb2-1efedbb910b8", "value": "24576:e0zLMUH1GVrdsa1lLEipOSjG2L6Pyq/QPs/jROoB:eF8GVrdV0i62L6PyfKtJB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692698722, "uuid": "5e4ee545-e5f0-488e-bf05-949742c94f18", "value": 1765080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692698722, "uuid": "736fe99f-c976-454f-bf53-52286595dec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692698722, "uuid": "bb582dcd-060f-4f12-b8fb-c9bdd9125a25", "value": "34A0F848BBCF609398FBFFBC14A3B070F6E5C15C49877.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f3c7bf-40ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692694806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694806, "uuid": "d3b62ba9-87ec-41ce-8e1c-72948b76ab10", "comment": "Malware payload (Mirai)", "value": "e2711bf223dca28933c50cfcb3e74615", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694806, "uuid": "e5c73777-98e6-473a-a248-e77c1ca169c9", "comment": "Malware payload (Mirai)", "value": "34c4407bb5671c3dc2c047f4c4b6c64f883df0730cd9aec0cf26466d86b2f316", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694806, "uuid": "af2b2b03-f304-4841-a210-e53cc6e88ea5", "comment": "Malware payload (Mirai)", "value": "785bd1ae68c77323150edc577211c41cd7fc0440", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694806, "uuid": "a5f0a6ec-9a8f-4d81-b2d9-cd9ec635f099", "comment": "Malware payload (Mirai)", "value": "e393569701fe2db6a16f8d76f3c90af7d57e991455745c2a07b94aa132f4a848730a5e0fe6419203b057ba2891393a3d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694806, "uuid": "53365107-5f56-4855-bc6d-551e4e3ea081", "value": "T17C33F1B682ABAD71C27056F7162D549D64162378E3E5F00356250470EACB1F39AFE7C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694806, "uuid": "5498064f-f966-4bc1-a0f8-1ed84420b24e", "value": "1536:ICoqsGR4eB3g0Vmh1IxIpC8JqL9VE8amFZP7R3X:loqs2Twh6P8JqLJ9ZP7R3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692694806, "uuid": "59f5c6f3-a131-465f-89cf-de449d211a55", "value": 51444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692694806, "uuid": "fffc8ff5-3c68-4fbb-aa27-742a37703fa4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694806, "uuid": "7fabe796-5294-4a95-969f-f48419bfde6b", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4191ac-412d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692737407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "7b60a308-1ab6-4e28-8104-c1631ea101e7", "comment": "Malware payload (Mirai)", "value": "2d568bcbbeb1d6636e212a326cf20ec2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "bf2def4d-d1df-4b13-80e1-4e61bdd7ec48", "comment": "Malware payload (Mirai)", "value": "359c8c699bbe3b1fb338abc93403945747515a307a5bfde3de153d3056e427e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "06e5d861-0385-41ee-814f-5a9b71ad9ea7", "comment": "Malware payload (Mirai)", "value": "cd3415f48a44b2fba1f6f07985ad407cb70c24a5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "f94115c8-a28a-471a-84da-020c821dbdf8", "comment": "Malware payload (Mirai)", "value": "028a746c84564b00b96b2a3aed2d8878ed529adc076c3fd89f737d96ab548b85c9afae26bba60d66a64eda23c8254621", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737407, "uuid": "500e32a0-cede-45f8-b54c-c2801061536b", "value": "T1F5C2D170A2AA1CB1C6500533F7B85AC9BE570F7DE9FF3890124057BA3941D0629EA9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737407, "uuid": "e0f8caf6-507b-4546-be3c-2567b17c2e18", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEIR9hymdGUop5hc:AWsoTAZ3alkXLvFh8nNEIHs3UozS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737407, "uuid": "c5ef8c92-ce3f-418d-98d4-bb8aa1d60360", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737407, "uuid": "a351f38f-e613-4386-bbc3-28bf37667953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737407, "uuid": "45e20d91-2a91-4c73-b023-1635c399417e", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6179713e-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692693127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693127, "uuid": "131c7f9a-2bc3-4350-a29c-f67cd6bfab8c", "comment": "Malware payload (Mirai)", "value": "a55e22a4014a86f5ce59271364b859be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693127, "uuid": "590f9058-6db5-4ce1-9417-1f1f094fc8fa", "comment": "Malware payload (Mirai)", "value": "35a933bdb5d628bb5bb2732f4b4700493f6d4d8b23a4e4d75eb1eae16d374414", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693127, "uuid": "a53213b9-579e-40d5-8ed1-cc6579495fa1", "comment": "Malware payload (Mirai)", "value": "2ecec4c197792c13c14bd6f599bfbc718942ed0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693127, "uuid": "a4dead21-e501-4824-87fe-2028a0990c86", "comment": "Malware payload (Mirai)", "value": "49d32f6e49e749264858ce66e2e54370a9748c9715a88b2da801d273ba10bafe2f19596b5cef3fb21bc85228e762a008", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693127, "uuid": "60dbbbe3-25f1-4c04-91ab-9ce20c7a02cd", "value": "T152D31908FB50971BC2E227FAE68B428E33335B94B3DB7319493856B43FC5B694D26605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693127, "uuid": "eac1fef8-4111-43bb-a46a-20faf1411f31", "value": "3072:9DoqUnmN7al/d9XIbIcb+0SCRD0Mqyhk5/+didevM/90yuXRKU:9DoumBXIbI10SCRD0zyLidiM/9sKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693127, "uuid": "b0e1ea20-6963-4669-925e-cb74dd0337c4", "value": 138790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693127, "uuid": "493ca5a2-5b13-4fc4-a99f-7f8266e76102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693127, "uuid": "76751f06-1179-4aac-88e0-fdbae2bb667f", "value": "a55e22a4014a86f5ce59271364b859be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f261ea-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690508, "uuid": "65c1673d-2d30-4112-bdce-877f98ad8f55", "comment": "Malware payload", "value": "fc72bbb60376284689391c7bc049ea69", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690508, "uuid": "53507b4e-6d37-4809-8545-9d6de06f6110", "comment": "Malware payload", "value": "370d5e6c2737520fcbc77ad8953996afafb597fc01ce132cbd198fd05443b10d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690508, "uuid": "56b5630b-0436-48ad-9072-553c628ae913", "comment": "Malware payload", "value": "1289ee30677824d1fd895f503986e5856bd2c591", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690508, "uuid": "a2262f2d-d9ae-4291-a58c-6437cd32fd6b", "comment": "Malware payload", "value": "a8142e426759790dc482b48a53a198d6b79181ff363075a008424af567a577bd212c5505a9f521505a45b28cefa0a6b5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690508, "uuid": "86b3d59d-ee8d-4f32-b730-5a50d0baf0de", "value": "T13EE42368F32B4188EE95CE13E189C114FF3D9CDD21CE0EB5E3656E63A4E826862D175C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690508, "uuid": "bc1d5242-7500-42fa-b1d7-217b126606c2", "value": "12288:Av/TPabGLA4VZQlLUU1pt6YyFoA70nAJ2Q8CWFyDI2ImU:AzR2Lbpt6YyxzZjDzIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690508, "uuid": "367d23e4-3805-4bbf-9e31-2871ca5ebb8a", "value": 665214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690508, "uuid": "38d6562f-9425-4dd1-9d9b-940acea5286d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690508, "uuid": "5477bc01-b9f8-420b-894a-1c125d59b95f", "value": "NUEVO PEDIDO - CF0002.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b2e41c4-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720658, "uuid": "866efd8c-a3bf-4c40-839f-2cd445972441", "comment": "Malware payload (Mirai)", "value": "889dd80d95ba3915a3f3a7cce1db466d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720658, "uuid": "6207f25e-ce20-4bb0-b1e7-6ad20c4c49e3", "comment": "Malware payload (Mirai)", "value": "37b72e30ab2db6fc1c78b2cc40780899de2f20d7464b5d3be32304d08e65ae14", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720658, "uuid": "f0a98687-c802-4c31-bff3-1fa700b7759c", "comment": "Malware payload (Mirai)", "value": "31d57c47c06bd3f612d080c51116ec865355a1b3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720658, "uuid": "4878165c-9768-43a4-a9c5-47bd1b8235e3", "comment": "Malware payload (Mirai)", "value": "2890c970ed85d76a049a4da0a74f5d32ea7058170006cf7333cc8e1e3d7ebeba82f23592c330f65f63345fe7d8029ef8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720658, "uuid": "fd32eaf7-1327-4c30-a8ad-4768ea584fb7", "value": "T180C30945FC508B13C6C611B7FB4E428D7B2A17A8D3EE32039D256F61378B96B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720658, "uuid": "14e17b10-3dfe-4690-807d-1ccae1fc6421", "value": "1536:7Yw+rdAnap+1ZAN5jHR4VYumMTTVib3wTnX1budpL8lI5wywaFzhNKGWcrhjoW3A:7YAao1Zm4fmM/Vib3qbu3+VL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720658, "uuid": "675db419-61cc-4b6f-893a-7bc8538cd993", "value": 121600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720658, "uuid": "fcf83a51-49ba-418b-a278-3ff60f2344e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720658, "uuid": "b9a44cb9-cd73-4893-89a9-d9942b5a2e6b", "value": "concakhbtandhuy.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737bfc1c-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692693158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693158, "uuid": "14a752d9-2c23-4536-aeca-343c8ce97dc5", "comment": "Malware payload (Mirai)", "value": "f35704edef0ef3aa59fb4926b4ec4670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693158, "uuid": "9a49d969-31e3-4d6e-bb03-21855c327dea", "comment": "Malware payload (Mirai)", "value": "38f154373f342cc7042ef8fcbc4a2276d8afe7cfda016a7f5abc85df0e479cdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693158, "uuid": "964e3660-e414-4d68-80e6-beccf0e825ec", "comment": "Malware payload (Mirai)", "value": "2754c9400d736ba293a11f6c565a9d1a6a5d858b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693158, "uuid": "71e971af-41ae-454b-a71a-9d5ea320011f", "comment": "Malware payload (Mirai)", "value": "5d6c600ce5b389a28a3fae8b2450de6089bb038b7b31302bfb71a3135659168e9bbef10c9ff92d3481ca99240042481c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693158, "uuid": "e735f4f7-cad6-4371-ac34-1ba02ca1c377", "value": "T1AD23F755F241E776D18710B624F1EFAA8231F23A7080995AF7C52A3DFB62100D72A76F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693158, "uuid": "17b4a077-cba1-4dcb-acb4-ae0437a3b54d", "value": "768:ORQlVCfd/v0T8SJIfvm52z8yB+YPzshElKZ2RZmJOozV+FZX:ORQ6dv0T8S6fFI4KZ0GOocZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693158, "uuid": "a9ae7b9f-d15a-430a-8375-7df26747ebf3", "value": 47700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693158, "uuid": "190c7bd6-6456-4a2f-a840-6d0f79cd2ba5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693158, "uuid": "f001cf2b-ad4e-44bd-8775-049b9c998e6f", "value": "f35704edef0ef3aa59fb4926b4ec4670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884dbe0e-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693192, "uuid": "4aa0c878-a8cb-4ff9-bbda-0d999a3426c6", "comment": "Malware payload", "value": "56c3dcf16977835b1dd4f598ae9de7b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693192, "uuid": "bc26af90-ab3f-4683-bcce-da0b57faa798", "comment": "Malware payload", "value": "3aaaae223974f3e3dd58c1fa1700c943f05269a97416d428c29d5b9fbba03e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693192, "uuid": "aea842fb-8c9b-4451-b7c9-780226e4a9a1", "comment": "Malware payload", "value": "6f0d756bbe7e7f22a4e82b4524ccf36dffed313e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693192, "uuid": "9315d4bd-a29a-49b7-b6c4-3f9bf6a0f7df", "comment": "Malware payload", "value": "644c59ee953a5722d50b14f4ff4a94bf18078c210f5ea57a78fa5e8842ef7b1beeadea41908b323803bf7defcd921ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693192, "uuid": "f909e4f3-0332-40d4-b79a-95c13ba1f8d1", "value": "T16C438688FE69922EC7E172FBF70803CE373E1BD8B3D9B1265D35065173C8A64656A124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693192, "uuid": "3d75e783-dba1-4355-aeac-78474c02664c", "value": "1536:L9HOigI6iKNVQ2Nf1djgbUqlzVkWoL/fN4YV8w+:xOiC31djgAqlunN4YV/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693192, "uuid": "9dffc630-fe2c-4671-a257-75bd816f7ca6", "value": 60248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693192, "uuid": "868cda6f-2306-47b1-ad91-1f55b2728de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693192, "uuid": "10f6a765-e642-4f76-8cc1-1bb20f12c050", "value": "56c3dcf16977835b1dd4f598ae9de7b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cecafac4-4139-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692742703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742703, "uuid": "0a59ce46-e8b5-4e35-a64a-d0d00aaf20f8", "comment": "Malware payload", "value": "106f703d4fd4821c4edff1808f324672", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742703, "uuid": "2ceff9bc-a831-4d03-82d9-559fbcbb0f9a", "comment": "Malware payload", "value": "3c15a7f80b69e4a0d892616bb8bd0e417345f427a4c80a405a3dcf7ff50af655", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742703, "uuid": "4fc4ecc3-e177-4f16-908c-7290501210d3", "comment": "Malware payload", "value": "39370c62ec90ca9a059d8aaac5f234e0d6549219", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742703, "uuid": "235a0b54-93b8-48ac-8e15-2907b0e97a95", "comment": "Malware payload", "value": "c79bf21c6611f9be6f6b1084020c0b4fe5c2943848c5600e108fad1b72b40b9b2f8f70569b4880881b66de5636b2a476", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742703, "uuid": "4bfceeed-f660-4857-9a36-2bf2888cb817", "value": "T13FD104F90C975FC20B089D7B285DA88182F548938FA8B54D70FCA88D5FDD95E94B1878", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742703, "uuid": "bdd99f16-551b-4746-887b-5a84b56ab49d", "value": "192:0NRY1MpiEEiPCAQT5gkGdofr5jcucXywtuUhRbHtBvpP/A7f52lCleNUkDOR8:0TY1y+AQT5gkGdofr5jcucXywtuUhRbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692742703, "uuid": "bba2a889-96f0-401e-9e44-5414ec714c82", "value": 6567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692742703, "uuid": "7b7394cb-a326-45fb-bb33-56d487c210b3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742703, "uuid": "3e38329f-ce76-4b26-8e5a-d7ced758d423", "value": "2023_eSignature_Cbh_052474466_872203448824739pdf (2).htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f40e246-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725336, "uuid": "2beb6555-2c98-4107-acb7-8112e460c565", "comment": "Malware payload", "value": "eb2b01d9e0c2d3b47161a6bb972de79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725336, "uuid": "685bd85a-234d-4b07-84c8-303abe90cc11", "comment": "Malware payload", "value": "3c16b388b43a56a85026806cc346a20ded144b448ffb512e165746b5143dfb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725336, "uuid": "e3433286-ea86-439e-be93-7ec40823d13d", "comment": "Malware payload", "value": "073c200138b63eeaf28f14f3250d94fa9be4a20b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725336, "uuid": "a7699aed-a7cd-4850-b46c-842b8767315a", "comment": "Malware payload", "value": "89ba7af410fc30eadbeda85b2aef38a04f9407820b9c9e2f71ad480b1c167902df02adef1c5ea377d2dd0416c52e09e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725336, "uuid": "b66b25e6-6ffd-49fa-a95a-f9ab6f01522a", "value": "T117859F113781803AF56310718E78AAB954ADAD305B2498EBD3C83E795E707D3673AF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725336, "uuid": "97585a9d-6524-4b99-8c14-bf28de3d05c8", "value": "3643c3ef73d6a41aad5528939e41b2d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725336, "uuid": "87a69613-fa2f-4205-ab51-6396375c23ab", "value": "49152:0Vgk+c5iSEKRsHLtdkMw0XFErPHwOVadVrE2CFg96xICQ:Ggzc5i5KRsHLXNb42YgE9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725336, "uuid": "0bb491d5-23f9-4bbf-97ae-e1a2eea4e031", "value": 1731624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725336, "uuid": "e752b56a-1b8c-47b9-b99c-8227f0788038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725336, "uuid": "217e4673-d265-4909-8106-f80c33ccbf0f", "value": "SecuriteInfo.com.Trojan.ALToolbar.15506.30617", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "730dfc72-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690580, "uuid": "d246dd35-41f5-4dee-96cf-d8092d2cffbe", "comment": "Malware payload", "value": "d879ab4246433bfea879c5c9568cb0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690580, "uuid": "32747422-996e-47a8-bbd5-4fd4f38ad575", "comment": "Malware payload", "value": "3cf18715e4e52e503845221167ad276e90f614dd8142172d5a4a4f76b937bfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690580, "uuid": "ffc9524e-305b-46eb-8b62-cfd766384bd8", "comment": "Malware payload", "value": "5c296623c848f1aa61a59b641924d70e5e344845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690580, "uuid": "f43e9a9b-7a7c-4b23-bf23-dc1a8e998786", "comment": "Malware payload", "value": "4aad511e085e6923d9a00bff61478aac5f08bc5e94db67d195fa7cd74f015b8ff6f49e201224048f4e3f0ea634899ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690580, "uuid": "8d79f8f5-d045-48e2-b737-f12cdb228201", "value": "T14DF4125026BD5B2BC27B5BF996B1710183F604122563FBAD8FD120EB2B673910F66723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690580, "uuid": "51e1b12e-c3c3-4dd7-9d04-8f2af09f3bf8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690580, "uuid": "6c1a512e-7432-4d17-b3c6-fa3323c7eff6", "value": "12288:WrKh+xGb/8r7l+IF6v3Xubq4G/qpAj6qXB4drFaJSoMOQLZVikPwt03ZPC6VYxzU:Ph18rZ+Igvb4dpUx4XCZMOuViPt03Z6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690580, "uuid": "86cbac00-6f30-4955-bfd4-e35a1d76ef55", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690580, "uuid": "46061684-88f0-48d5-b068-1cfa62f1fca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690580, "uuid": "bf0d8d21-3505-4527-bb79-26beab43f10d", "value": "Maerskline Invoice_K22TSI7191.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef6df67-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689795, "uuid": "ad057242-4fdb-4d03-b663-0e333bd0c379", "comment": "Malware payload", "value": "c28a737f17aea64ba40c79ee334fb81a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689795, "uuid": "984958a2-2077-4019-9ce9-586f121a817a", "comment": "Malware payload", "value": "3d9859ea552a73c7d9a56c5d1f4284bb9a7bc555daeca4ea5ba4c75533364d33", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689795, "uuid": "eb5d6ed5-1f34-40e4-83da-b12572066b33", "comment": "Malware payload", "value": "3d3bb5facc1986a87915df61f0b76301d6502574", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689795, "uuid": "9cbe3392-812f-45d2-8fa8-fb5f95b89420", "comment": "Malware payload", "value": "c91a20b9847a6bf46c54f7f4c9a91251e6707c3002e5020d975222b6062ed48740a20f430c3422ab11c9464731012772", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689795, "uuid": "64b147df-5a32-455a-94f6-ea36080cae55", "value": "T191A3AC68D34F02A9CF6253779A271A4481FDBB7EF64111A5306C537933EEC2CA1262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689795, "uuid": "d524ffbe-5a09-4e3d-a36d-abac358ff58d", "value": "768:CwAbZSibMX9gRWjYUFlAMDoZ5i2mxPrEy:CwAlRslAIPPL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689795, "uuid": "e530bb06-d126-493e-af9e-d4e2cedd0b68", "value": 98496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689795, "uuid": "005f8bb6-dfc0-49d5-be3f-3b8912896781", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689795, "uuid": "88bd9361-748c-404a-9efa-9a090c725023", "value": "DHL Receipt.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6221b16-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692728944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728944, "uuid": "8ed4ea0d-3e86-4382-a5e6-ce57f521d55b", "comment": "Malware payload", "value": "f5f312366ca15f26232a29ab10f1b1d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728944, "uuid": "707d1fbb-4c44-4722-a1b7-b3dcda4ce86c", "comment": "Malware payload", "value": "3dc213072359870805169cd82a6eb975e17ca6b6141fb126e0e2984a7433a6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728944, "uuid": "61e243b3-2f27-4993-b1d1-2645b56a8e01", "comment": "Malware payload", "value": "c22412c56967f1e3ea99e3724f9d4ea5fb3b2e90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728944, "uuid": "212489d2-9bb6-411e-a1c5-f80c7ac6b5b2", "comment": "Malware payload", "value": "a8156b1cbbbd7479e22666836ba42ba516f30bf43b6bc2cdd206b23a2e8919abe821f33889440be0dcffa6f26327c9b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728944, "uuid": "259b2420-f4eb-48a9-8e28-6a6382a0b143", "value": "T1A1C4021D9A6B6F9ADEAE43FD6922600413F3D016E772E66B9FCC14E91F17B848640313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728944, "uuid": "0fc8764f-55e1-4776-af38-e0124aa28909", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728944, "uuid": "ef4a61b1-9316-4bad-8c00-1921273edf70", "value": "6144:hdxD+AVN32esAHO8QcEUkcJcFn/2dlsd8dEUmBhSA1VyiTsng1BWdFv2R29WJlVn:hOAV4LtUkAcF//adEMAeQm6QdL9OcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728944, "uuid": "fd86ff66-a553-4827-ab27-ee7586a7a814", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728944, "uuid": "0b10ba41-f6c2-4b2d-b39a-ca143a9cfe00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728944, "uuid": "fc9bbce4-9e7d-499f-b1cb-d1e07f304d62", "value": "SecuriteInfo.com.Trojan.PackedNET.2292.29179.10026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d888d5d-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MassLogger)", "timestamp": 1692689738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689738, "uuid": "e8f05418-ca1f-43ab-9594-58347c551bbd", "comment": "Malware payload (MassLogger)", "value": "f59f07ee8a94503436d91356bec3377d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689738, "uuid": "56f2b91c-e92c-4b37-9625-86057b4d9479", "comment": "Malware payload (MassLogger)", "value": "3dfd94bcb9747aa71ec9e14f476a572f85d70ce1ad2d7170efb4e226f862bac1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689738, "uuid": "fb9f7160-39bf-47b6-8ed5-8c441c4be7e3", "comment": "Malware payload (MassLogger)", "value": "2c41fedc912f56d34eb346ae3387cae769b9e037", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689738, "uuid": "b4cf8093-74eb-4939-96ba-5df5abc1c3d3", "comment": "Malware payload (MassLogger)", "value": "87129ee0f4bf314523f318bd64d9c4e6f97ee5b54f738943e92ca273262cc2d3386a545c37354f3d2a2382c353657d66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689738, "uuid": "9ebcae3f-0a94-44d6-8dfe-f73f984566c2", "value": "T1E5341200AB70D4ABD4B324721E7EAD9AADB6D53384FC0F4713249798FA755135A2D323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689738, "uuid": "5c79587c-090b-473f-ba48-710defad23aa", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689738, "uuid": "692ce64a-b611-4e0a-9b12-d2be6689ac96", "value": "6144:ZYa6MXvmkmNpKIR5qt8G5+jE2j/znEEDRkmx2SZiyvcWBm+Wlja6uK:ZYevmZN0S5RI2LDR14SZlm+Wlm6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689738, "uuid": "3c926150-baaa-4bc2-a95a-f0318a6de892", "value": 252981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689738, "uuid": "98056f42-8c35-437f-9c44-b22886437050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689738, "uuid": "09996d79-7857-4f32-b5bc-b713c79616d4", "value": "SD09756789098765.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce8c5a46-40f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Sodinokibi)", "timestamp": 1692713926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713926, "uuid": "057352ef-6a40-4ceb-99ec-a9f9586deb8e", "comment": "Malware payload (Sodinokibi)", "value": "ff1f6956f07e700a86b5986b63ea12db", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713926, "uuid": "19a8014f-08f0-42fb-94a7-3ef235fa5a77", "comment": "Malware payload (Sodinokibi)", "value": "3e6fbc358e0204cb67a41b05771fac74f1b49737c7ab7138e415c7e9628ef545", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713926, "uuid": "f8e2a56c-7c79-4b3b-b147-b54e05a4cd75", "comment": "Malware payload (Sodinokibi)", "value": "a8d88813f2691cf71e8d6790e473593644c913ed", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713926, "uuid": "3e39be71-9790-4409-b048-472d58729915", "comment": "Malware payload (Sodinokibi)", "value": "df44a3ea9ed289c2118c7a8431f9c43f0bcd94605fbe530ee35e1bcd36f4f26c76f15d1611d787d5f58f0bad8eb565a7", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713926, "uuid": "8fc1b62a-3995-47d0-bb40-75a2873c7663", "value": "T11EC3CF33EC9003B2CD83C1F2132E6E579EBEBD34161524A6E3258A454F760D2AE1B75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713926, "uuid": "8ef74bee-df5d-40b4-b612-17c9725f8416", "value": "f3d46e2f8717ced6d4b220e65d6ad18a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713926, "uuid": "272da93b-1841-4dc3-a9ba-2d89bba11b6a", "value": "1536:YxOUyl20w8bVZQ40iMSO1fY+iUyQs2r8t5p1ySotICS4A6QdZls8XzUXiWr4X5Fg:YMhQNDEtb3A2ZHjUyWr4X5FTDUA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692713926, "uuid": "2da266fb-650d-4519-8d55-86d6f4632bdd", "value": 129284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692713926, "uuid": "6b634db7-c4b5-4de7-b467-ff83deb60c96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713926, "uuid": "9ecd5971-515a-4c90-a7ca-87ecd6680522", "value": "revil_fixed_I_think", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcf07cd-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692693145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693145, "uuid": "8c2bb753-1f0f-4832-8589-0b97f95c94a3", "comment": "Malware payload (RedLineStealer)", "value": "cb990bbd972b9938ddc9efaf80abab21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693145, "uuid": "4fa82b72-6b95-4eff-b78c-bf60b75c0b44", "comment": "Malware payload (RedLineStealer)", "value": "4004e75b14a77bcd4a33f8d518522d13242180509e26a05c9217bd621fe20c7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693145, "uuid": "d9b10168-dd1c-4652-b463-0f77a3784f3b", "comment": "Malware payload (RedLineStealer)", "value": "071e41e22a3a8f24d0987214aac496089013c743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693145, "uuid": "8b4096c8-a1ee-434e-a49d-fb20e1ae0106", "comment": "Malware payload (RedLineStealer)", "value": "21526752cb0f0da0a8d24c6b90f3664f14220548153e4a3eda9d0c7cc137b841bf4a65c3087b2b3f39dd9f9c97b68844", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693145, "uuid": "7c53e8c4-174a-4075-aec0-2cff6337504e", "value": "T100854A3139B3952DEDE210B646EC6429426CB0630BD819C75DC8B6EE875F5E22E33DC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693145, "uuid": "8b08a09b-ede4-4f20-8b54-9fb7ea5bf402", "value": "7ca28186d68c9a22a0e816e570aac96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693145, "uuid": "13e04b6b-472d-47ac-b9fb-080763fc712c", "value": "12288:ZJzhqGapmwMggvYOR8xjN9cDUtmRxpAvAE0veITSrteJPzQ3rV/JGECn+UMJuQH+:N9LvYOaxjN9cDwtGeBrV/JGj9GAFW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693145, "uuid": "ca1d6377-48aa-496f-b19e-d32ad9f2adbd", "value": 1711616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693145, "uuid": "d0002131-a41a-4f7c-955d-f224af2c5ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693145, "uuid": "131be89b-365e-4a33-9810-aa13d9f19c27", "value": "SecuriteInfo.com.Trojan.PWS.RedLineNET.7.31605.26624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86318f0a-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692689753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689753, "uuid": "b2b54aa6-d305-4b50-b861-419de2a8a6b8", "comment": "Malware payload (Formbook)", "value": "5292d77a5796360358f012d31f4cd438", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689753, "uuid": "b7ccefff-676d-4e1f-ae8e-06c33c586160", "comment": "Malware payload (Formbook)", "value": "404f0f676d94ffdc3cc0b4422a34a5aee31d06c815253ba0e7aeb0fed3905b9c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689753, "uuid": "7f308694-04e5-4758-92b9-dc22611ba0da", "comment": "Malware payload (Formbook)", "value": "ceb7009b833a4829f9017636445a07ca201a9db4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689753, "uuid": "e7496962-c02b-48c0-aa9d-4a800633f067", "comment": "Malware payload (Formbook)", "value": "51e04b3e940f9ace8d77b845cdcc6becc7f9a51e8197f3f02cf9370c13bfa1282539aafbfc8d92cd648c2b8ed47e46e8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689753, "uuid": "adbac277-4f59-42fc-9140-b852e6080e42", "value": "T12793AB2D934F41A9CF521377AA1A0E4442FDBB7EB78152B1346C837533EE82D91262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689753, "uuid": "ea1eafac-ca43-4069-8603-2dbcbc98d2b7", "value": "768:kwAbZSibMX9gRWjQOX1eDp9haTtsZ+Tnkfas:kwAlRxu1edzaT+Q1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689753, "uuid": "9e4a4894-ac16-40ba-b6c3-b08934761188", "value": 91029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689753, "uuid": "9c66008b-519e-44dd-bc28-d99e7531ca71", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689753, "uuid": "bcffc96a-acb8-4c1b-9e73-f28b5f590e46", "value": "PO-384728493049.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc5dda1-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690490, "uuid": "7f7e8b6b-0763-46db-a5fd-4612a1b1e310", "comment": "Malware payload", "value": "dec730b27ca90b591389d2ad82dd4844", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690490, "uuid": "4964fedf-5b91-429e-85df-2f1527ac3a6d", "comment": "Malware payload", "value": "408a63fd345ed4843e072cb5bd074934a17d5b69b99ae73290bf0e3d11897556", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690490, "uuid": "a0607123-8fb8-4f42-9a67-30daf6939a78", "comment": "Malware payload", "value": "a80a7b822148b2f5dc6aa85c9f51d609816fffef", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690490, "uuid": "dd980271-0e1c-4546-8b69-92c6eb2b1c48", "comment": "Malware payload", "value": "5d8e0346d1a9d24794926e5295d5ae4227cdab69b79796eefa0aaf3205c70d843284076f9e922840475f4235079437a3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690490, "uuid": "3eaf6218-86c3-422a-8817-e3abeb619773", "value": "T1F2E4338F795211068E42C9A9BF301F1B542AE8E53C4D47EEB253BC6EC72B489F3446E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690490, "uuid": "83a170e4-3cad-46f7-afd4-026b82017ad4", "value": "12288:wB0rtHI8OWJwM46ZX0phJJGReL7w3QW1cU+Q8YgHKLj2X+hHzpdgzD17:wB0rtNu6e2S8391cUZ8Fqn2XctdMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690490, "uuid": "4dd26357-c224-4ca0-940c-99930a89219c", "value": 676203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690490, "uuid": "bfc9b99d-1762-4495-976f-81b8e0374e09", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690490, "uuid": "0c7fabbe-ad18-4e7c-8a30-79c78ed65ca6", "value": "xxxOrden de Compra 20181##.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8e0f99-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690514, "uuid": "a870d1dc-06d9-489b-8e47-4f94682fa32f", "comment": "Malware payload (AgentTesla)", "value": "0b627e92f3cf551dceb23f4dce3e6177", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690514, "uuid": "85aa1719-2636-4a5f-b562-1b4d90f2e217", "comment": "Malware payload (AgentTesla)", "value": "417d38f0078a18cb32f4c47f31d73b9270c7f143ce3813be5d4fec3367792962", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690514, "uuid": "aea653ab-d2a0-49c8-8517-defc484e84b6", "comment": "Malware payload (AgentTesla)", "value": "27de2dd94b4f341cb7818fd383b05256a2cdc0eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690514, "uuid": "b2cbc762-715c-4366-b161-b8b64bafb439", "comment": "Malware payload (AgentTesla)", "value": "c403486d3c134328552bf0ace481a881c08a396ca7ceded187931d12aaa0e9305e8c83c88a75eb3e6f977ab77689d84b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690514, "uuid": "565330f7-768d-4fd0-9fc0-70415539d998", "value": "T172D423B1667FC79CDA256477FC00A2D46F8D982CF40A49DF5025BA9D0F8DEC9E00AE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690514, "uuid": "2a96b0ed-b8ae-470b-bd24-b20d39d0cac0", "value": "12288:H1nWkycUfXk3a0sTgZOLZeECqSyOpzKbjfyt7DmCRT+Vb5uHxK:VicUf03HYLIEmpOPc7LqVWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690514, "uuid": "f15b903e-4a10-4953-92bf-fda85402c73f", "value": 642782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690514, "uuid": "f219d928-0a35-4ef6-ad26-88037298eaa6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690514, "uuid": "e8605c4f-3514-4af6-aef2-91820719f9dc", "value": "12V100AH LFP battery.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eeab9b7-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692693123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693123, "uuid": "3e4c01fb-2f11-4b95-84de-d263fcd6f23a", "comment": "Malware payload (Loki)", "value": "22bc409a1262d97b5f1cb8e85bccd6a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693123, "uuid": "3cc923e5-d4f9-484e-a732-147593792729", "comment": "Malware payload (Loki)", "value": "41806b559cc3d4245a5e2caac6f1fcc88684f6a4efe33c0d7665e137f2864c96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693123, "uuid": "c6350390-c7f6-4621-aba4-152729b4aba0", "comment": "Malware payload (Loki)", "value": "74cd5bf15abfb69eb4f823107726841866e581d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693123, "uuid": "f0ade200-ddd3-42bc-8e3a-de35ad28fc26", "comment": "Malware payload (Loki)", "value": "c1ed3c1247f4822df3b2ea491e2b20330221f0d1a4d3d16519d867eae908a43cde83f7ff7b4544bd5c7cecf39e0dd5d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693123, "uuid": "160d1cbe-9fe9-4d61-8a68-fac3f5e3cedc", "value": "T11744BF22B7F19432F12386318E66C3B45A3FB8B25F66A6DB27854B3F09741D1CA75312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693123, "uuid": "671c842b-12fc-4de3-bf95-f0bb23908a4a", "value": "a58360eb10a18d5dc70efe7d39616fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693123, "uuid": "fcb003dc-1cef-44e9-a616-b5d0d184a071", "value": "3072:ggfE2iXsetoLlYt5lVNCsyvitbFIgtQW8zOMmYqI4EmirgWSw0U175D0Ri:p8shly5lVMPvitb+W8zOMR0S6iVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693123, "uuid": "fba96ba2-2de1-4745-bca9-b939cb5291fc", "value": 263680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693123, "uuid": "a841f6b3-ad0a-4f92-9249-7d4611931c25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693123, "uuid": "ee933b71-7b3b-4a57-812a-37f870212510", "value": "22bc409a1262d97b5f1cb8e85bccd6a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910d9790-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689771, "uuid": "9a29a734-9696-43eb-bbd5-c289ece7ee0e", "comment": "Malware payload", "value": "8345f5f832ccc46e0907d1554e7d6d34", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689771, "uuid": "aff96cc3-eaf9-4d73-81b5-18b6d4acf0f0", "comment": "Malware payload", "value": "41b972caddc035b290530a4d91da5570be040bb02ce9ba7f9cd648f9f936562e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689771, "uuid": "786eb610-f783-48d8-8508-ec9b669dbfff", "comment": "Malware payload", "value": "c3b48bfe714a7f4c51bbf07afab3e46aefcdf7dd", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689771, "uuid": "a08f91ec-903f-4925-aa04-5c8003506b92", "comment": "Malware payload", "value": "0a4dbdde9c70bb7a13b155e02cf72770b137814649af023590277f1e62b09b6fb99b31707219dc9819b798199a7922d1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689771, "uuid": "ff489978-7f59-4b06-8685-8326a743ae50", "value": "T11A7317A2B2D4D80ADA4807354CEBD7E63B36FC159F66834B3284F72F2F357908952646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689771, "uuid": "d6b821d3-95e5-48d3-a9dc-c1d613f7297a", "value": "1536:yLxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAdGkNYngPz5ZHeT7DmvGKolgIxvPy:yLxEtjPOtioVjDGUU1qfDlaGGx+cL2QT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689771, "uuid": "11fc1b52-5bdc-4d61-8724-36f037eaafa5", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689771, "uuid": "cc3bd80d-a6da-4752-8e32-abbcdddff3cc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689771, "uuid": "7c74c73c-83c9-4af8-9091-01c40462c2ef", "value": "Receipt.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a202b2e0-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690659, "uuid": "f1d2f5b2-d6a9-4973-8ab7-cce2c0f8ca4b", "comment": "Malware payload", "value": "d426575287164bc39618ed17b879d77b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690659, "uuid": "67921c30-a082-44e5-9216-fa646c75f77f", "comment": "Malware payload", "value": "4294a30ec880ba51c2b696852ff9e5688012b0f22a7813261e8c833d2cdde081", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690659, "uuid": "032692dd-5ab5-4fb7-abe6-d07b798f1d06", "comment": "Malware payload", "value": "b9d4b2d3e65a6d7d770ab6fded5b9391374c2d94", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690659, "uuid": "16522fdb-3dfc-4f3f-9713-5aac4c7e75e0", "comment": "Malware payload", "value": "eea7fd6c300d812d3535fd6630b187142084c2872799137011ec90e78b78303c77709adb1a8e69f2eb8375a76a78c75e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690659, "uuid": "bb7f52f6-02ce-4952-afbd-1189668fa1c8", "value": "T1AAA4126F3FCBD478DB076036900084A6971EB0A4B157116F5BEEAA9A0C70DDC1B99DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690659, "uuid": "82b1fba5-c545-4a3d-974f-e26fac7e5122", "value": "12288:98QlP+9NW32j29pBucycBSvwznel8YGbQnBeHh7P:98YSjyFBSIztQnBkh7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690659, "uuid": "ec6f7c9a-095c-4543-8dcf-ddd2ff8af90d", "value": 456251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690659, "uuid": "d4331f74-11ef-48f3-8b50-1ebc67aa423c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690659, "uuid": "4797afe3-6589-4fc1-bbce-31a45bdc5d54", "value": "Invoice no17684.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a65c0f-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690527, "uuid": "b82de427-64b3-490a-81e2-2ad3fb2b665a", "comment": "Malware payload", "value": "56cdaacd1ad2f15d39329d2228faf410", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690527, "uuid": "9fb02391-e4c1-4a9c-ac28-371f10659b68", "comment": "Malware payload", "value": "43042751e19dca0c882b05dd29e02a1b4ed2453f8c482f016054256690788df8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690527, "uuid": "9f966e05-1b95-467d-8129-5483fffabdfd", "comment": "Malware payload", "value": "a458ff2092cb22bff8841d099993a693481f893a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690527, "uuid": "8685783d-cec0-4393-bd0d-b73733755328", "comment": "Malware payload", "value": "c35bcea46c67c37770b0856d97976b67fa79d69b9737b17cf9aff858eeaffd77b8874a21a539731a4a3da7706346dc83", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690527, "uuid": "542790b0-fbd7-4655-a253-ae39c306ae75", "value": "T1EA745B1E4DC033A59BB4000980AFD25371D6A7C570B5D46FADB62BAEAF2162DF0396CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690527, "uuid": "e6ea5616-f22c-492c-bc97-0e56cf84d811", "value": "6144:qzIw9dIB6UmEBa7ydz8fy3h51wVhlC1ZuSSQxIEcoYVidGQKL9PEAJ:8laN8q151wVhwLSKqs1YPEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690527, "uuid": "aa2091b9-d09c-46e0-ab14-6c5fa3acc7e9", "value": 363132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690527, "uuid": "1e5c7f93-4f5a-4091-8cd6-a4061466cc34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690527, "uuid": "52965812-9918-4260-a7d1-902d2e4b1c47", "value": "File.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed80d96b-4129-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692735882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735882, "uuid": "b41069c7-b076-408a-a5c5-c464d875df31", "comment": "Malware payload (AgentTesla)", "value": "02f0f8710d2c7074a50c2bccea68755f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735882, "uuid": "a7926ab3-1cc7-4314-8314-1b6de70edffb", "comment": "Malware payload (AgentTesla)", "value": "4518d27e5b9109b044c8dabfa242bb224be62ed58111701c1f5e9fb7ed189f11", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735882, "uuid": "a8cd4df0-3d56-46b7-bd38-19d636cef490", "comment": "Malware payload (AgentTesla)", "value": "5a1221b385d7d0b16d481b9ed5c8ea95abe8048b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735882, "uuid": "d78bf74c-0b09-4672-9173-acb147fbdfa6", "comment": "Malware payload (AgentTesla)", "value": "41be1d54147ae6db6bacea3af91f782bff9809fecaa0eedf8caded2f01fd13e63567956cc05b9788187cbe86711e168b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735882, "uuid": "4d6bcaf9-f67f-41e2-bc67-648b9fff79ee", "value": "T181250227B1A9EF05C7BC83F150512F8423AB41CE2176E1384D96A4D7B2EABD24E525F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735882, "uuid": "9e05d57a-ffb8-46e6-9d71-83c3f7580ffc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735882, "uuid": "fea9c911-a3b6-4273-b8dd-df8cb08344cb", "value": "24576:ISqlCe9qhJN0SAvZEqIjJN+gOAWRMNDSL9S4tw:elCe9qhJN03DIjJkgbWEAkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692735882, "uuid": "2283e55f-d5b0-41b8-ae8a-dd908cbf22aa", "value": 991744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692735882, "uuid": "0be4e91e-a99b-4f74-ac14-0f5e154a6e30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735882, "uuid": "5ac5c8c2-c72c-4ac6-975d-408972f57625", "value": "TEKL\u0130F TALEP T\u00dcB\u0130TAK SAGE_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4d629a-412d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692737407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "2b966c62-2a13-4ed2-b9c4-c026c8e4d52b", "comment": "Malware payload (Mirai)", "value": "f53f4aeb67fd47d0f0cf9b5232de9a82", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "1eb85e48-348e-4508-9238-2f2dda7535c0", "comment": "Malware payload (Mirai)", "value": "4585def4fba5a971d358569316252284432366aeba63431b768fc8f112f1b5c8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "1e48f3d3-6f73-4b71-9664-4bcbd76d4440", "comment": "Malware payload (Mirai)", "value": "1b1468d6e1c48ec33f7d88b3cdf136af5d8fc492", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737407, "uuid": "8bd6ede4-e30e-4f25-8a31-1eb9830c6be8", "comment": "Malware payload (Mirai)", "value": "3146618a780f4d78a6eaf012af1c3d17af818872ba03541304d4455883459269ce43eea23b9c29db7533e2a265d4b527", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737407, "uuid": "5f4e3edb-747f-4a46-8645-f9c56b1769e6", "value": "T1A0A2E12572A32D65F3E91C3CC96A8357B9670BFC90F6327679415621C94D20B3E38A4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737407, "uuid": "d4edeffa-fc36-4c7e-9b31-d9ce11711278", "value": "384:xvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjOYvEhymdGUop5hY:xvQn4j+ZO5fKAlxZMs3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737407, "uuid": "9827f876-c7b6-45bb-a135-faf00978238b", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737407, "uuid": "bd253480-ef6e-4357-81ac-dd6e2caa8915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737407, "uuid": "5e8cfac8-4495-40bf-923b-c5744e8518d3", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed18423-410a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692722409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722409, "uuid": "be9332c9-2c6c-4f11-9d04-22a5f5176e8b", "comment": "Malware payload", "value": "b21b7a7c3470ec539fbfb187a361c894", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722409, "uuid": "e9010096-386f-42a1-b2d6-bec3f3b026db", "comment": "Malware payload", "value": "45a65ee5cbaeed0984d4be556b53ef8c90812de58fb2602422b5187e285afd6b", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722409, "uuid": "41f7b79a-e94a-4846-89cc-d9fb0fe71601", "comment": "Malware payload", "value": "33fe3b6442f18b3c6558530d94c79f5c8b711ab9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722409, "uuid": "44d618d1-3cb9-4797-b385-170d94043f61", "comment": "Malware payload", "value": "999888233b548cf730fc9b9e639fcb6744d72b97b66502071a9889a34bfb67f250513a9b851be16cf305daf1780b6298", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722409, "uuid": "551944d2-eb33-4b7c-85bb-d046c37abd4b", "value": "T11C83F1172F14C461E7E30F3885F19BA895B9EDC16D53EB4EB466334E35B9A082E0B714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722409, "uuid": "264bae97-44c1-4870-ab77-afddd37150f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722409, "uuid": "d8e5c1ac-c6df-449b-b787-141c93589016", "value": "1536:QJabrK0uBgrdB7Kgql2UlsrfMdmvorGrl/bfkBfdfgZU8UlF1lV/OxQi4tt0:QmuBgquU2rfnGGrlzvO8Ul/lV/1te", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692722409, "uuid": "c083ddce-348e-491e-8f86-5b1ba2815c36", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692722409, "uuid": "2315d717-ae54-44eb-9426-90b424ad412b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722409, "uuid": "524c1c6a-ee8f-4e1b-9f5b-7aadb30e4052", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec26f1ec-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692704527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704527, "uuid": "abc6fa74-8192-469d-8e51-1863ba342730", "comment": "Malware payload (AgentTesla)", "value": "751e7f509ab83302358d8ea9f8ab49bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704527, "uuid": "81bd5729-e618-4f65-9b43-979fed4f9576", "comment": "Malware payload (AgentTesla)", "value": "4844ecc408afe476195c13a782a5b3f175f63c5cfbcb69229f45e0713fb33c59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704527, "uuid": "b4712aa1-e373-4996-9a82-3e21ce23f744", "comment": "Malware payload (AgentTesla)", "value": "89604ab5366e9f571e79c27055a33b39f1c392d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704527, "uuid": "47f8576c-455e-4afa-97ab-7ca1c095fa14", "comment": "Malware payload (AgentTesla)", "value": "4b5aabe151b63134f3f42df3bfa073c94b22e9ed7dbc182f11e35f596c7b635435a38b37f2280594557f816f308f5d90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704527, "uuid": "af923223-cbbb-4da0-bdba-bd6b05964218", "value": "T15405D08F56F35FF9FA46593EF3485972BF135A8452797DE2AC030D085AD0E88262CA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704527, "uuid": "d5efb0d5-4115-4c23-8c4c-5e819b3ffbca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704527, "uuid": "64e8957f-3d30-49a0-aa6f-fdabe634c963", "value": "12288:rprwOG8YLtv1/8tVdK6DPhTAbnQb6sJmuw+iuajVTRnU4lG5YOUOp3FmytGTUPja:aO8FJMInnxFuNoBCO4UUPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704527, "uuid": "7aa9ad7b-784b-4f86-b225-875d930bcb5e", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704527, "uuid": "5085e0c3-2daa-4e22-95b6-8cd32d27e28d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704527, "uuid": "97cb4faf-002f-4a1c-881a-1fcc88d66129", "value": "SecuriteInfo.com.FileRepMalware.19572.18695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45bf5862-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690504, "uuid": "51c9758c-a283-4c8e-8c43-d494d50b47ec", "comment": "Malware payload", "value": "fadc508cfeed80ef0fcb11eee7dc9339", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690504, "uuid": "ea5a2063-3be7-4440-8c33-cf8bfafad923", "comment": "Malware payload", "value": "4893b2aa4ddda6036d76e34e8fbbf5bd5d10543e2d0abbafee7088dd139fe5cc", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690504, "uuid": "d62f947e-2bac-40bf-aa12-ac885f731e0a", "comment": "Malware payload", "value": "f0ab7c3903969dd2353574ecdf23054413297459", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690504, "uuid": "ebf79fc3-c041-4f28-83cd-873e5c76b9af", "comment": "Malware payload", "value": "6637422554f85b185784238a2b0c05d32a1420af454ba2554d906b6e885ab4b8d7be12327dc48d235c42905f5cf1559e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690504, "uuid": "506c1088-a9f8-4603-b8da-78b208ec72e3", "value": "T153D423C79D03E24FF358CA3BB45539D6540264D3359E03D6A1BEE5866CEA0908CA6BCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690504, "uuid": "674f14c6-2929-49dc-97cd-b985ed0a0eef", "value": "12288:eSVg+AmP3wnM+56iu3W7hhckEZo94+Fi3L392txVYyVFH7DKd/:e2gpi34h56pChcdJh80qFH3K5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690504, "uuid": "f6ed4dbd-932a-41ca-95a3-bf19d09f2f9d", "value": 625965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690504, "uuid": "3b4cb0c5-d677-48ee-97ae-4740c81ea37e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690504, "uuid": "fb5c7bd3-2c5d-4f22-9bf6-f9a0275ba51e", "value": "Order Request.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3206dd05-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690471, "uuid": "8e26e36d-2c8a-4471-8aab-172bedcb8034", "comment": "Malware payload", "value": "24b195342d2d7cd36ad43f0beb8432c4", "object_relation": "md5", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690471, "uuid": "101cdbeb-65e9-46f4-9740-b6a2ebdc0a11", "comment": "Malware payload", "value": "4977040fa9bfebabca090e00dc6165e48f28b4851a748215f5f05627f407005a", "object_relation": "sha256", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690471, "uuid": "84569d17-b16b-4da3-b8be-4fcdbcdb2416", "comment": "Malware payload", "value": "a66629cb2e75b8b84b91c0c645ad0067b0f0aa46", "object_relation": "sha1", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690471, "uuid": "6dde3415-2bcd-433d-ba8b-3a76d89ba79c", "comment": "Malware payload", "value": "e446dc08ba30fbd1a37ab584aedc0abbe11a6a95ee8fb7d4123d9df0055f90f19059ca90903578795f286113636e955d", "object_relation": "sha3-384", "Tag": [ { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690471, "uuid": "c431116b-2acd-4a4f-b01c-d8ed2d824f1f", "value": "T1F3E423853997790FCE9938ED32C4594D4DA3722732942E1F49FC884D9AE91C4323DAAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690471, "uuid": "b62eeb1c-c5e9-43d6-b34e-cbb9d44019cc", "value": "12288:48d26Z/+iqMFtn0skBzL/MVFivRyKds/kwX3mzSAcpAFitVWXDv5zW2PVu:n9pqwn0skBzLEVFgwKds3HmzSLAwwFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690471, "uuid": "3e4772bb-3b05-4d8e-8268-ea5c42c63c10", "value": 659790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690471, "uuid": "f8863adf-eee2-43e4-8a61-1bf925db978c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690471, "uuid": "5f0e2525-e375-4358-872f-3fd90d4e697c", "value": "OC.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44048eda-40e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692706392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706392, "uuid": "69b314ab-f9d1-4db4-8ce6-44cd4372f998", "comment": "Malware payload", "value": "0fc9600ee3eae56b0d81fb4560cb0146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706392, "uuid": "db394ec6-7214-45dc-bd38-2ffd3ba8cea4", "comment": "Malware payload", "value": "49b2e08cf7fb9bceaf2721ef24c9ab795c984403c258af9df3914dee1f3225a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706392, "uuid": "89e8aa69-4e3d-4f57-8a19-71e4c8be7d70", "comment": "Malware payload", "value": "5b537332965f41f4d9abb0219699fd3b0072a303", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706392, "uuid": "fc5530b1-6cd3-4e41-8432-6955753a097a", "comment": "Malware payload", "value": "3f9a4add879c3796a1904375c8277c6437251dfa04e54311970bddeb43b9399a5765e9fbbddbe9a915f061b8aa128d25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706392, "uuid": "7968f8e0-4f48-4af8-a6a4-141ab49b91cf", "value": "T11EC423B2B64BC54DE1F8C3B4910455E53FB5230628BFB0B90D7AC216B9387C674E8B66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706392, "uuid": "eb591eee-7f77-4356-b047-4a6032a01cbd", "value": "12288:F/d6aGTEgIWwwxNF47y3qNFPbkPMqD20ewIizq26j4CZMk6/:JGgfwxNi7qqPbkPMqD20X36j4C2kW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692706392, "uuid": "1a5736c3-2421-4c51-8cbb-bd2891d06a76", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692706392, "uuid": "80ff1f64-45b0-4f01-aaf6-e7b087fd8a83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706392, "uuid": "544e6af1-15e5-465e-8e37-149ceda57a9b", "value": "TpuLrsiSQ3light.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64079ba-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727227, "uuid": "49882d54-63cf-425c-b250-39c33a8cbd8a", "comment": "Malware payload (Mirai)", "value": "6d68e92c217a54b4b9bf349820ca16fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727227, "uuid": "9262aa06-d297-47b7-aba7-799f2613d2fc", "comment": "Malware payload (Mirai)", "value": "4c05a3789c423924154c656b59f2f9b2d1922b4b2e3db5de7fd379b0231a3d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727227, "uuid": "a9982071-fda1-47e9-ae41-6f04dd83ab2c", "comment": "Malware payload (Mirai)", "value": "e1bf997623e1fcd6051e6003ba2ab99ce14c4a16", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727227, "uuid": "0f044b0e-5323-45af-a091-d8ebe888e5e9", "comment": "Malware payload (Mirai)", "value": "b2ede33df75e1eb2a7862d16179ad1e08fd2cdabbee67d89e06a1186dc28c888b96c797b88b343b7d8c43a3b0e0887de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727227, "uuid": "8d8b100c-97d9-4d81-85b9-06f3a1e3c64a", "value": "T1C3D2E09876D753F78CCDD9BE720E4026309974A966B29363B305D4530B7A180E652E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727227, "uuid": "3319c95d-e853-4bb2-80bf-754d180ba3fc", "value": "384:MId/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKIe9FtNy9:blxKd29WcxEns+V6IHE4RlY990HKw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727227, "uuid": "52d800a4-d5ff-4c11-b8a2-e018bd755052", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727227, "uuid": "c3e6fb79-a7cb-488f-9322-5eec64fa7238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727227, "uuid": "065985b0-4e1f-415a-983e-e249a405cbee", "value": "6d68e92c217a54b4b9bf349820ca16fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "852e64fa-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720675, "uuid": "6b3a4051-4df5-477d-9960-c545e8209f6c", "comment": "Malware payload (Mirai)", "value": "8d34811b65e7c09d194d45787353ede8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720675, "uuid": "4f8f29b4-058a-4a3c-9f31-1752e3506769", "comment": "Malware payload (Mirai)", "value": "4c313fd0e9304fd6412a03135ed9d34439289e641f5c8cb179d86bd60295baed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720675, "uuid": "3c431cc4-d004-430b-9f1a-e0cae69e1cd1", "comment": "Malware payload (Mirai)", "value": "e6fe3cdbeb4c37aec795be8fdbebb3fd8cfa5f26", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720675, "uuid": "90a0d21a-38e9-4188-8128-fa7c00ca7d56", "comment": "Malware payload (Mirai)", "value": "e4de51c52b8f89453270b547f4017a94e2ddeccdec07fada94344fb0c2f774a188d90e723def10d527249dc68682f7ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720675, "uuid": "362bb4cf-957d-41be-924e-660c6db64938", "value": "T19AF3D71AAF510FBBCCAFDD3706E90B0239CC954722A53B763674D528F54A50B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720675, "uuid": "5db0f4d1-5e49-462d-b3bf-1f816dd6a80c", "value": "1536:A3XcoiJzdbdqxcqREaf2ZQdAZV1jj8l56TV2E21mZNct9/4XsS7PJc5xMHiUtllr:AncoiOcWeMAtH2mA2sS7hc8lLNUFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720675, "uuid": "5f2c559e-3cd5-4410-9e8d-de8f434b5eb7", "value": 169640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720675, "uuid": "1c86bf12-6e49-44da-a23d-d1517a084745", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720675, "uuid": "eeb0d31e-4e7e-4967-b388-77c9316d990a", "value": "concakhbtandhuy.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdedfbc-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738618, "uuid": "132876e6-e2a2-402a-9caf-1158d91226fd", "comment": "Malware payload (Mirai)", "value": "950961cd3421db9ad54450a9d5ceefce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738618, "uuid": "0e276e9a-9bae-4c2f-98a1-cd53fb35e7c6", "comment": "Malware payload (Mirai)", "value": "4de9c29027a0f887e119a429ee3c1cf548924d2ea91ba5d6afb777ca814319c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738618, "uuid": "4d706562-04c2-4ee7-b21d-85c00336139a", "comment": "Malware payload (Mirai)", "value": "f1acfe8964d9a6cb2c45c7072c4cf85d59905dea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738618, "uuid": "20ddb63a-0622-4ed7-a42f-39644892e5f1", "comment": "Malware payload (Mirai)", "value": "74c67ceac139cefe1fb886600093100de77bdef5f2e2da719f6df001a63757b5cbe514cd5ea8a9a35845a2bb972b7f5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738618, "uuid": "c1965e85-77d4-499a-be6d-c4b1072d468e", "value": "T19982CF3062AB74F4CBF14435FEAECEC6671A0BF9D1FC369316586B78894110221F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738618, "uuid": "023c3e95-cd59-42a9-acee-c738486047ca", "value": "384:MjLzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMaRhymdGUop5h5lO:6BV0P6+kom0tVAoNvm+to1Rs3UoznlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738618, "uuid": "9bef19ca-a422-4e0c-a060-8a085c82229e", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738618, "uuid": "91271428-00d3-49e1-8bfd-419cf40c63a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738618, "uuid": "422a88c7-bfa2-4090-a1cd-d079bd6d9eae", "value": "950961cd3421db9ad54450a9d5ceefce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8385b846-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692690607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690607, "uuid": "5595c409-4c74-4d7e-9b57-03b40320b1f4", "comment": "Malware payload (Mirai)", "value": "06b05ddbc7098e60bd7e344376d8eb01", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690607, "uuid": "36d51bb7-65b1-409d-8ef3-df552867a780", "comment": "Malware payload (Mirai)", "value": "4df754fd83e214c021d9eb35ee8ea698437d47991494a140c953b629dbf764f6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690607, "uuid": "3102c007-f04b-4fb9-b845-71d9f4020337", "comment": "Malware payload (Mirai)", "value": "78e8c416080ccac59e32cdd0f8b6e66222669ddc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690607, "uuid": "d82de609-c2c9-453f-8cb9-71a0a44a4694", "comment": "Malware payload (Mirai)", "value": "c6c378699f1e699cea3950bf83d59b2238cf0a46319494fe2ba3a81e38891cb8b7bb6ab6ebfd92932180d02102614a10", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690607, "uuid": "65919ef8-71fb-4220-9d4e-e991774db3f9", "value": "T157C2E130A2ED2CB5C6500632F7B85AC5BF530F7DE9FA28D0224057FA794280529E96C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690607, "uuid": "fccbc8f4-8a05-4446-a4fc-6fd010124e16", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNELqu/rnShymdGUop5U:A7soTAZ3alkXLvFh8nNEeynSs3UozU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690607, "uuid": "2e6a7a8b-a8f8-41ba-b977-41b543a708e1", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690607, "uuid": "9dfbf243-ce09-418a-a8d5-7f47ec0a54e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690607, "uuid": "7a60179e-a789-4dcf-8618-1ae66b9647c0", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059cad20-4109-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692721749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721749, "uuid": "e250debc-3a29-46d7-aefc-9646ba3d4e19", "comment": "Malware payload", "value": "6527c67785f7f845c419eafa42fcac80", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721749, "uuid": "8726a513-bcbb-4c39-98f0-5152a3c3f523", "comment": "Malware payload", "value": "5052c5afbe6ab1a3d27606c985848cb3ab2da75eb5f338b9daf5d91f5b36622b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721749, "uuid": "e3a3685a-5a98-4aef-8dba-7ef92f514389", "comment": "Malware payload", "value": "a84761d96f8be76fe112b92384d776a5d37c8a1f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721749, "uuid": "99febe0d-fdb1-42c7-ae5e-43fa5d609ad9", "comment": "Malware payload", "value": "ccea50a493b7e4c47172ec3eff0b8c79753b7c8f1f2964399fb088796d51cd26564e42dcb9a720582f731d46fcb4a7d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721749, "uuid": "4b320c16-10cf-4804-897a-1c3fac4f8402", "value": "T1FF736D46BAD1C871D6BE1A315864C9705B3DB9124EE48D9B3B8A063E4F306C1EF35E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721749, "uuid": "299cd400-bd67-4876-ac99-73f659444f57", "value": "1148116808daa700e5059fa51907e932", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721749, "uuid": "0d2ea18b-8c26-47fe-812b-73cb24ab67c6", "value": "1536:flpGQIgcORfb7u/lGbfRcfZit1dsW3cdmibplg:d0ZOf2/lGbAU12midW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692721749, "uuid": "28d230b5-a5d2-43cf-84f9-e0bf6ac9d0eb", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692721749, "uuid": "c8519a23-bae2-43ff-8cd7-0749d45f828b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721749, "uuid": "0c4b7985-99fc-4631-9484-f1758dff56d0", "value": "SecuriteInfo.com.Win32.PWSX-gen.24106.24902", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb332d-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725337, "uuid": "f8924de4-402c-4a95-acae-ca0ca394e8e1", "comment": "Malware payload", "value": "378e6d4d6f4e9f96b9770501c24c0686", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725337, "uuid": "0f413c27-a693-433c-a65f-97dbed334f03", "comment": "Malware payload", "value": "508253b0a157521d163c3fbdd9732a996bf5905cf4cf5a88ffec535f38d3a6a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725337, "uuid": "a45fa7c3-c939-4366-9ae8-c54e84103c58", "comment": "Malware payload", "value": "5e140e3f9b7af8c47a9aacd77cfda9395dd5384e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725337, "uuid": "9e256ddf-5119-4982-b785-d18c73401adc", "comment": "Malware payload", "value": "9cf674934c9792c19f4b92b138717af57b317d013203cb30fb0da0b9a46c7e00dd212e402a266f1ee233c2585dd7dd4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725337, "uuid": "2f6abac8-9649-4e2e-a886-96cccd9dab63", "value": "T121138263E601EAA2E5C567B3257783B5562CF1312B169783FF883AF40E023879179D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725337, "uuid": "63b48064-bbc9-4654-a69e-13ed5edd7fe7", "value": "768:3DStOZonFyNJVMNwTURCS1Gd0TMV46cF4XiixdAwl8hfb2v/4URr6PmsAhhAakou:JZoqqZbU/s+4cfooXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725337, "uuid": "eb3e93f4-05d0-44fd-be75-fe53fdd1b4d4", "value": 42384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725337, "uuid": "59c0fb9a-e8cd-441a-87cb-0a0089118cc4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725337, "uuid": "9c989a58-9d37-4421-a8c9-5e871f679005", "value": "SecuriteInfo.com.Trojan-Dropper.AndroidOS.Agent.17899.19558", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c0de2c-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714749, "uuid": "dce24a71-05d3-4dcc-9c66-5ae4ea38fc4d", "comment": "Malware payload", "value": "c624568e033887437008f25588e3d9ce", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714749, "uuid": "793e28d1-9506-45d9-913c-c7fe9f933ea0", "comment": "Malware payload", "value": "526613447e3fab1375062a6cd1a92f9494d712f1384f850ef46f364a6cc1a411", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714749, "uuid": "74da51bc-6c7e-40f0-a79d-3658fd711b57", "comment": "Malware payload", "value": "86a6e0446fbd19a7a9bbd097bcd0de4f8d41f8d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714749, "uuid": "41691046-076e-4a96-b350-d9eabf369736", "comment": "Malware payload", "value": "8154aba8127e378baf94f5dc6b4e8124a57a3fe603326d00f416821528fb20e1281aa24c2a9536739625fff52327e22a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714749, "uuid": "1cded4ed-cf37-4243-a19e-f02d9c4c5cf8", "value": "T1E966338719CA41F4EAC51970C12F9BC71BF258B28D898454AFC178C7E692FB2A077973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714749, "uuid": "f9aca786-0b5b-4f61-98e5-ea30dd487b6f", "value": "099f20f175e7be818172354f31e4022f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714749, "uuid": "bb83ebff-1cac-4c5b-a008-1291c0a498f8", "value": "196608:2ESpuhPRSIIlKBX0EOJ7+n22Ze0+4O9D0FT:8uxstlKBX0EQaZS40Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714749, "uuid": "5f0eba08-25dc-4b7e-ab82-ab5062489c8d", "value": 6920192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714749, "uuid": "92319d66-0617-47e6-bf84-236346c0aaf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714749, "uuid": "1acf9cff-f67c-4d7a-aafb-9d446ad8b5d5", "value": "ds.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df51430-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692704369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704369, "uuid": "38df1915-3702-430f-890f-e845ad28d187", "comment": "Malware payload (LummaStealer)", "value": "d6ca960d6248f031ffaba9a7aa429f46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704369, "uuid": "ed1e5a35-eece-472a-8cd5-472c0d8f3108", "comment": "Malware payload (LummaStealer)", "value": "545462d50f459ec12cc489c7b2f9ffca485100c85d1d21e8d8987a0a4857563c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704369, "uuid": "902f5dde-c9d4-43d4-91e8-bac0445abe37", "comment": "Malware payload (LummaStealer)", "value": "dcbe94f668bfb25c8d90b0490c3a3f95e868785b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704369, "uuid": "ee78ad13-417b-475f-9108-89bae3ed6e4b", "comment": "Malware payload (LummaStealer)", "value": "1d7595ef279e8171daeb942c456680090fcb25bc3d93770588f20504a1a30477b926f9f2458c10f7d528f31152484095", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704369, "uuid": "cd73bed1-19ef-4ca3-ba6e-28bac30f4294", "value": "T11D94F11366E1E872D7454634CE1ECAA463EEB8F0CD9FA657231C4B7A18703B2C667352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704369, "uuid": "15644f45-5c67-479f-bc67-c7e93e7f4b30", "value": "83f305571af3bad4fd0b459ab4b0a012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704369, "uuid": "370c06a9-e31b-4848-8e82-0028297c9cb6", "value": "6144:2npLT7J5OLqifiyO33WedyIwXc8jJw/kOAcGmOgIpbeQBU8MsaoDMvL9LkG:2np/TCqiKv/8vCkxb1pSQm8ao4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704369, "uuid": "d73ec867-ac2a-4492-bd4a-32fef4444ac3", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704369, "uuid": "4c36d6d6-c651-4d83-af3a-d395f89b27b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704369, "uuid": "5b31c5c7-49b8-4dbc-b49d-98aaaa644951", "value": "d6ca960d6248f031ffaba9a7aa429f46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5359a90b-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692728752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728752, "uuid": "d9a6b61f-04dc-4dde-9175-e5084917c20b", "comment": "Malware payload (AgentTesla)", "value": "5957f73587c0568c38852c74a5195301", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728752, "uuid": "b9cebcb8-685b-4986-b53a-f0f6e05639c3", "comment": "Malware payload (AgentTesla)", "value": "54fff8c0e0265d9f0d6ecc1a44617b63abab1ae3c98afe406b5787490db0bfde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728752, "uuid": "85e30e80-6097-4940-9d22-1373e8471b4c", "comment": "Malware payload (AgentTesla)", "value": "44deb5179179d7752690ee01fc1427db20117c2a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728752, "uuid": "c7514570-1943-4b11-86c5-eaf10cb4dcbe", "comment": "Malware payload (AgentTesla)", "value": "98aeb2cff0b3b9ce751e5085762573e3b423a535a0da2a30d5e64a92743becaa7c965e365a7a9c8c34c813b62e3a6364", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728752, "uuid": "99225e4f-bd57-43b2-b51f-9754ba829bad", "value": "T18605DFD9253ABC2DC87C92FC73199C1DA3ADCE75830BF012F2994867A43AB915F35690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728752, "uuid": "70458974-9104-406f-932d-a2e100d0949e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728752, "uuid": "4ee83a50-1c9f-411d-ac99-4bf378102b5c", "value": "12288:iAUXC8Ae9JbSw6vAGvjRg7VYXKJq6EJws9Eyshinml+pInZZxZ8faAaPDWIzdet:iAUXCFBw6IGvKJV+7VAsml+pIZNsgaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728752, "uuid": "07681e35-73fc-4bac-84f0-c060b400fd6e", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728752, "uuid": "5a55da50-e512-4e70-8744-9252f7aa157b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728752, "uuid": "2e6bdb44-6bb2-4c36-92f4-a5b224737300", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c077cf-40d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692699550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699550, "uuid": "96c11c63-b82f-4258-93ec-bc06d6da0938", "comment": "Malware payload", "value": "4570a601bd41de47dc9a5485ff0b74a0", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699550, "uuid": "2dd641c2-c2a6-420b-a2f7-c414976a851c", "comment": "Malware payload", "value": "57f003b439470ff3991240c03c8bb32bbc0967d9c33a3f7738be92153548c6a1", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699550, "uuid": "8aaebd6c-224f-4b67-ac2c-1f173ec7e1b5", "comment": "Malware payload", "value": "0df3ba73e8b10004ebb27933e5c489b95e5a1f85", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699550, "uuid": "889809e5-5da9-42d3-a20a-fde623af48de", "comment": "Malware payload", "value": "6b08614856eecd148ba884c15fd8c49c42f8e3864f9b9209a4fac6f4c44c5c830608850c8694cff4eea09de00d1b4053", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699550, "uuid": "29e9d555-ac72-4172-b20a-62c2f9898b01", "value": "T16FC42326DFB752692C561FAB86B072A441A09C0C4CBC23555BB1ADEF30FE7369581EF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699550, "uuid": "8be5c0b0-0ea9-40d3-ac55-5c0da9d7cd9e", "value": "12288:gav/PAgUcFlwE3eASGRs9pW0Qg1PE7SXr5DntYZqBj:gKIgTreiWj1PESbVtYKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692699550, "uuid": "bfd9b08b-27b0-4380-a739-6994afa7602b", "value": 563556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692699550, "uuid": "3e58af22-bc39-4ea5-a191-810d68d2b106", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699550, "uuid": "813dc54d-a824-4926-b165-5904478a430c", "value": "Refund Payment 274652.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496538a7-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738614, "uuid": "7eb0ea4c-15a0-4442-8ec5-b3af4136d1cf", "comment": "Malware payload (Mirai)", "value": "194bf4fc0fdc1d492d8db56b870662ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738614, "uuid": "bb95a327-3826-4a71-a951-8b7cfb28b450", "comment": "Malware payload (Mirai)", "value": "58ae94d9002fc73f29aba867d23f28825591b4e8273d97eb18fab1ee0d425fb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738614, "uuid": "c89ef387-1067-46de-9f2d-a750f29d4fd6", "comment": "Malware payload (Mirai)", "value": "5b299321f12d24c6d3a0205f817fa2ad3a62602b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738614, "uuid": "d5370671-245f-40c0-9f14-b49236052246", "comment": "Malware payload (Mirai)", "value": "551bda84d759f2ebfb72a7b28edb36c96d9d503f434b47f4635253150d487f1e706a12059052981a4926c7a90aa5773d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738614, "uuid": "c633dd33-0a8b-42d0-9deb-4255054c7fec", "value": "T19BD2E0597693A3F78C8DD5BEB70E0036309A34A9A7B29333B30AD553477A080F655E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738614, "uuid": "06fa16cd-2b49-472b-af10-485b793ca6f0", "value": "768:0lxKd29WcxEns+V6IHE4RlY990sYfNEeO:Rd29tn+9HEw0a4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738614, "uuid": "c839c250-7b8d-4f35-af21-87460d6e8c09", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738614, "uuid": "5f8b0077-37cc-48bf-a3a5-cfa445af4259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738614, "uuid": "f8a4b4bd-83a4-4abe-b9ee-9adbc62cf822", "value": "194bf4fc0fdc1d492d8db56b870662ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3290f14-40c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NetWire)", "timestamp": 1692691520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691520, "uuid": "ec95693a-f1e9-4b55-acd1-defa5f5ae478", "comment": "Malware payload (NetWire)", "value": "a7ff8ea9951ceb3e3660bfc3500b211a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691520, "uuid": "50784c75-212c-4e54-b3c6-f3c363a398a2", "comment": "Malware payload (NetWire)", "value": "58e6a469f1ace9ec112de054209783ad6dd469a0794f20a998a0dcdf02a4834e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691520, "uuid": "3040ef50-8d40-4f0c-a238-2310c9307f7f", "comment": "Malware payload (NetWire)", "value": "547237200e4044f1f6e2165b6d9d060adab4ab71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691520, "uuid": "8400a5eb-15f3-4f13-9690-4a7709fff1c3", "comment": "Malware payload (NetWire)", "value": "f4996d75d9012605b2a0772823e18a695b2334becb8b9dfe16827b77f57545047c6fce9ac8ff9cd0da77086223624d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691520, "uuid": "c920a83f-7dd8-471e-845a-d134f9f1c919", "value": "T101B3E04C57B38AF7C4D459787D636CA0213CAD47D461DB7A88CC01296EE23BC29CAE75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691520, "uuid": "18c909b3-2aaf-4a62-a742-c104824a35dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691520, "uuid": "dd14968f-ba13-4c8e-9fb9-445c81beb84e", "value": "3072:lh0seFp3R/lmAZCx+Ru8ymVqSSWT78SpeDT2d:lh0s8p373+SNToSpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692691520, "uuid": "5426b642-b61c-4832-aa54-1a9e57f14c0e", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692691520, "uuid": "bdb2a99d-d847-4656-96d9-69187315c8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691520, "uuid": "b88135b7-bb2b-4fd6-a5b6-93a9b5c62703", "value": "a7ff8ea9951ceb3e3660bfc3500b211a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe2e7c0-40b6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686118, "uuid": "c45f1b87-cf0f-43b3-ba0a-5d0da256fbe8", "comment": "Malware payload (AgentTesla)", "value": "bfdae1786fe694152c11c0eca4b72cc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686118, "uuid": "4df1b727-a3bc-4edb-bda6-eba667fc6355", "comment": "Malware payload (AgentTesla)", "value": "596694c74332564a2f97d443cb291ac7f1ccf0d3cf7cf468fd2810b22f7c593c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686118, "uuid": "88184f66-6e7d-409b-bdac-fa8059c0df0c", "comment": "Malware payload (AgentTesla)", "value": "1ed167913dc5b3f5a4a8f6ddf70b11467f1535e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686118, "uuid": "b4f44403-e515-48be-9ad4-2322dcb63e7c", "comment": "Malware payload (AgentTesla)", "value": "375bc0cd04a5e9c9c2998cbe655d9bd829cda5ef5e05b777b68218243844b0eee89688d6d08a24dd72216e07e17116c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686118, "uuid": "d86b91e4-2289-4f38-968b-9914c42b9e42", "value": "T14DF46AC0E2BADBD3D5BA57F5206146000F767FC6B52AD2544DA234EA35F5B402A83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686118, "uuid": "b6c832a8-8f98-4600-ae35-4504f7795ee0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686118, "uuid": "fc5e8c71-7b2d-4a81-83bf-b841587ff5ff", "value": "12288:XTUe2d1mbTdaAv33QalGb0KF09RSfiMyYT5aTJaTP7MFNrnebs5wm3h:XTVdl33plGbzF07SNyicJmPg+bs5N3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686118, "uuid": "99ac7f38-6b64-4ca7-a3f1-1447d9e89165", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686118, "uuid": "2135ddf0-3400-49b0-bde0-ddbf40a2c8dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686118, "uuid": "1953a1ad-bf7a-41ba-a515-e57329822a36", "value": "SecuriteInfo.com.Win32.PWSX-gen.11060.18935", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4103f2e6-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738600, "uuid": "80f7c8e3-0ba6-4b8f-9d8e-feefe9d5b0fc", "comment": "Malware payload (Mirai)", "value": "f25b730b8011f367c1d1ef46adcd7e1d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738600, "uuid": "adb49a24-4c31-415c-bab1-f3d4ba446431", "comment": "Malware payload (Mirai)", "value": "59c35b2bf3e821b12dece9b713936e3bfc6c0dbf3fcce8d7f65ad19e09b0a181", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738600, "uuid": "53fac4ce-db7d-4bf7-8faf-c1875f980885", "comment": "Malware payload (Mirai)", "value": "1818bec170005816443ec17d356f4b5005ccf277", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738600, "uuid": "ac11a449-dfbe-45e3-bdb9-29b0ecf3af41", "comment": "Malware payload (Mirai)", "value": "4f70401555367793b4c3f5327383f7fe9def75ba5fe6940619c789013f781e7b89aad6844c2f1bf3da76689e3516ccf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738600, "uuid": "1fccdf76-fad8-4c91-a83e-597bf6734e34", "value": "T1E9C2D0A07726F931C5206C3DE52B4D8A3A91063CD1FF393664158C398FC1A9B67B88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738600, "uuid": "cb918ed1-1b9c-4d83-8944-123c13eeff44", "value": "768:AMKyhegCCMqfizjoNpd2vJdX6vwr8T9q3UELuw:nKy4qfqoeJdXWg8SLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738600, "uuid": "0e90da54-76db-4d88-bdcf-7d8bf91f5979", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738600, "uuid": "06578599-504f-432a-9472-aeadf57f90e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738600, "uuid": "5b328865-703e-45ae-9fc4-92121a07ffc6", "value": "f25b730b8011f367c1d1ef46adcd7e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7519d2bb-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692704327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704327, "uuid": "f6e5a4ba-ed24-4a0a-97d3-e5e46d4db01b", "comment": "Malware payload (Formbook)", "value": "16ddb4ac35e1089483ad331dd9398b25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704327, "uuid": "251c8b36-8e2c-470c-ae69-bd23179328a2", "comment": "Malware payload (Formbook)", "value": "59da9f40387363fb12e59349fa8f47535f80abe5ac07d87e20f42c547e176864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704327, "uuid": "e0aeca12-1291-4155-9d9e-c04be093332c", "comment": "Malware payload (Formbook)", "value": "0b225a39433ee94f651748141506ef88b0099630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704327, "uuid": "478d8222-372f-4620-942c-c34bb936bc07", "comment": "Malware payload (Formbook)", "value": "b6de8dbf2b14d4547bcb107823107e7d4a509993763433dc0a83920b72651f1e965689b9837703a78769e227ce91f7c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704327, "uuid": "aa1f71c6-059e-4d4e-a48c-7b742219245b", "value": "T1B564235CADF0C51BD6E31BB2AE390B665ABAC50256F9460B03B44B0DFC396908B1F753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704327, "uuid": "57c07c90-49e5-4f7c-8353-324b3d9b26d2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704327, "uuid": "ac290ca2-e8d5-43bd-993d-ad5cdad25d7d", "value": "6144:PYa6kZDdUQ/pdVioadY22tJwLUTme2O7E326RyqhKh89Jrgwcaf:PYiZDy8dVedGtJwLP26RyqT9JrK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704327, "uuid": "bc963f83-3771-4b23-9eb0-09c7c27acb96", "value": 313057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704327, "uuid": "2f6dd990-2740-45d6-a996-df61a074f2c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704327, "uuid": "29ef8c93-1648-4324-9c1b-08f72f4850a4", "value": "USD 150,032 HSBC Payment Services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bd37d3-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692683338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683338, "uuid": "ae295ea9-4ee7-41a6-bc94-8453077d2db9", "comment": "Malware payload (AgentTesla)", "value": "19a3963df28d7ba0d09b228289e94394", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683338, "uuid": "57de265c-d895-4971-ae0c-0235afb08f4e", "comment": "Malware payload (AgentTesla)", "value": "5a6c429f017b403c4bc91330056da43f35387f4a5ed19fed2be140ee29c32989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683338, "uuid": "bdccc7f2-5f66-480b-b9a1-3ccbf95c483e", "comment": "Malware payload (AgentTesla)", "value": "8fbf8f30146835f14c553ed42abbef116e0dacda", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683338, "uuid": "12f1a098-4a34-4020-8909-206990dd8b16", "comment": "Malware payload (AgentTesla)", "value": "7dc1acf1b71a7a5ef1fa4881ce11a9bacdea4c7091cf0295091626eb6af3141a9f0df3026da9d80b4df846ef79d6712b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683338, "uuid": "0acfc454-c781-4082-b98b-fbb26a480a49", "value": "T11F258CD0D1BADAD7D47A43F9202141000F72BFCA7526D3948DAA78E975F4B016A87A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683338, "uuid": "2465a88b-e7ce-49d4-8c78-fcef14cc9803", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683338, "uuid": "2af73df6-16c3-4edf-8c94-109925bcecf2", "value": "24576:5T+deplfkNQGhAExbAU0OYWPMObNA+gk:B+dOfkNQGbXMsaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683338, "uuid": "dfdcb8c0-f33f-4fcc-bac8-4e3b30cbcf04", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683338, "uuid": "05187fa6-5006-40f5-84bc-46f9793ad2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683338, "uuid": "581d2003-d26c-4e44-b021-9dd8dff2156e", "value": "jsDX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829dbbff-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720671, "uuid": "dac26b66-4b2d-469a-999c-4199b64ed88f", "comment": "Malware payload (Mirai)", "value": "f7b6cc980b64c28b9713ca7835d38dc2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720671, "uuid": "63efb7f7-025e-4575-87ff-7f3c2c134012", "comment": "Malware payload (Mirai)", "value": "5c62fc4e418dea0d0c3dbeda1ce422c15c0041cf5cfc9910a7ef73062efd600e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720671, "uuid": "6bde4b1a-a28b-40f1-935e-eca517f2f1af", "comment": "Malware payload (Mirai)", "value": "d7dbd3c8329ad4894cfd78ed9dcad17a9ed7af8a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720671, "uuid": "445521f1-e10e-485a-b5cd-acdb40e6aa69", "comment": "Malware payload (Mirai)", "value": "b7156fc6d321dedfd94a132c7db39735f3228038ad27c2ec7687c1ca710127fcee7a3cc7a0a20aaa198bd472652f7867", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720671, "uuid": "8d5d0c93-e7bf-4068-9a02-fe76687e9631", "value": "T13AF3995D6E228F7EF668873047F78E25975823D623E1D684E1ACC1146F2029E641FFAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720671, "uuid": "2f8be9bd-7a56-4c08-b5b8-0f8a62d18eb4", "value": "1536:j/cOqkAIE2Yci917WDNGuS0IMoO1B7qroerzqsWWCLTNiUQfmh78NBLioV:j/vBchWD4utI9O1dqrrzqlglfm8NBLim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720671, "uuid": "0c47886f-efbc-49ee-bf89-f9d52a6d4dc1", "value": 166408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720671, "uuid": "09dcd8cb-c3d0-41ce-bf5c-d35952a67540", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720671, "uuid": "dd1a2136-b934-4cef-9844-c621d2d3faf2", "value": "concakhbtandhuy.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85726d03-4085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692665270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665270, "uuid": "9c974f7d-a3e2-4160-999f-7cf0ee6b09ee", "comment": "Malware payload (RedLineStealer)", "value": "52729fb3d2b746d9817a74f61afd2f02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665270, "uuid": "bd1d931c-a219-4b06-8fb4-4ee66defdeb1", "comment": "Malware payload (RedLineStealer)", "value": "5e8671453cab8ce33ccabb63e497b293526d955dcda009ada9b4756a1076e8d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665270, "uuid": "76868b0e-b4fb-4537-8693-bf48020f14a0", "comment": "Malware payload (RedLineStealer)", "value": "cbae511b221ff3fa0be2ceb5c7307231976988a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665270, "uuid": "6425fc45-526f-4750-bdc1-9aa3821cd1c6", "comment": "Malware payload (RedLineStealer)", "value": "c6022cd56bcaf2fd2173a9878d5099e03613b57ba65af778730e6c7251f70ef0dc35207e39a023d5ca9f4bbc0ca09ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665270, "uuid": "4d287a94-203d-4a12-8f4b-0934bd0223bd", "value": "T1C4958D2F3981C525DDE220B647ECBC28516FB2B3072A5AE705881EEFDF105E26B35647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665270, "uuid": "bb5b720f-e2ad-45df-b514-d591cfa2e41d", "value": "7ca28186d68c9a22a0e816e570aac96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665270, "uuid": "421e77e7-182d-43eb-bc3e-f5750fea8596", "value": "24576:BdGvYOmxjN9cDk2OeOxrV/JHaX14UqSaviF431Ifi9:Bd1xjN9cDhOeaJHm14Y671V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692665270, "uuid": "7ff062cb-0860-4723-832b-cb5ab0f8408f", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692665270, "uuid": "ef5972c3-4446-4ee9-a916-8f7b6303b261", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665270, "uuid": "183174d4-74ab-4b80-88c9-6009687d355a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56924658-40d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692699551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699551, "uuid": "04923343-5672-4d89-b8a4-6eb4a255f90e", "comment": "Malware payload (AgentTesla)", "value": "0d5ecb5c496e7399e221a8de306c659c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699551, "uuid": "7c25baf7-9064-4a9b-9a44-b5940123e073", "comment": "Malware payload (AgentTesla)", "value": "5e9f2794e4c145fbd68caacb0ddf07d1d35fc9b8b748b2efd1b4063e489f8223", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699551, "uuid": "39bdd199-5807-40f0-b2fe-ed055588ef88", "comment": "Malware payload (AgentTesla)", "value": "5be89fd0488636b47ab07a28b8bd41f15c0c7e41", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699551, "uuid": "cdb99c3e-9e45-4436-937b-386ef4f386e4", "comment": "Malware payload (AgentTesla)", "value": "76c6d215c7228af726d9494bbccc672adf77827251034113dd88eb1d43abc71a92c66f196222d8eab9d5d1ce1b0bdcbf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699551, "uuid": "22b60796-68fc-4dcf-b1be-9d640117edff", "value": "T1E374125341A0D867C4F60D32A9FA727BCB76D76AF4D35B830B90A8493DB83C9560E9C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699551, "uuid": "58ae3257-d63b-4831-9c0a-5d822942eccc", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699551, "uuid": "471b2713-8f67-4988-bc5e-4adc756114b3", "value": "6144:aQ606xiI86ZqqEWdy34g5xKQcMI32bzybK5EQ/l3TZfwlNWUvili+2EMKedJD6Sz:5I8eqqESvSxdHbIKKu/GOi+evT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692699551, "uuid": "b1547296-12d6-4088-948a-905e4a4a2136", "value": 345984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692699551, "uuid": "a20ff964-afdb-49d5-a575-129ee222b728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699551, "uuid": "72f4477e-9529-4400-8461-6ecd1beef24f", "value": "RFQ20230822_Commercial list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f35963-412d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692737403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737403, "uuid": "2a06347b-b78d-4fc3-a5d0-ce6b1d36fc53", "comment": "Malware payload (Mirai)", "value": "2c93d3a319a6c742b91cad997470c75f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737403, "uuid": "4a534901-1b1b-4a18-8ae6-579401c60947", "comment": "Malware payload (Mirai)", "value": "5ff9d5ac4d59d23bbf48f9b5adfc9db86682c300d0572b9fc05943d00bf4b445", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737403, "uuid": "0847c938-e0bd-43bb-9a0d-61b7d57ce6d8", "comment": "Malware payload (Mirai)", "value": "686e2e38b7070f650e3dcbed44c1d4d34a21c409", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737403, "uuid": "444c9697-6ca2-4a1d-a8f0-c6851bae5ddd", "comment": "Malware payload (Mirai)", "value": "92573c2d5898f86ad3720a279933054766367bb9a395c2f0d603f3442183c5ad93c45f5fb362848a586c2327cdc56a65", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737403, "uuid": "d5ea23db-06cc-4f33-bb2e-1cd6e682b2e0", "value": "T107C2F1BFB5AA5A67FA5C233DE431C11B03A5F42C979E275B27401432E94E82D7532CC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737403, "uuid": "ab42b98a-befe-45a4-aad3-5dcacf5ce1b6", "value": "384:M21DMwk8JPyGnT8WyopNEutTneSe3oECHjYlQ2NnE4+0o8tm3HWBKENAZHsx6KUX:vMwxdyoEUnDz+Y8tqHWXmMxI1T0NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737403, "uuid": "35ee2384-c76d-484a-a3ee-c172d2e75f99", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737403, "uuid": "68e68813-26c9-4e7f-a146-d015cb836191", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737403, "uuid": "945b6180-c513-4b0e-a733-2026a2cc8045", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f301ee-40f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692715207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715207, "uuid": "f26277c2-b412-405b-afcf-4ce31da33575", "comment": "Malware payload (Smoke Loader)", "value": "0c729c64d368fb66519bfa42b391aae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715207, "uuid": "9f2ab247-1cfc-4033-a42b-85c069dce78e", "comment": "Malware payload (Smoke Loader)", "value": "602b49375f31d74cb4163751abaa38ae8f5264846aef56a99f9231602e7502d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715207, "uuid": "f12f134f-6af0-4b76-b964-f7d862cb0afd", "comment": "Malware payload (Smoke Loader)", "value": "74c7171140efc850b6ffa9f7cbb0cab9aec072de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715207, "uuid": "e97d2648-b242-41d7-b017-c87ca3978fbc", "comment": "Malware payload (Smoke Loader)", "value": "d0d01d7d5002a00867f9492978ef6cc8ad879e2507a369a7dcb61c0b6033e8d9dc909212f020aecc3f8e1d82ba250f62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715207, "uuid": "42b08380-2f49-4fea-a2d3-bf9da48ce91c", "value": "T17944BE22B6D5D432E52745308E6AC7F46B2FF8716F9666DB23980A3F4E702E1C679340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715207, "uuid": "32b369df-c001-433e-9d1b-e94178d01c77", "value": "cac4ca706752b4093b870401cdbc4288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715207, "uuid": "b63b0927-af1d-4d6a-acb6-eb037b44fb7e", "value": "3072:YhH/2iJReuTHZF4qV28V77P6sUv3mNB4H9GnnbHN3W6vkHusg+tfzGlH50PRih5q:sHdIu9Cq84usUvmoHEnbozTReH50o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715207, "uuid": "2db83528-6114-4a17-a6b9-81407d5e143e", "value": 274944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715207, "uuid": "4af8f053-ecb6-4622-980c-a066fa932192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715207, "uuid": "5b3c14f2-1762-42d4-9bd4-2c6d2c7693bc", "value": "0c729c64d368fb66519bfa42b391aae3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7b5b99-408c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1692668099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668099, "uuid": "deac2736-c1f7-4fb8-bd13-938a2128e8f8", "comment": "Malware payload (CoinMiner)", "value": "55a0b5948da3a1c85b2758b1a8815631", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668099, "uuid": "424b7e8c-b836-4699-ae15-273b3a1145e4", "comment": "Malware payload (CoinMiner)", "value": "60312f09f1b44e0668a6ce58ec3fb7638858f5c555d281f9402f5c1ce5b6704d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668099, "uuid": "b1c91db0-9a11-4dc8-82c2-0fc38b4c637a", "comment": "Malware payload (CoinMiner)", "value": "b93e8f13aa1eb4028c1e4d059862d7df262dd127", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692668099, "uuid": "d1628c2b-72f1-4550-b529-9541c630ac5c", "comment": "Malware payload (CoinMiner)", "value": "a8c58006e530ba566dddc6beaa6a3068354789b3170d65132eeb66b762b7ae03d7a9c17be95cbd2fcd74063ea64e01d1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668099, "uuid": "61dc4758-9bcf-49f0-8372-44b4088c80ee", "value": "T1FF56DF54F9631629D931953BB5D9C940D2324371F6B36FF20FA7A322ABFB2806631439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668099, "uuid": "a3e1d564-1ea9-402c-997a-783c9d557c8f", "value": "d3be2dc19ba54f7225d7679c3f791cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668099, "uuid": "e6770666-1152-4f9e-bbda-4eae408e4045", "value": "98304:rrH1+/QQdVat5Ceag6SBuVKhLAw4tc9cQJXA96zVDTgQHVPok:rQ/QQd0S/gTBuCLANK9cGw9OVDkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692668099, "uuid": "06d4faba-7ed6-4e8a-ae52-8771462c3aa9", "value": 6046520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692668099, "uuid": "79eb78cd-ad03-4597-a379-f2292f5c701d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692668099, "uuid": "eda14f0e-8711-4e8e-84c9-39f6bec074fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1b4c57-4100-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692718163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718163, "uuid": "037618c3-8f5c-4189-8de6-fd5afcc189f1", "comment": "Malware payload", "value": "c75348b55b9f0ebe2aa3d061f93c694a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718163, "uuid": "f72f3be6-9cc5-4f51-b8c7-5d78c15fb0e2", "comment": "Malware payload", "value": "6038dd4ed82e4dfa0db83d4aeb696e7413d7e7fe992321d261737516698b6755", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718163, "uuid": "f4fc8f6f-d0d1-47a5-82a4-40dc483e5884", "comment": "Malware payload", "value": "08cae9d11d5bf2efe68c67548fa523c489dc275c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718163, "uuid": "4609121e-17e5-4e6a-a99b-13bc35917f49", "comment": "Malware payload", "value": "22951aab1070766c3275eacdf42769cb9a751d2d4f990dcccf570bdebe95e5d35bcd67766bdeb9a30adbabcbd20991a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718163, "uuid": "7062fe09-93d2-4adf-aa62-0c17951cbf12", "value": "T108236B00B7A1C073E59B063469BA86610ABF7C935EF4945B7FE8074D8EB12C0762D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718163, "uuid": "d4c05436-5e88-452b-ba16-07a453228a89", "value": "e16bd71cc52f8b2347f0367958a2caa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718163, "uuid": "6d7df1fd-9794-4e7f-b50f-eaf1ff6656b2", "value": "768:MFS4WFkWFhTdW66YL36jOG7bYtEESAboWV2NKsEBsQyddjAN3lYlclG:MFS4U9XbgdKQfs3ylP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692718163, "uuid": "a9faea93-3c7e-4305-b7ae-870fe8b7bae9", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692718163, "uuid": "72c644ad-1663-4e9e-acce-fabe43a56ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718163, "uuid": "2e06c8da-be5c-49f6-94bb-fdb537175bbb", "value": "SecuriteInfo.com.Win32.PWSX-gen.27170.11618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c677336-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692715828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715828, "uuid": "29622cdd-a59a-4567-90ee-d6f8de86af6d", "comment": "Malware payload (AgentTesla)", "value": "2f8733a4745882246263b5cd7cadc4dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715828, "uuid": "f7c52bc5-2dfb-4074-9b00-fda7f8ff4b72", "comment": "Malware payload (AgentTesla)", "value": "61fad9b69a8e4f8a3dedc8193bb3dd24a07f394cc4200de37e3df667017c60a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715828, "uuid": "ac8450bb-75f5-4aa0-987b-c86c693297b8", "comment": "Malware payload (AgentTesla)", "value": "d7183ccc050da85fd7ee086a82dc395c617ae3ef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715828, "uuid": "923119e2-4aaa-4908-aae3-2db508d740f9", "comment": "Malware payload (AgentTesla)", "value": "bf5878132cadc32e70a89592d5807c0d55f9d89ed905d3e704302fdf100c33132d0b36f198a7d6a1c66681002cf7fe45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715828, "uuid": "b2954751-1780-4a91-8e1f-bb0628fbc50c", "value": "T1A884D1063384CF21C52F15B6D8A3C2F81727BE00DD449BD776C9FE2A79F22AA6951187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715828, "uuid": "e05d54de-9441-4cc2-852d-415b24108dc8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715828, "uuid": "7f333a06-321b-4793-a798-30a5f166c10a", "value": "384:ffePCvpJinBn06CjFN8P3YsU6fCWYA8S/hs/E8sofOh/Q0RbnqyGt/Qz20BB8lRY:1EnBdM8sScz9Apqn+klo63DG1EJPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715828, "uuid": "55f9e626-8e20-466e-b665-31770b0921f8", "value": 387488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715828, "uuid": "610994a5-60d8-492f-acdf-9a0eb8513de0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715828, "uuid": "f195d6f2-1190-47d5-b6a9-19af71bab6ba", "value": "rQUOTATION_AUG7FIBA00541__PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5d7623-40f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692713387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713387, "uuid": "6d2fa082-3571-467c-bb0e-23d1ea12fba6", "comment": "Malware payload", "value": "73a293f7129d0977f4d036f191da8159", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713387, "uuid": "5cc0ce82-e56a-467d-8e64-dfaf0ab64984", "comment": "Malware payload", "value": "63eedf8b0bf67ee09bb7945c6fcf770579c69935c8ec436aa0f31eb8b501c70d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713387, "uuid": "f5e3df43-f344-4ebf-9230-a9f2c1ae7014", "comment": "Malware payload", "value": "33d24c71572cf9ba75a19d1062e04e876ae690b9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713387, "uuid": "2490b305-ef9b-465a-9a40-5a3f32aedf11", "comment": "Malware payload", "value": "2b3247c45fb95d7318268d590fdb535733f4818d2ce2fbd520c824543e7fb405166fca23442e9b9428b94b677464b921", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713387, "uuid": "6ba336c5-2260-4068-8c93-2f88df550854", "value": "T14EF5F125B3C7C522C56D017BF858FE0E1538BE63473045E7BAF9396E88F48C162B9A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713387, "uuid": "ef7fda67-192a-4e3b-a3c8-16448b0b3014", "value": "49152:qnZJk+q4E5q8g7391jBbFX4pYpLCvvx9CiRQsX6PFpm/pdqgQaJE+wKsXc+Ock4:x+XJ4qpLCnHCiRefrgFu+wKu2ck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692713387, "uuid": "4449d93a-7607-4388-b44f-a86b46295347", "value": 3420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692713387, "uuid": "dfb54736-0764-42ac-9648-6d544926b484", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713387, "uuid": "56851824-7c99-42ee-94a7-b3f34d840cee", "value": "ID_multa4c12f406.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47ab599-40bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692690367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690367, "uuid": "4a8802ef-bbf8-4da1-84bd-0597d5e1c2f2", "comment": "Malware payload (Mirai)", "value": "66afc64a751408cf0559926eaed76e21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690367, "uuid": "a95b3daf-20f9-4b8c-aabc-01ecd3682201", "comment": "Malware payload (Mirai)", "value": "64b92ee7cdea66909fef8d36f5e0ce3d0375af03ab456cfffb3b506ae5861582", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690367, "uuid": "42047ca6-4f4f-4570-a723-f4f6fd21bf5b", "comment": "Malware payload (Mirai)", "value": "bc5b4c1573c1998c96c4f1676af13e95134103b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690367, "uuid": "0af94cc8-d088-46c6-84f3-4fa599ae82f8", "comment": "Malware payload (Mirai)", "value": "f9ee81944b4bf4dc90ae0518d936d867971887c0141fe8987591e748fcfde388a82cedb5f8d5d597a68a7a737c90f8f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690367, "uuid": "06a513ba-87dc-45d6-bf20-dd4a3958800f", "value": "T15DB2D0717011B4B7C6A600779DEDCB83FB801EF8D0E873291469099DE6D5D42BAF1247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690367, "uuid": "16df66eb-c064-4364-a97b-bdf504d499b7", "value": "384:tZ0X9nxn8o9ir/nSdoijsN2e4JQkCD2EjKb3pCGhymdGUop5hY:QX9nxn8o9wnBoWzEQf2EjKb3pRs3Uozu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690367, "uuid": "d133b3e5-6963-4290-ad3b-57f07e161061", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690367, "uuid": "fdb3968e-8d2e-443b-8d92-145231206242", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690367, "uuid": "5fc6643a-c828-425b-8caa-790dc3b0951b", "value": "66afc64a751408cf0559926eaed76e21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0aa0c8a-40e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692706172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "176d1a05-a23e-4eac-b6e0-bf7596eec544", "comment": "Malware payload (AgentTesla)", "value": "6c3df793262b77074e2cf8fd7c3de824", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "1ff2ca23-dd0d-44fc-8f43-4892882c9ca1", "comment": "Malware payload (AgentTesla)", "value": "65991091fbb81c3961dd91240296ae03aec2a94ef682dd194134e8cfdf69f8a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "aeb7ce0a-9c31-4cc0-8527-5d22eeb95bfc", "comment": "Malware payload (AgentTesla)", "value": "705ee2c8c612fe8c2b8c7866639a84e33a0d234e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "053ccdcf-fc79-460c-87ff-f21a50aeefdd", "comment": "Malware payload (AgentTesla)", "value": "9c46b4c5bd1202b3f6517e76312b18062892593b3588c386edafca556a89f8216963a1cb716d2d8e0ef0201466a42f7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "23db6535-36fa-4938-887e-485578e4f4b4", "value": "T180058CC1E2BADBD3D57A53F5206106000FB67EDAB57AD2544DA230DA35F4B402A87A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "1540bb1e-cc64-4a3f-88b9-b411d498fcdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "9f068c54-abeb-409f-bef3-5f77cf7dbffa", "value": "12288:TTwV2d1mbTdasgDGBBRxI4cOn6EdUk9TbgLPl5zStKSUZU8lwmtxKbKRKoG:TTydTgDG5Kk9fgLPnztZZU8KfEKoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692706172, "uuid": "edcfeb6b-8c64-4d8d-bbd3-64cbce3d747d", "value": 845312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692706172, "uuid": "48d593d1-39f4-483b-998a-00d70ccf52e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "6a93b1e7-fa8b-4b37-87bc-9e9deb771681", "value": "T T PROOF ADDING FA Please advise ATD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696cf7b3-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690564, "uuid": "4c570c55-996d-455a-8216-0b6b6a82b1c7", "comment": "Malware payload (AgentTesla)", "value": "ff3f88db42b51b8928be3f1f08d7c1ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690564, "uuid": "356d6baa-6a13-4564-8bce-fc77a24df5bc", "comment": "Malware payload (AgentTesla)", "value": "664e98a05e0cdd62d0f97525f2255f1c19b5b8a1d8091a362ef5fbc007c2715c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690564, "uuid": "84253853-3641-4715-8394-17fee9a43a53", "comment": "Malware payload (AgentTesla)", "value": "e6cbc737d151b54129bf082b4def740cffe6d137", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690564, "uuid": "fcc374df-338d-431c-949a-9d7f6a87ce20", "comment": "Malware payload (AgentTesla)", "value": "0157b4d5dd91ab002999bdf45d00b3303fff07efc3b7aca7bf6c979d33a625d8384e872dac3601388b74d1b3d2c14af7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690564, "uuid": "0d3861ef-0e6f-4f9f-ae65-6fa4213fe9ba", "value": "T11B350222B1E5EF05CABC83F160916F4453A711CE2135F2784D97B4E6A3E6BC60A526F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690564, "uuid": "16ce4652-680d-41b6-b520-27ca23940caa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690564, "uuid": "1edb4148-655f-4e0f-b543-7008e54d068a", "value": "24576:FSqlCe9qhJg3duRJ8P+B6nsOkzwTsnW+55A:tlCe9qhJ0d+CsO9bU5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690564, "uuid": "dd0688f2-f91e-4708-a137-cca676c5f86a", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690564, "uuid": "531e76bf-d2ac-435e-88e2-ce3db16cd7b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690564, "uuid": "67ae484e-c70e-4958-8fd4-7951525a7b63", "value": "Halkbank_Ekstre_20230821_080757_783952.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce24b12-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690516, "uuid": "f1c231e3-306e-4f5d-9f1d-e09008bbbe37", "comment": "Malware payload", "value": "f58c5adb5c0548d33559279702741954", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690516, "uuid": "5f25de78-0e11-4ab5-a24b-a1ea489277d7", "comment": "Malware payload", "value": "66530f6cad675ea4fb4074f70cb3a6d32c51ecd77f991f1f4d528cdd911b3da8", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690516, "uuid": "4cc9f256-1eeb-44b8-9bbb-ba3abe6c8f4f", "comment": "Malware payload", "value": "8f493d4788ff26c3d12ef84837936e4a1bfb681a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690516, "uuid": "b1a135f6-2e64-4e1e-a45d-1b653e2b3c32", "comment": "Malware payload", "value": "6b3a0f1d7b19a29f53792850e153d3dc2e44460dd479d319485802d6f9fae5a84b8ea4de0e4b660fe09fd012e7986bbc", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690516, "uuid": "c501d491-626e-4ee8-87d0-9d7a0a5515d6", "value": "T128E4232DDADA17C2F44F8AF485E0930C57A8FB87A8465F956EC034DD6A718EE0D67E00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690516, "uuid": "b920948f-514b-4f5d-9654-c166689e61ea", "value": "12288:6M5CrDCP/w+yemFHHNSC8q/NVo79Ccx6K/Am/EIrW5TQIGM:6M5CrmgDemFHf/NVsXrW19", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690516, "uuid": "02792dd9-c299-4b93-a844-07b3f9a312fe", "value": 681387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690516, "uuid": "e4c8216e-0656-447e-8e88-1a67e87d709b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690516, "uuid": "444954a6-bf26-4136-abf0-6efefd175f2c", "value": "0012342230DOC.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9783ec84-4103-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692719417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692719417, "uuid": "ac427a50-770f-41ed-a1bc-2ec1694de02f", "comment": "Malware payload (RedLineStealer)", "value": "c028f3889320b8bdf68a3a7a8de716f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692719417, "uuid": "06b6dc53-19e1-40d9-9c9a-b1ce59380a14", "comment": "Malware payload (RedLineStealer)", "value": "66cd47441ec1fbac490c9b7e68b24879ce961ab6b0e098a554609c59060042d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692719417, "uuid": "357b83e1-e2c9-4b7b-a0f6-f1a0be3fe53d", "comment": "Malware payload (RedLineStealer)", "value": "12c484a0cdc6e0a55ed4395e864c1ffe4268bb82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692719417, "uuid": "f217bc46-647b-4e82-a1a5-beeb010e5472", "comment": "Malware payload (RedLineStealer)", "value": "958e1a2540575b3a7605cb7a651b7b967a9a57e1aec0ac9281b624787499d41c1b8b5e973dff9b86cf4b4dea4be56b18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692719417, "uuid": "5f65bbdb-18fb-4c50-914f-989857a25fe9", "value": "T16FA52A94FD9F40B1E502147018BB63BF67301E0D9B35CBEBD9447A69E833AE50BB2265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692719417, "uuid": "80d05a40-4bc9-42fb-8426-6666f8a516d0", "value": "9a619ff592c613c85b0e236f7bccecff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692719417, "uuid": "460d1248-731b-4ec5-b08b-e198784b7305", "value": "24576:Uv0YMtVMMMBGAcX4sDorS1THLglsBVphoEHAaaVf/rYj1VlG1PIE3VvGD6YiVJOf:uCmsz1QGXoBYj1z6vO36O0at", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692719417, "uuid": "989adef8-20a9-4f72-a93d-f3f78871517c", "value": 2175488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692719417, "uuid": "c5c0d703-239b-449a-86da-9e301b8da7f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692719417, "uuid": "2ffa9a8d-e24e-46eb-b370-24ac50006233", "value": "c028f3889320b8bdf68a3a7a8de716f4.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95651e32-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693214, "uuid": "596834a0-9ab3-4657-adc0-25c2ddf88cc1", "comment": "Malware payload", "value": "39af1fbfdcd641e6ff5672c8a8818a36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693214, "uuid": "56fe32b6-b72a-45da-bbb5-bb8aa755a27c", "comment": "Malware payload", "value": "6762e17678667f16184d22504c031ff9e13fedac77031e527d9961e455f4abba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693214, "uuid": "798685d8-c171-4f29-9c55-746b5e47e868", "comment": "Malware payload", "value": "7fd53a1816972d8a21582b23e1c98472c1aea443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693214, "uuid": "c33c3d02-797b-4758-8c90-8f81161a927e", "comment": "Malware payload", "value": "bc6598d0854f1614e855a75060ec717b46fddf2be46e0dfca825eea8f6fb1fc93665ce70c72be43bbab80d24953e9080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693214, "uuid": "5e68e64a-1598-4654-8e7b-06b942ee13da", "value": "T1C44329DF88616EBDC018F870FC39ADA9131D6521762F1DD86A3887514B8F5CFA00F6A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693214, "uuid": "c62d73a4-89cb-4c8d-8fbc-8e824172fe77", "value": "1536:04mDxt6HKyuQNYmHuAjQ4WXVwCW0bpUXCX3xnKt6CWdk+r:J+KRHY0s4kVwCaXCXNKt6Zk+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693214, "uuid": "fb2cbadf-19ea-441e-9ad8-5d60bc5b43df", "value": 60212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693214, "uuid": "e03c6889-e759-4454-9fae-913e587924b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693214, "uuid": "f183fc2b-7959-4f85-ad09-502b108ec023", "value": "39af1fbfdcd641e6ff5672c8a8818a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1940c439-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1692714481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714481, "uuid": "74cac286-d585-4cee-ac7c-93b7d4e01f53", "comment": "Malware payload (Stop)", "value": "b6aafdaa35c4947300a0be4f5f6333a5", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714481, "uuid": "6d1a3ed3-fcff-4c87-97da-b979c79a4472", "comment": "Malware payload (Stop)", "value": "6822b497f3e38d94f3118a9310670f89e32c06f1ea88df09931887ac57880281", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714481, "uuid": "91856103-9e51-493f-a063-8ccc8417997c", "comment": "Malware payload (Stop)", "value": "67a66e26a50280d2a4e1c8c1575de185f8ad1714", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714481, "uuid": "b476fdeb-8397-4163-b543-e838c21f5e9b", "comment": "Malware payload (Stop)", "value": "556b9b80d023860263849bca594999b86be0356e38e67a93d24fc2ac87198b83d0943bd35bf392e803ed2a29831fd935", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714481, "uuid": "cd0862e0-f10d-4eb6-bc48-3a4b96a7624b", "value": "T106F41223E7E1D032E62396704D76C3F07B2EB8A14F9A6ADF23455A2F19345E1C675306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714481, "uuid": "b21c2126-72b9-460c-beb3-278fa6e5d9ac", "value": "a58360eb10a18d5dc70efe7d39616fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714481, "uuid": "e59495ae-6624-455f-ad3f-e81f2f43d96e", "value": "12288:/MSYX3bD3dMyKYX6HPuxhN9GiNZ3VN6PSqPidjWYRvKbuKZ81+/vOH:/UXv36EKPuxhLGi3F7siVRybXA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714481, "uuid": "9e0de3ca-f69d-4a68-abec-86c210ed0cd1", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714481, "uuid": "439c3934-3013-4d50-86fa-4757d10508d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714481, "uuid": "688c403d-7ee7-48d3-974b-8838f34323c9", "value": "1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7037157-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727255, "uuid": "6e9676a4-62e9-43d5-ade1-218fe310fc62", "comment": "Malware payload (Mirai)", "value": "9a3e5a452c68c691297ecf0a88971cba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727255, "uuid": "f795dd80-9bce-4a2b-a290-fd8d7729eaa7", "comment": "Malware payload (Mirai)", "value": "6adce0aa33a83f18cb2b9d5a79d074832e6e54917841d164108d46c332f767c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727255, "uuid": "e8834186-d053-4eaa-b4a6-179f887a982b", "comment": "Malware payload (Mirai)", "value": "5423fb6ddd9f727b9a01a97353068b5a55f5bf26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727255, "uuid": "39a45bb5-568d-42bc-b968-dabd30d29491", "comment": "Malware payload (Mirai)", "value": "bee464b4fec06255c79657e4cf1608aeced487230dccafd0e1cbe01aa81e10400c476500820499b331b2c6a2aee7238e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727255, "uuid": "d65fd842-85e9-4563-9f32-41a17434884f", "value": "T11FD2E12CD95D7945C69D3DBA11CF96B5398C70C0935DEA8E1726801CBA2BF87EC070E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727255, "uuid": "66d99dc1-741e-46ef-b422-ec2986972c47", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNiJbiWU4:1bDs06t4BEub4sU/MbUim4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727255, "uuid": "98115b11-67bf-47a8-8caf-cc5c02103172", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727255, "uuid": "fb4df647-fa5e-42cf-a68b-f69ac60b3a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727255, "uuid": "4183eabd-eade-4cb1-82ec-0e67fdadf290", "value": "9a3e5a452c68c691297ecf0a88971cba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8f0d85-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725335, "uuid": "37f8aad1-5006-428a-b318-6afc6d1c123d", "comment": "Malware payload", "value": "2cd063eff2bfe7872c9a499a7a38224f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725335, "uuid": "7a6110bd-b9a5-46ae-9649-d64aab39d932", "comment": "Malware payload", "value": "6b26c095d60ea6699313047285d76dfdc17b7026ed5e5243d6fee08149f8382d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725335, "uuid": "dc8b7d77-983c-4940-a092-307c23626e20", "comment": "Malware payload", "value": "471551991b0b8887a4f532f987fdbd839fac8024", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725335, "uuid": "fa966448-5190-4b19-9c43-ac95533e368f", "comment": "Malware payload", "value": "2f9c9a49031a06eb9b900ddbdf2a5b2e128312d04c7fec4806ec75a8d9804246ae1cc55bc17351e13f5b330e874bcfa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725335, "uuid": "74d0c7d4-6796-4c5d-934f-47bbe0095221", "value": "T1ED03A5A2661C58D7FE7D22B3A87F49C615902C7F8BE0186D748FF62244B2313451BD2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725335, "uuid": "fa78d14d-f212-4ab2-b4bf-95f73167e4c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725335, "uuid": "81f26528-9c25-4554-be2e-ba85bff3353e", "value": "768:KnvRDK3EaC8l2hP3SScNY8cfRqTuM+1+j:qpDK3Eaqh36G8BTugj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725335, "uuid": "6f1e2e0a-dc17-4608-a9be-ac0b47a42101", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725335, "uuid": "3b20fecc-4057-476a-a20f-637b18d30183", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725335, "uuid": "1706e8b7-e5c0-45c1-838c-1a485cef07f0", "value": "SecuriteInfo.com.Trojan.DownLoader46.714.1009.23840", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb60250-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727237, "uuid": "c13aa31b-cce0-4e43-91f8-858986e23870", "comment": "Malware payload (Mirai)", "value": "290af2303cd3184936dad7f2c1ec1191", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727237, "uuid": "fcff0d4a-d3bb-438d-9939-27bde958281c", "comment": "Malware payload (Mirai)", "value": "6ba654464ae49395b62dab2774373f616806a0a0720cda5e3031daff83b25cd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727237, "uuid": "bf9289a5-69f8-4f1a-ad7f-3dbf3b240994", "comment": "Malware payload (Mirai)", "value": "1303a039dd72ded2df00183f1f2135cb9e3ab1ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727237, "uuid": "c77ae90c-f766-4100-baac-e4d21974b12d", "comment": "Malware payload (Mirai)", "value": "1383c69a8cd4c6e08287001b628692170d47d7307caf19a46ce7e8eae485f3a2d0d30385e9a41d366f4545662b90e811", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727237, "uuid": "62cf7dc6-176e-442f-b20e-7950d2ea855d", "value": "T1EDC2D088F141DE41DFEB29F03D40DAD6FBD06F5FAA668E4066A053C26E4D6A74306DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727237, "uuid": "7abdfba7-da46-4bec-93c9-2218b330745e", "value": "768:CVdafO76jpmNJJKehmA7trpfIX9KeA7PQC+4uVcqgw09/:mam+AnKehPRa9a4C+4u+qgw09/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727237, "uuid": "cfdb5616-9ccd-40f6-876f-986e6ab78da3", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727237, "uuid": "0cc7cb00-52f9-4362-9361-b0613cc5b077", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727237, "uuid": "2c539799-28aa-453d-8233-ab851119c556", "value": "290af2303cd3184936dad7f2c1ec1191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b450848-40cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692695721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692695721, "uuid": "fd071317-1ba5-4d27-a891-ddb80b4e4778", "comment": "Malware payload (AsyncRAT)", "value": "b9946cd12ddd57f7f32654099b09ad68", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692695721, "uuid": "d319a5b5-4a80-43ef-aa7c-b4b70d0a3116", "comment": "Malware payload (AsyncRAT)", "value": "6c6491a4d68635154b4b1ebcb72bd6f89493c0b44ed769b9a558888244efec18", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692695721, "uuid": "e631ec48-8be1-48a4-81d7-df454e2b6edc", "comment": "Malware payload (AsyncRAT)", "value": "92cc3ad651efe921ad3b176c186338be5e53a2a0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692695721, "uuid": "3d161aac-dd4b-4e5e-b920-b7caae5194a8", "comment": "Malware payload (AsyncRAT)", "value": "aeb23b55d5cc0725bb7a108e55e13e412c4ceb31e8ded3abff86372c38a46aa3b125be98f4fae7f2bdb269f2846dc24d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692695721, "uuid": "70663754-7177-4a74-bffc-966dc7a4ce20", "value": "T13145BD8166D10361D56E093229ACBAF0A4ECFD1C0A14CECF66F4EB18D67374FE217666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692695721, "uuid": "aa785ff4-a336-4ca1-ad07-23a14971955f", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692695721, "uuid": "f1552b40-805c-4333-a748-128e8886041d", "value": "24576:WNA3R5drXPbrwUZLKmrcExgsu1091e9yewyoC2Um:35jcG1rcEqsu1n93vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692695721, "uuid": "74066c81-3c6e-44a4-bf50-e77b51df9c30", "value": 1214416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692695721, "uuid": "8c321516-663e-4e83-9151-245c36da4c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692695721, "uuid": "6bcbd180-e73b-4c33-bf26-f151c50ab5fc", "value": "TranscationReciept.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607372d6-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725338, "uuid": "12549fba-ac46-46d5-874d-03db64087294", "comment": "Malware payload", "value": "141ce7ca58f06beb9e6a678d8dbdcf55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725338, "uuid": "3a659adf-4121-4316-a0e1-4829e776a399", "comment": "Malware payload", "value": "6ce72411d1809f0d7c05eeb719bb63512779485f14da881766ea957310124ada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725338, "uuid": "5ddf17bb-3274-484f-a737-b222f8396024", "comment": "Malware payload", "value": "72dbfb21c43d6def626a82753257bb03ffafc5ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725338, "uuid": "aa6a82e3-06b5-4953-ae09-cf844811c380", "comment": "Malware payload", "value": "cc2f14e4376a826c4b67fd4d6114b027ae52559ec097a254e278cffbad8d82e3e4b18812df421901ce4d7969886efe6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725338, "uuid": "09369261-0adb-403b-ab7d-862b0fb27661", "value": "T16F03C66AF89CD712C44130B3284754C7DDBE8985903DE7B2F59CBA2239942FC66E6398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725338, "uuid": "a08b2d0e-9314-425f-b773-27a683de4bfe", "value": "768:DaKOTAOQxhgGOpoKeFnjwZCoz6879HeqeYN:vpDgGOsFnAC468NeIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725338, "uuid": "27613f41-7e4d-4bc8-8525-38bd401e85d9", "value": 38636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725338, "uuid": "e495a937-a234-4618-87b2-252ebc5ac5f8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725338, "uuid": "d3dd1066-376f-4103-b793-fe99cb026fef", "value": "SecuriteInfo.com.Trojan-Banker.AndroidOS.Octo.3817.9256", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f20596-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690603, "uuid": "5ea7e328-66c4-4b49-9e80-986810e2ef84", "comment": "Malware payload", "value": "b7f60d1c167302a5028c47ddd06d5c79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690603, "uuid": "b78edef2-5905-49f6-993a-d59a9a345ebc", "comment": "Malware payload", "value": "6e855e9b6706e7b583345ce8fff8776c63ef5b36cb897cc4ed4a452722d3ad89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690603, "uuid": "a819aa18-a895-4a80-9ee1-8eb9963635f6", "comment": "Malware payload", "value": "f3a37108e44d4be9b24583c0eca69f369d96ec36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690603, "uuid": "1af8c22e-59f7-442d-b6bb-7b34041bb78b", "comment": "Malware payload", "value": "14d3950e8c3620fc39ff97558b9559ba48828a8299aaa9e42cb2c5070972b6f9b45b44ddd1968782235f47c0285618e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690603, "uuid": "e4abd95f-9131-45d4-b260-a15b873b7c0c", "value": "T10FF4126065AE9B36D27BABF981B0700553F554123833D7AD9EC520FE3A637809F16B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690603, "uuid": "31fb210d-0748-498b-aea0-9c104d2dea72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690603, "uuid": "25ef58dd-e632-4e66-a2c7-c12262a5463b", "value": "12288:3rKh+xGb/8gJDXPadzRX6gBlokHgcszDOBIf1NSaYA/bMzpJUib9TrpP5xVxhNQ+:+h18wDfadzRXxlokHOOOf17YckpJ19fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690603, "uuid": "8282b06c-9df3-4def-a041-9797722e65a4", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690603, "uuid": "1fb68fe5-a67f-4719-b8a9-d9cdc2447f85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690603, "uuid": "07a5763e-b5a7-49d0-bb37-56a1059dfea4", "value": "Halkbank_Ekstre_20230821_080757_783952.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae813460-4100-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692718167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718167, "uuid": "f09051ca-fea3-4878-a962-009f2bb75a87", "comment": "Malware payload", "value": "6e66f0bbfb4cb57622b6cf0f7bd3becc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718167, "uuid": "3ce84a25-6c5a-4643-bf0d-8c1bc9ca5eb2", "comment": "Malware payload", "value": "700d1563e73cf14afc678a1244964b0352292042dfbdd84f51a943012fd15660", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718167, "uuid": "f7b1a410-9229-4248-a040-83423fa05711", "comment": "Malware payload", "value": "1d3e1d1058d3cee8308fc21a575e32a4509e54c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718167, "uuid": "0aa6de9e-69c4-4644-98a4-89ad79e1d685", "comment": "Malware payload", "value": "231dbc5f03103f408bc773389fb007f39c933f788d63dc4f0fb0991deecc67d608f7ba75702102a0faeda7218c7fcbc3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718167, "uuid": "223899d7-24a0-48f0-9176-d5efbd8b44a4", "value": "T1E8737D45BAD2C871E67E09316464C6A16B3E7D124EE19DAB3B89063D0F312C0DF35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718167, "uuid": "a52b9398-832c-4ec1-af88-95d371dfdb8f", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718167, "uuid": "b6cad74a-0bdf-4ed6-833c-30620b879747", "value": "1536:iNEi7fdKoQocShCBPFvh2X/ciZceSsWfcd5/V/UeYtQD:2lQoQocNBPFvGek5/t4QD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692718167, "uuid": "a8c0f215-0b32-498c-b067-66787cfa4ef9", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692718167, "uuid": "8a8df613-a6fc-48e6-aab0-a6128ab1ebff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718167, "uuid": "95092627-7acd-4a4a-bb30-7fa97e83bc54", "value": "SecuriteInfo.com.Trojan.Loader.1704.28759.23768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9285171-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692689812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689812, "uuid": "88f4bf01-8f56-4b11-bcf3-00d6c91e533c", "comment": "Malware payload (Loki)", "value": "fa5ff41cfb3a0e7f3e436897aa01d49f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689812, "uuid": "baae1007-0a7d-4575-873e-d175de8e76aa", "comment": "Malware payload (Loki)", "value": "705c66e0a758fdb06400d480c3b890de5e65f2e748c6a40debb8b8a892dbf8ad", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689812, "uuid": "7b2c06b4-50b0-4d5c-942d-693fd9f6ca5d", "comment": "Malware payload (Loki)", "value": "05d246fce4aef96dc45b175cd6ea00873db88ed6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689812, "uuid": "b8059bae-f883-414a-9470-d0d6ac7d105f", "comment": "Malware payload (Loki)", "value": "3097e1b91f0dbfae2360a246c9e4c2ed1943b944dd9b440bd45cf8fb00f18add7d5baee33dc79f570edecb794db6a272", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689812, "uuid": "4bbe0cb2-4827-4876-a049-a4b79c600ea0", "value": "T12575F00398009FC7D41D8BF8BE630EE54F1B7F18A99578DB15623F9B3B316A2185A21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689812, "uuid": "556e7af0-da4b-4c65-9ca8-64c71568294e", "value": "24576:yrsZyrw6VZjKaWlEzp7aVZyew6VbjKaWlEzp7aNzdlFZRFQA3QpWxgEtw3a:yrev6VZjKjOzkS6VbjKjOzidPF/31Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689812, "uuid": "56a6ed50-3d3c-4c0f-ad15-dcb29a43bfdd", "value": 1580544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689812, "uuid": "f0da19d1-6406-4ac0-8189-4acecb12bffb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689812, "uuid": "e5ddead1-e16b-4124-a0e9-b52ba3df183d", "value": "Shipping Docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd0cabd-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690655, "uuid": "2b387874-3d1d-41fc-ab3d-7331ae9363fb", "comment": "Malware payload", "value": "e25debe1ce502de341f7235b2c37b96c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690655, "uuid": "bf2d8fdb-5da8-4a66-93e7-54603f945990", "comment": "Malware payload", "value": "70a45afc3666b4fcaad541d8fd4f002f300470b22dc5070ab5d0ebbc8e101417", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690655, "uuid": "3384e020-a980-46a1-8f02-dadb2c1647e5", "comment": "Malware payload", "value": "dedd010363b2b553b875cd35f03bf178ccfaa3a4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690655, "uuid": "13ff1827-d186-4c16-8026-1dff391a7353", "comment": "Malware payload", "value": "96e7bcd655125ed303cbbffb60845d020dd2cce2a7f0b62f236bc55a91a9d6bbcbf50ae7d735d1410bcf60ba96d2d551", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690655, "uuid": "0c9ed98b-b8bb-4501-9fbe-9c848b677756", "value": "T159A4126F3FCBD478DB076036900084A6971EB0A4B157116F5BEDAA9A0C70DDC1B99DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690655, "uuid": "c7be2d6f-d35e-40a2-9215-368b7ac39f4a", "value": "12288:98QlP+9NW32j29pBucycBSvwznel8YGbQnGeHhmP:98YSjyFBSIztQnGkhmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690655, "uuid": "15c255f3-d8f4-4bc9-972a-bf63535f472e", "value": 456251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690655, "uuid": "743748e6-26f1-46ad-bad1-e9726c26116b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690655, "uuid": "838cab09-eaed-4a2f-b3c6-271a2b50092a", "value": "Invoice no17684.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee32ba3f-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692704530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704530, "uuid": "790d8cc9-c2db-45cc-932a-b5d216d00444", "comment": "Malware payload", "value": "7d3f95448e0b975dff9053f28c996e29", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704530, "uuid": "b070f88d-af69-43bb-bf9a-21c18a307c88", "comment": "Malware payload", "value": "7155d582f0b47b7fef76e2004694484797193d4a4f5b692165059d5d323186c4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704530, "uuid": "f3d7c668-96a0-4a3e-88e6-cf9e47848cbe", "comment": "Malware payload", "value": "3d36a5b3736b5e99dc51c5964c26e5edd4f69d42", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704530, "uuid": "6a5e2523-56c5-4a39-ab4c-a885ac9f484a", "comment": "Malware payload", "value": "22afdf6f595074b6e5f7c723811a7686dde3bc881c285caac977c5ea8889775018d17dc5861f2ca7204eb3fc2ef8efe6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704530, "uuid": "983af1c0-3bd6-47c3-8696-7d3d74fbe300", "value": "T1EA85BFB876047DE6267F576BDE96ACDD13B61A239ACBA4CC806477C305A3375EE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704530, "uuid": "ae70f7e7-50d9-4d29-a9ee-2e47211b1210", "value": "24576:mlJVuliL2ZPdY+y4+1cfyoNyOoW1SA58iRnQ87YaEyV4K4GlJsqsScPS11ZjcaFX:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704530, "uuid": "1a784599-8cf1-4d92-9899-4c52a4c5e266", "value": 1829556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704530, "uuid": "92814183-a0fc-4faf-8e4b-ea5eba9d1560", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704530, "uuid": "f3c0587e-4136-4a00-b9ec-4d3a8b9e88ec", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.13087.12539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35ad1dda-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690477, "uuid": "2d73aad2-34ec-4722-b47f-9a3f45227e82", "comment": "Malware payload", "value": "d0a479f856722693d79a76b27588e32a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690477, "uuid": "5643f175-8173-45f3-9fe6-674d7618584d", "comment": "Malware payload", "value": "72006dfd34f5b043e6763b16ff8399382e69ad356e8c6b9e71ec908674dab55c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690477, "uuid": "d3d6fd3c-0efa-4532-a80e-8586392445ec", "comment": "Malware payload", "value": "fe59316799f6e3e35a91ee2d86ae72360e8da856", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690477, "uuid": "d6c89827-e395-46ab-a40f-9f5f60baf0bd", "comment": "Malware payload", "value": "0db8eeb875c77c63377c49602e5c678765f75986472809c6c03f5b993630cfb5a3d5d538be3249e35c67cc1dc3e5370a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690477, "uuid": "626b6a58-c1ce-44dd-8b49-57ffc3e45b50", "value": "T1FBD423A0F3680719F43EA81B010275B79D4C26353707EF75ADF8E4EA9167A1B18D8F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690477, "uuid": "e2fe1540-3eea-401d-9d05-0ae5b969c101", "value": "12288:h/4k6eATSzNgtiT4OA84SQb/SxX7yhX1PT6e32cnpE01fhmrSmzjlb3:YBicOAIxuhlr6e32CJpmGmnlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690477, "uuid": "4a1c69ca-6dbf-4418-a439-eaf8b239499a", "value": 622823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690477, "uuid": "3b943982-4d60-431d-99bf-d959ae5055b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690477, "uuid": "9ce907b5-7193-42bd-89b0-0c14b33e56f0", "value": "New Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7362885f-408f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692669535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692669535, "uuid": "734d182e-e770-4bbe-8dfd-235a45ccc9a3", "comment": "Malware payload", "value": "2c4a0cefeaa7da35992d1ba93c93f6fa", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692669535, "uuid": "c9b7b7bf-0097-4de8-9ca8-913c72b93019", "comment": "Malware payload", "value": "72590b59664bf215bd407f46b5296cdd33db7721a77f5e80d23f61b73ce984d3", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692669535, "uuid": "4b2d33ae-6365-4f9a-9830-312edda9e48e", "comment": "Malware payload", "value": "d100d32ddee108cf451eeb71c4c7d34a17b98aa7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692669535, "uuid": "a1ee2480-d657-485c-aa4f-ecc2f421d700", "comment": "Malware payload", "value": "589dbb3fd2139de606d04cd6c9899d2be2ae035bdafb6ac285ac5aeb5e68e61b7607056542e8912e9c7c8cb0e88534fc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692669535, "uuid": "13f12540-c252-44ed-aa71-f6b79bbe3dc5", "value": "T1AED50182F758B42FC877C0334AB60636625A4C5A8A46E3531559B36CBDFBEC44B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692669535, "uuid": "0f31df14-cba1-46fc-b0cf-a0a6c3498070", "value": "49152:O+m0Y2+I6UGHBERoiBPeWp9AtCqy805sQwZt70lJ0NtxpUY6j:JoUGriBPVjAtCqyHq9k0Nbo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692669535, "uuid": "83cfc335-240b-4516-a43d-b18d25abbb17", "value": 3000963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692669535, "uuid": "fb46dc1a-5851-4b1a-8057-3362a32c0f08", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692669535, "uuid": "241b7469-a352-431c-9fa5-aedbe282d857", "value": "ss-kids.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "064335b4-4109-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692721751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721751, "uuid": "29877eb4-3f98-4bf7-a556-101929f82719", "comment": "Malware payload (Formbook)", "value": "bdd4f6fed94ce135a729f834ebdf20c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721751, "uuid": "24ec3faa-55b7-4da2-98dd-1fb4b14a5adb", "comment": "Malware payload (Formbook)", "value": "7496574bfa590d4e3b360f0a485e1d36571b1973fcbe23ec0236700090cc236a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721751, "uuid": "52bc198f-7582-413a-9081-19684a1162b5", "comment": "Malware payload (Formbook)", "value": "52f349abe9ead3eed171fdd67eb9b2fc8b5546b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721751, "uuid": "2c204c0a-b99f-49fe-9ea8-dc5e5bae1ab3", "comment": "Malware payload (Formbook)", "value": "62538c99355f214dbd8ccbd247db21151231d519436c80d49e4a3f944121e3e4c1831090de37573b61e816625a5fae3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721751, "uuid": "8e4f6847-332b-4866-a738-68fd74c29104", "value": "T15415E03536261F92D6F33837AE04D5D3878214F65E6858FB5C1F310828CFA6A6605BBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721751, "uuid": "1d8043b2-b61a-4517-9d6a-3857a0660639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721751, "uuid": "edce778d-2626-4309-842f-6d226c355eb4", "value": "24576:Sc/+311f4Mgm/RLr/7IrFF5smjF3gYV06:4hvDIR/F3gY26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692721751, "uuid": "295fc696-974f-48a1-8ece-67b5d192c390", "value": 921600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692721751, "uuid": "5232dfaa-b6f6-46a9-a46b-1819b9070c31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721751, "uuid": "48bac083-6aa0-4395-ba8a-c0bce6a4073f", "value": "SecuriteInfo.com.FileRepMalware.18604.15295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc120740-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687320, "uuid": "81d19cab-913e-4ad7-96f7-b90046b56b7a", "comment": "Malware payload (Mirai)", "value": "430337e9725580592b596a1bc78aaf2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687320, "uuid": "c53c4337-edde-426f-a4c2-e0c2987a728d", "comment": "Malware payload (Mirai)", "value": "74ffc1c24ef9af72053a0f34e74b126e4180853cee054cc6ee303f51124be313", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687320, "uuid": "53582ab5-1c75-4c93-873a-38445f8d1f24", "comment": "Malware payload (Mirai)", "value": "c9d1fa56b14b6155312fef24c13319811de407ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687320, "uuid": "630d7a13-1c1d-40dd-a9f2-8770bf2aea55", "comment": "Malware payload (Mirai)", "value": "96bbf6740055e33fd528c30c49b80eb987370c1f2e2a4d94f234ebd3775ab9604e5cb0eafee0363e53e561245e8fc3a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687320, "uuid": "6df9bfc0-c82f-44ee-a058-36ba58ae35f3", "value": "T11C338CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687320, "uuid": "50b1bda1-8518-46ec-b5a0-03a584c515f0", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvC:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687320, "uuid": "953e44aa-e02f-404d-8050-34ac8666baf9", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687320, "uuid": "99cb8427-0f7a-46d3-9b71-95577ea9de94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687320, "uuid": "a74b9cc7-fd07-4346-9bcc-744685e4ecdc", "value": "430337e9725580592b596a1bc78aaf2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eeae012-40c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693901, "uuid": "6cf93b3f-e221-4904-8ecf-b7fb34974df8", "comment": "Malware payload", "value": "eba8a57dcc25b3bc42054936ee6d8718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693901, "uuid": "d2586a8e-c983-4f25-9a4b-b684da1e9f0a", "comment": "Malware payload", "value": "75972e8e47bb1f56e0ed7a13e6f5508fa7c104ef902f344b065842f99208948b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693901, "uuid": "f78eb578-a18d-474c-90ae-06711cdc28c9", "comment": "Malware payload", "value": "b69d520aab862e33e9aa849bc15d357a10065d4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693901, "uuid": "bd6bfdb3-e883-4296-8de6-aeb583fa9992", "comment": "Malware payload", "value": "6e2cc7ace4659646cbb0235576a204f2e2bfa72b46ecc535db150536a30c8e7aae0bab32d71f114919465281fff59df2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693901, "uuid": "ea15c8a0-cc97-4fb4-a0e9-cf4510434692", "value": "T1E8B64BC7F85111A4C1EED37086665656BB713C894B3023D73B21FEB82B72BD4AA7A314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693901, "uuid": "713aa0cc-7601-42f6-bb42-e75c5a93d223", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693901, "uuid": "fb05ed67-ecc9-4368-b364-f9db2502b469", "value": "98304:5hrusSVqOuvxCOLRuk5k2efbEnAwVDzGjGlmM6gdw:5Rvxp5k2vAwVDAGlmMNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693901, "uuid": "f68c2134-600d-4090-a895-fc475c73ee22", "value": 11289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693901, "uuid": "cb714156-fb59-4aa8-ace5-ff82f47b60c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693901, "uuid": "5d0e79d7-f45c-4940-b759-2ffa1252dbb0", "value": "75972e8e47bb1f56e0ed7a13e6f5508fa7c104ef902f344b065842f99208948b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de35559-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692693202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693202, "uuid": "5ab415cd-1c39-4f06-ba4e-bbc2da6e543a", "comment": "Malware payload (AgentTesla)", "value": "114447fa6f663aed141feeb4dc72f9fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693202, "uuid": "d0501c81-c835-42e0-9248-557a4f480411", "comment": "Malware payload (AgentTesla)", "value": "76de16b596ad3700130d2d2c02a9ca144ace99bef78a7088b93f069673cbe972", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693202, "uuid": "a2f70e4d-ca3c-4e53-9330-d4c742a05fc1", "comment": "Malware payload (AgentTesla)", "value": "ae13f7f1caabe308e65eced72be6a11896ba6fa3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693202, "uuid": "7ab83338-9fb8-4a93-9bf6-278acb5433f5", "comment": "Malware payload (AgentTesla)", "value": "3006a04bcb9cb44a45b0906a6c400367a2c253ccd57cac8c3c2cbf202ccac39c8383e34a9133db203b81ba4508601be9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693202, "uuid": "49374a2b-8c0f-4cd6-9e30-4002d6b7af4d", "value": "T13305D11227A9D71AD6BE47F9D1600CA08BFEBD17E556E35E0D8038ED2872712CA015BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693202, "uuid": "547c5430-4060-4273-9cbf-6d4d0d562b7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693202, "uuid": "61ff8bf0-139d-40b2-88a5-f26dedff3f94", "value": "12288:4UVv25w+mBmtN2d1mbTLYLAe/LYWuB2xmiwQZ/+t7Qk61Nh8CTAKOr1XqsWS62:4dmB4FLYEg81Axmiwy/+tf67qXLWS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693202, "uuid": "681d3aa4-a59d-4073-9ee3-5e491981c928", "value": 866304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693202, "uuid": "1a1fbe7c-cce0-4e2a-aea8-553fbfa00ce8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693202, "uuid": "928fde7c-a0f0-43c3-9558-171d30465b61", "value": "114447fa6f663aed141feeb4dc72f9fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c457599b-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692728941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728941, "uuid": "8b1cc2ec-de1c-45f7-8743-de69b8f40201", "comment": "Malware payload", "value": "f98f51b943c0cb1c16e500dc0e37b677", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728941, "uuid": "203139ca-40b3-4004-a4c7-1fc07ec66059", "comment": "Malware payload", "value": "76f895e5dff37e75660e6415896450079d9fed66f7b88c34ac3addb7658fd194", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728941, "uuid": "aba7f961-839e-46cd-8cfd-9bd9c66d7cd6", "comment": "Malware payload", "value": "c24c3d9ae4979c6aa05a4e60f9d075a935c00f6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728941, "uuid": "0a7360a8-a522-455e-b439-9a9534b33854", "comment": "Malware payload", "value": "8c81be3b37783213db0c32c6ccb3cbf53beef01468dd57a204274fa677e630f4808e0622156e6fc37c2f88c94c0a195f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728941, "uuid": "cc8ef7ae-6d9d-4654-ba3c-b13282606f3b", "value": "T1D2737F45BAD1C871E67E09316460C6A16B3D79114EE19DAB3B8A063E4F313C1EF35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728941, "uuid": "af30d46a-b856-47f3-8994-3876b6cbe434", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728941, "uuid": "04067574-f6d6-4132-84a1-3d08162e16ea", "value": "1536:NNEi7fdKoQocShCBPFvh2X/ciZceSsWfcd5v+/12PyXxGn:TlQoQocNBPFvGek5vESsGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728941, "uuid": "6ee964c9-7f61-424b-a5aa-cb0995c69ed0", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728941, "uuid": "13ca795a-ef8a-4cb1-9ac4-8768bf87de00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728941, "uuid": "8efb6af7-06b1-4487-878f-27cdcad1a839", "value": "SecuriteInfo.com.Trojan.Loader.1704.29451.1133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c9b6d6b-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720661, "uuid": "6e37a073-2f37-4a46-8ecb-0d5967033102", "comment": "Malware payload (Mirai)", "value": "59d2b8a8c9d41a058b612957fc4fa43a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720661, "uuid": "99ea7a97-3b6c-4fa4-a996-7251592439ed", "comment": "Malware payload (Mirai)", "value": "7ac0313c56f704cc9cf5900840df56f9da466b0e2046a6df283f7c5a156f0e75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720661, "uuid": "e32c7f36-a4f3-4db2-948c-ada0aebbbea6", "comment": "Malware payload (Mirai)", "value": "d4769efac8cc943d59149377367f1757098bb9f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720661, "uuid": "ccc5adcc-fa41-4415-9167-dad93761abfe", "comment": "Malware payload (Mirai)", "value": "9f47f3e5380587a84e54373d53c6568d55c5ee884e309b56eb87a73d0743283e092126952e3c01a55500e5563c31981b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720661, "uuid": "0d2bea07-aea6-400a-b694-337745b294bc", "value": "T102D30A56F8819B12D5C111BAFE0E124E37131B78E3DE72026D246F747B8A9BB0E3A915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720661, "uuid": "3e13e7e6-39a1-4527-a0f1-75c8a9105e27", "value": "3072:PUaGXUWXMt07gqaAOcW8/bnoC+dAHR5hz:P9XWXQ07XaH3FXdAHRvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720661, "uuid": "10d085b0-9505-4ccf-9c40-f6750035586c", "value": 137020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720661, "uuid": "4f71af28-1cac-4984-ac86-544b5f9f0f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720661, "uuid": "158fd81a-a949-41cc-a7ac-2a63479e0137", "value": "concakhbtandhuy.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e296d4a-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738622, "uuid": "257c17cc-b223-4dc3-9803-106939d6bb58", "comment": "Malware payload (Mirai)", "value": "8d1f12b760380ff366a0dbde97dd3102", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738622, "uuid": "5a56295c-c08a-42eb-924f-e9ebf75d7396", "comment": "Malware payload (Mirai)", "value": "7b759e6916b8589638da80fc5252cb5efd95ef3d3262d49ad52bfbe75a39b352", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738622, "uuid": "549a5a82-b193-4c19-8e6e-ee6deb13d7c3", "comment": "Malware payload (Mirai)", "value": "c003e228d59c088d6684d96d9218d18e27cdc15f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738622, "uuid": "ef0486e4-5679-488e-bdff-d19aea185040", "comment": "Malware payload (Mirai)", "value": "db0d1caac0f5b10b95fadb624f54870d503195db040bca2430391fa71070f1b3968f590089459cea4f126b4763082272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738622, "uuid": "dbc65d08-6b8d-4949-b90e-7c5cf9707d20", "value": "T156A2E029D345AEF4DFAF5CA452C2C2C276E647C7278AC8E240EEAF01251A046B788D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738622, "uuid": "e4bc7428-f5ce-4a74-9bb7-23596e297b41", "value": "384:M/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5OW8M4uVcqgw05VxJG:MRxsSVsMD6xiJJE5zRWNlj4uVcqgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738622, "uuid": "4af599b9-a493-4e0c-8eb6-f97b35bb48bd", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738622, "uuid": "e5aebe38-e91c-4be5-965a-cc713654d565", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738622, "uuid": "f089d157-df1f-48ed-b466-7707f3af1e76", "value": "8d1f12b760380ff366a0dbde97dd3102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d06349f-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715964, "uuid": "6200e272-883c-482f-af65-10f90d0c62a9", "comment": "Malware payload", "value": "ffd686da1923301cdc6190a15052f15f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715964, "uuid": "8879f6d7-acca-47cc-b646-e9e298fe287d", "comment": "Malware payload", "value": "7c91058133a449a21c3032d23853121b90fc990a8f5a33e8eb12497230a49399", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715964, "uuid": "e1dbe2a6-e81d-4ce4-bd5a-4540d9e84475", "comment": "Malware payload", "value": "db2321cd93e92d13269702deabd1e442bf4f4014", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715964, "uuid": "6135f85d-f86f-4977-9311-c96e206fc524", "comment": "Malware payload", "value": "ecf514e840ad02bf0ceb5ffe207c20b5ce51196930d69f9b7a0bc93d1a7656b22729743d049fcc0b0c49aefaf3aede35", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715964, "uuid": "f0a829f1-b07d-4835-abd4-77a616d87754", "value": "T1C4F38D1971D1A0B2E4F30976D5B8AF12446DFC111BB07CDB72E61A9E19320E39E39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715964, "uuid": "c1643338-761f-4fed-a8fb-b3e94fac6872", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715964, "uuid": "efb35d7b-41e4-43d1-976d-151a633f4eb1", "value": "3072:l5K/B0toLQSNJ3lZHQsozTS+SMqqDL2/TrKvmG:lcytwt91yTS+xqqDL6HKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715964, "uuid": "fb187011-3369-4a26-9ec1-a51300631a67", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715964, "uuid": "e2b36819-7a27-46ab-a3c4-0c5da884d2e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715964, "uuid": "9288511c-2a82-4f89-bba1-86598b5a59f3", "value": "2023-08-22_ffd686da1923301cdc6190a15052f15f_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6eade2-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692689735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689735, "uuid": "f86c5eb2-4f82-41cc-b7be-9fe245307251", "comment": "Malware payload (AgentTesla)", "value": "aa6f835df3489adb6f029c9a4d46cd12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689735, "uuid": "baff33d3-1f04-4aa3-8881-9ae6a8eb909a", "comment": "Malware payload (AgentTesla)", "value": "7db30520cde8d37f8875299b1182c0e56a0a47d995117c1be330d08b4de86666", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689735, "uuid": "d6077f74-354b-4b30-8114-60682838d436", "comment": "Malware payload (AgentTesla)", "value": "694d538365aedc22b84b2618ff159ac5bdd93b36", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689735, "uuid": "c443be3d-e299-4ebc-8558-fc1721f84536", "comment": "Malware payload (AgentTesla)", "value": "be5a07bac2006c8d180c3d75184b7a9950a97f06dbdc6322e17408a8a2919a1785164003fa58ef82074653a6d3f4cbce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689735, "uuid": "dede922e-99b9-484e-86cc-907cba5a6759", "value": "T17394CF2732A49721D4B877F8A066614117B3BE5A0470C30A9DB87EE56AB3783DE447CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689735, "uuid": "f1332b22-549d-4a64-8932-1f9c325c73ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689735, "uuid": "1ba10d71-8483-416a-8171-4a808a8a29d3", "value": "12288:6Idy41a0G8DKVoMUyW1/NIyGbNVim6omwJBS:6jz0QVcv1/NIyGbi2mwJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689735, "uuid": "a73c6456-9b06-4d43-8d93-1adefefa3747", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689735, "uuid": "9adb4cd7-47f9-40b7-a4ad-8d1feb71c291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689735, "uuid": "2e5f97e7-3d73-41be-af6c-3240195bbb31", "value": "SDQ0009000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ab6e7f-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690522, "uuid": "97c20d6f-579f-4591-a67e-5dc8e0fc87e2", "comment": "Malware payload (AgentTesla)", "value": "926ad1b04f5753e749f0e024cf6f61a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690522, "uuid": "a23eb482-6d1a-4cbe-ae9f-68c40a1c2a5c", "comment": "Malware payload (AgentTesla)", "value": "828107b686c52c28cd01c0bf81e55d7aaf8cf8953c775380b6cd3a98c890ed9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690522, "uuid": "1e234387-25e6-4fa8-a6f8-fd33e47d5a3f", "comment": "Malware payload (AgentTesla)", "value": "24cc1d23256627e8289c2db8b44d6084f96bdc87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690522, "uuid": "5ef4a029-17be-4bbe-820a-09be3267afb4", "comment": "Malware payload (AgentTesla)", "value": "44dc87e3d7b23a53c63784902e23958e00f7a589e040430bff25ca0660dbdc7e07951d3dcfa96ebd6f70fbf6c34a1f9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690522, "uuid": "4d8adaf2-5324-42c7-bdcf-7c750d9a141d", "value": "T13DD4236F324B122064C7BCA695ACFF54926CBD77435BE4953834A3D44AE1DE84A30F8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690522, "uuid": "cd1de182-1a18-44e1-83d6-1810161f6772", "value": "12288:Y9nWVKnocDFvUzHHEzVRtSH7GeD7UB7/1fNjgxDZ57hAbA5+E1U2SnLO92zK:AsyFsOSH7GeMNML7WE+ZnCeK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690522, "uuid": "b16c909f-5686-4458-9301-53a5142dbd3d", "value": 646702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690522, "uuid": "83a9702b-8d2c-4829-9ff8-9353b1ae3346", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690522, "uuid": "97c49635-26ec-438a-9ce0-2f0e80890de0", "value": "FAL.SUM-Draft-00982.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6619d685-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692693135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693135, "uuid": "73285591-f090-4fc7-aec8-00d00b32cd68", "comment": "Malware payload (Loki)", "value": "57acf09a959e5044663f82d39ea75a34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693135, "uuid": "4e165b4d-3642-4ff3-b846-f321bbb4b959", "comment": "Malware payload (Loki)", "value": "82a294aa5072baca70b941c44def34063e052ef781a1673ebc65071cffba647e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693135, "uuid": "d2513563-35fa-4912-b85f-257cafa6bb45", "comment": "Malware payload (Loki)", "value": "b3d8032237770b7a3c80159f3e7d0a5f6a6b2836", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693135, "uuid": "6afaeac2-1e69-4a21-a458-8c5af8de00eb", "comment": "Malware payload (Loki)", "value": "91398432a29b9af753f6f5af5645e6d26aa4439c96155170a55ab7cf77069e2914a11b043938cc60cfc79f17b79342ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693135, "uuid": "90aeb738-eb53-4a14-b986-b7e4ef658b63", "value": "T11B44AF12B3F19832F52346318E65C3B46B2FB8714FA56ADB27855A3F0E741E1CA75312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693135, "uuid": "8cc945dd-1b98-43b8-9fd5-51818cbfbdc3", "value": "a58360eb10a18d5dc70efe7d39616fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693135, "uuid": "ddddd5ed-a07e-4e34-a871-c6ee9d50625b", "value": "3072:GNxCE6XhR5xszbY6Q5UXoCf+vUykR4SztQJnN50RrXdR1fAi:AshNwb1Q5UXhGvUykRAdOdRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693135, "uuid": "dfcb7dc5-c7b1-4758-a140-88bfd4e384a0", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693135, "uuid": "11963fb1-5615-4ca9-8121-e00c299a1f45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693135, "uuid": "3f399963-5efa-4d56-96d1-8de5489ab474", "value": "57acf09a959e5044663f82d39ea75a34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03381bb-40ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692710412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710412, "uuid": "74dfefc9-704b-415d-9903-c052374272a5", "comment": "Malware payload (Stealc)", "value": "c835834522989e067c2602c16df648c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710412, "uuid": "020a1141-16af-45d6-8e4d-91037164f751", "comment": "Malware payload (Stealc)", "value": "8320b1984cd007f2e819d2572382e0d231feae3b91ec2d30163665aa1295cdc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710412, "uuid": "0bf518fd-7dfa-482b-9b59-e7f8205f9951", "comment": "Malware payload (Stealc)", "value": "a7083673c00fa5d2df7cf8db6f81f076b229c461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710412, "uuid": "19a16cc7-3e0b-4d19-a914-db9af543b3bf", "comment": "Malware payload (Stealc)", "value": "3ca62a79fb4c9b5dfd5cd4447d20a3cc852948a57ef7de784cdef5506f687d741cf31b10bf11227ae665e7f117d6f50e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710412, "uuid": "a95ff8a7-2785-4ba3-b782-a0fd4e74c67b", "value": "T1F944BE22BBD0C432E52745318E6AC2F46B2FF8715FA56ADB23944A3F4E712E2C675311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710412, "uuid": "f6d86de0-0e8d-4a10-9c5c-fe2989e75848", "value": "cac4ca706752b4093b870401cdbc4288", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710412, "uuid": "bfa23f87-b9ab-42a3-adfd-b7ecfd18251d", "value": "3072:te/hsJleUs5egqt6dy7HPd7ygeE2i2mLGP6ctXrPjU5MKHnMOj4/nJCduHQLLi:8ucUKqsOV7ylE4maCcCMSEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692710412, "uuid": "ebf01512-f225-48ae-b57c-c8d483e3c502", "value": 273920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692710412, "uuid": "845d9343-64be-4f06-81d7-156a3e48a71c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710412, "uuid": "22b02e45-a32f-4a84-b1a9-7e1d55ea0f4a", "value": "c835834522989e067c2602c16df648c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b32f132-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692693144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693144, "uuid": "1ae643ad-d2e9-4fe0-9059-47024f20c8f9", "comment": "Malware payload (Mirai)", "value": "d0b06071375d80ca359301fa54ad3d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693144, "uuid": "14ef521b-c7be-4959-bf4d-208ced71cc84", "comment": "Malware payload (Mirai)", "value": "8433515350b8e5d6d37ed9eaf21b85d949fb3d7e73e4f83ee311e542c8c52ec8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693144, "uuid": "da6589db-5ed8-46ef-a411-e4bf39c55282", "comment": "Malware payload (Mirai)", "value": "44cd21d930ac8379f952f27f8e84fa4fce3d580e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693144, "uuid": "78c21d8a-511c-4d8a-8e0b-87be81809957", "comment": "Malware payload (Mirai)", "value": "c7d5604d5fac74f1da73386da74672b3e5edb3bfab7db7282c34f79268c47517a56b8f7abe23796afa1ce0193691c6d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693144, "uuid": "cb2b37c9-7089-4c11-8f90-a65b6768cb6d", "value": "T18743F68B961D1B4BE0AF56B13C2723E4831DB66152DC41CA3907CE824BB7576A323F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693144, "uuid": "8a86d736-6b40-46b7-8632-2a696b44513b", "value": "1536:fpR7M9MoM+yMuXz3d3oSaq+orSv29WZJzC40+r:WMz3d3J5rSvyiJmd+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693144, "uuid": "a9715f49-3a7a-4629-aeac-85944b94269f", "value": 60508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693144, "uuid": "0a5e8347-3711-4094-ad05-ac98e9198df1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693144, "uuid": "9f9c2a2f-93d2-4f34-869a-10809305cfcd", "value": "d0b06071375d80ca359301fa54ad3d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f466f08a-410b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692723009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692723009, "uuid": "4d5fe171-e6ca-4015-a485-9f6fc15ff92e", "comment": "Malware payload", "value": "4872f94db93b01605b49bc13053be423", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692723009, "uuid": "bcc513f3-58d3-4da5-a214-b57f77a35260", "comment": "Malware payload", "value": "84a9748e5b11d4dd0c01ed4329339318abb70c0c8ed1885efa2f1307e625e333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692723009, "uuid": "1394c522-defb-4f74-b482-68e13d43fbcd", "comment": "Malware payload", "value": "18b5e7ca077da74779ca21f927284d3a7767b24e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692723009, "uuid": "6aded9fa-831a-4c22-95f1-c4785d36a54a", "comment": "Malware payload", "value": "a0ccf7c896186c7d976c4dfeb7f1ba16bfbdff13d22f44dcd3ee053ed51ccd176ff39182ac8b59aa48a94c416e5f4b05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692723009, "uuid": "68f93ce5-660c-45a7-8e5e-80ba40c5fd56", "value": "T122B5334FCA15EF6587C95A0E18FAF886D4FA21434E91D7C17E096C58C03A3E5EEBB121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692723009, "uuid": "ce8e6f5f-f395-419a-87c8-c734d31f2cdc", "value": "49152:E0gBLmfpEdOaWie86ee31leG2jIFC7ut5IqQoGp/cN9Tf:+LmfpEdOzDtv31UG2kf8dEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692723009, "uuid": "be248f88-cd1d-44ad-8075-ef050ae0647b", "value": 2310156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692723009, "uuid": "3c399374-9edf-4327-830c-c115f110247e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692723009, "uuid": "008946e2-a805-46bc-a4b9-b3cc66ff55ab", "value": "4872f94db93b01605b49bc13053be423.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad92929-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690486, "uuid": "449ec566-636a-4fde-8157-224861765062", "comment": "Malware payload (AgentTesla)", "value": "5bc571b4e9a2374dc90f9d7ddd4c5774", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690486, "uuid": "21aaea6e-2057-4b91-8127-83cb4fe4fff8", "comment": "Malware payload (AgentTesla)", "value": "84aab9f68b1051f694f2c83ba4dee20be94a30a86cf75508b6cbed76363c0493", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690486, "uuid": "ceefa203-1b69-4464-8da4-f8f9ae4f46da", "comment": "Malware payload (AgentTesla)", "value": "64874c9bf60dc696596c38dbf5ff26812838871e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690486, "uuid": "9d07d858-8111-4da1-93e0-68915e28c279", "comment": "Malware payload (AgentTesla)", "value": "bbbe41702d2575ba41ffb1370ca2cea5a3e3026307f1c5c9d5fbd4cbb70d2ea5bebc2d68012dce7cce8076604ef32630", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690486, "uuid": "e7120e4b-1615-4614-9db9-58dd48b1d604", "value": "T1E8E4237D119F956852CE24B7611BE0F2620C58BFFB0BA93CF8A476D786E4CDA34045CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690486, "uuid": "093580f7-f020-4043-9b5f-3761194fa033", "value": "12288:+LnWxmB0vO/RhQdcSPgALXaYyMEp7YHmaHl6bL9Xa7WhJhBCDys/PZNyrkNbYC/3:OZB02/CRtLJyNGGaHl6bhXa76DuyeZN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690486, "uuid": "56735499-bcfc-41bf-9871-879838b7e1fd", "value": 718712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690486, "uuid": "dd8c8914-6d29-49e9-bc3c-4ffbaf868325", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690486, "uuid": "7f535f96-1684-4189-ab9c-d4be5f19efcd", "value": "BL Draft-00982.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f47c451-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720665, "uuid": "5b8398e7-680f-4430-85b1-91d88bc4bee4", "comment": "Malware payload (Mirai)", "value": "e1e22f29cb958c59e8d7be05816160e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720665, "uuid": "7ee6684e-442c-4686-be63-260cf061c351", "comment": "Malware payload (Mirai)", "value": "86ae3a9b76ef386a8c04537d8aa38247f05a381975f3a7b0a1c0d2deca42d6d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720665, "uuid": "637ea735-88d1-49df-ac13-642b99974786", "comment": "Malware payload (Mirai)", "value": "0c3340fa2c2ea547cafbbfcfa56da37619457e78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720665, "uuid": "9632564e-30a3-4152-bf62-fa600c35c5b0", "comment": "Malware payload (Mirai)", "value": "c4586cb0f67e335224e52a0ec627aa483a8050325c4c74954c3f8ab79dc4a54750320bc7a5a35189d09223771aa8adc1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720665, "uuid": "8b7fe777-0f41-4e2a-8c3d-555754a5fefe", "value": "T192836CC6F683C4F5EC5305B2607AEF368B33D0BA1069EA42C77A9931DC52511E626F9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720665, "uuid": "e0bb7e4e-ddf6-48bd-b976-d31cad00db2f", "value": "1536:15xbeFOSWy5lr9bcoftZbda3u5yzOlS+tEzi+/j:15xkOSWyzB1thc3CRMhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720665, "uuid": "8d38db6b-2ac4-416e-9cdc-d5e061c7401e", "value": 88424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720665, "uuid": "a3418f7d-fe16-4b3a-9419-576a4705b625", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720665, "uuid": "485816d6-3b6b-484d-b8ad-d4f8b74ce075", "value": "concakhbtandhuy.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88842e3b-40ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692696629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692696629, "uuid": "c792b913-18e0-4e5d-a655-501da542db2f", "comment": "Malware payload", "value": "d29b904d29405c0dd355419c2e963744", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692696629, "uuid": "bd7bcee8-1277-4e89-84c5-270efbb34d42", "comment": "Malware payload", "value": "8776ab0daa233ccd78a81f75262186bfbc5cd2b125c8a3eaef612427673e4d46", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692696629, "uuid": "7613bec6-302a-4cd9-a44a-5cbbc3158be0", "comment": "Malware payload", "value": "3e44473dccdaf02cbc9948338a2ed59a993c1142", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692696629, "uuid": "d745506b-67fb-4154-982a-d9f7dc89467f", "comment": "Malware payload", "value": "b55845f1a704556986c5f07c1c42b94a3f74a2165ec0d4feb5bdab44b1401d9a5e614124dfd30941b498f1890fc54f3b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692696629, "uuid": "b55faef1-2dd9-49aa-8da5-ff8f8b04c617", "value": "T1F5736E45BAD2C871E67E09315464C6A16B3D7D124EE19DAB3B8A063D4F313C0EB35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692696629, "uuid": "9bab5c7e-2e64-4c1e-ad31-1b14f7ae849f", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692696629, "uuid": "ced61036-c368-4646-92a7-1d4fa7efad6b", "value": "1536:4NEi7fdKoQocShCBPFvh2X/ciZceSsWfcd533/pcNKX1O:ElQoQocNBPFvGek53PqNaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692696629, "uuid": "a357fa2a-179c-4a05-a18a-ca1a2c39332c", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692696629, "uuid": "d64ae5e0-8cf1-4349-bd33-a18152935e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692696629, "uuid": "b662cc4a-afbf-4e0b-8717-08114632d316", "value": "SecuriteInfo.com.Win32.PWSX-gen.19133.12437", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "576032bd-40d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692699553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699553, "uuid": "229ec9b5-cc94-4ffc-a727-7016c0603609", "comment": "Malware payload (AgentTesla)", "value": "1f79b164e0cf004a1dbd5aa5a76d8e5f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699553, "uuid": "1ba2b550-9185-4816-b2cd-9b5be54b78f6", "comment": "Malware payload (AgentTesla)", "value": "877c94f939e6572ddc2fbce3470e2e7ce3aa80ec15f853b77d2560c5fb93d564", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699553, "uuid": "9dbe6d80-9668-4fdd-bd55-323c69280bf8", "comment": "Malware payload (AgentTesla)", "value": "363a045a15ad69bf26e4ab8857b1a420a4db7a19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699553, "uuid": "d6b88275-fb6c-4653-b237-162d2ba2462a", "comment": "Malware payload (AgentTesla)", "value": "0a82924c14c11f697059c222c99035e2e3ddc7d3a24b31596f8816cf8122f6681ae7785bd008582e59ed829f54d7206f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699553, "uuid": "53e4fac6-388a-4625-bd67-f924826f2fb3", "value": "T110642323BC6C76E8E708616F0BB27D15D25839DEB8133115EA9C06C61FB3006B7729B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699553, "uuid": "371fff95-4bb8-4bc7-a802-8c9da51af7ba", "value": "6144:WNEdDU8Tk3lV7caTkMuC2+GKp+SfpVgPjKLsAgfMDqKNEGQy:WNbzfTXc+Gqz3gPmLKfMmKSGQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692699553, "uuid": "2163fd2f-a3c2-4747-b3b3-2041f34f640a", "value": 324810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692699553, "uuid": "9ae490e7-83a3-43c7-9d6c-d6a6fac1b794", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699553, "uuid": "de570807-640d-436b-8a83-6b7a0a7e3849", "value": "RFQ20230822_Commercial list_pdf_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd5f331-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687326, "uuid": "282aea5e-0043-46c3-9714-93ea5a3ba97d", "comment": "Malware payload (Mirai)", "value": "0b3f3834ace9ca0d091412bdd9b6fc45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687326, "uuid": "08f9368c-4308-48c6-98cf-1bb753788e66", "comment": "Malware payload (Mirai)", "value": "87f4f40f5b545fdaeef47067cc8fc252637d5111c29abc7306763ea980c0c25f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687326, "uuid": "496e32a2-8534-4494-9d5f-bb1168a31f16", "comment": "Malware payload (Mirai)", "value": "2f512c0e5eaaa7f3fc8301e204b022736c1f5c96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687326, "uuid": "e27f135a-4ee2-4be1-95f0-65056616ccfa", "comment": "Malware payload (Mirai)", "value": "8fe3bb5846dbeb1a6f814434dc4236fd0668c695b73441c5a4f4d4994e745c7dd6f56a744f275926ff39ddb1c2c25847", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687326, "uuid": "0befb099-445c-46c2-8c27-e6aafb9e615f", "value": "T185B2E195E6FB27C3C391C332E07C595DD2761BC10746450A2109729EA29764E87FB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687326, "uuid": "c2d4fd82-cf00-44b5-bdba-13812d587abc", "value": "768:R/QOC0Yhn6ROHWF09cwNPFCnNBxcvyqce:R/nihneF1wKNBavy9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687326, "uuid": "3e552566-ac9e-4534-8a59-82e5a2eddeac", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687326, "uuid": "21547ebf-9751-44c6-acc3-a63e2bf0eaa2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687326, "uuid": "9846af50-6ff8-4287-8e02-45b2a486f2fd", "value": "0b3f3834ace9ca0d091412bdd9b6fc45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43dfcf3f-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738604, "uuid": "947c45cf-8277-40dd-923d-7c1676ed213f", "comment": "Malware payload (Mirai)", "value": "abeda22f33b85ac972f0b45d9b2d772a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738604, "uuid": "79bf9ed3-f7aa-40c0-acb5-2ae49258a2e4", "comment": "Malware payload (Mirai)", "value": "8841b6a414b7f9a5464346b45a18db40e933b180a599057f469418d37e587036", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738604, "uuid": "b70a1826-d626-4cb8-a887-a0b4f8c3ccb9", "comment": "Malware payload (Mirai)", "value": "e4ef66a71e5267f24409f2fb87bb82fd9f7d979b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738604, "uuid": "81135039-5673-454b-a151-af5ab1d9395a", "comment": "Malware payload (Mirai)", "value": "861ecccc7aec8aa9e2446195cfa4c9026c659f5c065aa4b4c6530ab6c3487c33dc384239e32bc4e8e2fd8f08f9b23b65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738604, "uuid": "5847cee2-0603-4ee6-b635-55d012cdea86", "value": "T154E2F197D3719452DE782AF1F96E81CB1A7D4A5CC67B30E31A155718295B0534F3C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738604, "uuid": "a2512b4e-9913-4875-a863-6d0453416cd6", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9X99q3UEL5IG:Porm1vpALgUJQLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738604, "uuid": "0656c2f7-f3bc-4e0c-99e3-9ead02105b0f", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738604, "uuid": "022d6dc3-e52a-4ca8-a009-66b736f282be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738604, "uuid": "21bd186d-7909-45b0-841d-e84b49c60160", "value": "abeda22f33b85ac972f0b45d9b2d772a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0da20c-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692693143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693143, "uuid": "090ba03b-1adf-4141-999c-0d19cd62989c", "comment": "Malware payload (AgentTesla)", "value": "9d19b315735c9bed8d6109277904de73", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693143, "uuid": "b0a60c5a-739c-4f92-8214-037ffa7f6922", "comment": "Malware payload (AgentTesla)", "value": "891506e9adca3e63194bd09965a91917768320436f7b5d940a4ae7a1d334f831", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693143, "uuid": "d8e344e9-f137-412a-9b02-70204ce98b5c", "comment": "Malware payload (AgentTesla)", "value": "498471e14e2c303bb2d02c29532d7a2785a88c70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693143, "uuid": "f9b6b2be-5f18-4116-970e-e9b03f9ad360", "comment": "Malware payload (AgentTesla)", "value": "93f90849902a49de8ee263b4c325dc6353c5f9a6af71794c74c1383755b1dac0e796b3ffa7bee3b1d36d56227683c306", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693143, "uuid": "c09f18e6-9cec-45ba-a095-00673073f359", "value": "T13B05D0DD66A5792DC834A3FDB3199C0DA38E8C394907F087F6E04866EC3EB555B36290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693143, "uuid": "cc6c6b95-2a20-45e1-90e6-9581e8e7421e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693143, "uuid": "eba9e48e-3241-4fec-96b4-9a3e07f456a7", "value": "24576:43pMc6DB5YFxOSoH+CSMOTw9ADKsWdCKikfH/zlI:DNIgSoeCSa4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693143, "uuid": "7fd1fbfe-2780-4583-b696-a729d013ce71", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693143, "uuid": "49fecb39-d491-4fae-8a0c-768dd56ab423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693143, "uuid": "8480a671-08ed-4955-974d-dc34e45d24c2", "value": "SecuriteInfo.com.Win32.CrypterX-gen.8383.12656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301a10ff-40dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692702923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692702923, "uuid": "e184ad6e-8c19-4fd4-bf94-3a219f149bbf", "comment": "Malware payload (STRRAT)", "value": "89581908d9f7d4092b7d865c8c2ac808", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692702923, "uuid": "4578a780-7d42-48fd-a4fb-8ffc5436ca87", "comment": "Malware payload (STRRAT)", "value": "8986d20df56d339452ea5f31c54288408a9d82e090c16f589992b58687a37b47", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692702923, "uuid": "09d446ee-f257-4e7b-9aae-f4f57f116e39", "comment": "Malware payload (STRRAT)", "value": "aa2dcb35a9063371f20f926096c0a7fc0d824361", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692702923, "uuid": "c2453c2a-a04b-4391-85ec-00f8eb52e376", "comment": "Malware payload (STRRAT)", "value": "d515ceec735084d28de64c7bcf75aafbe9ed37c24d372197e190f465cd26dcbe6af743723a354f4ab371d3279eaa84a9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692702923, "uuid": "4395c745-f370-4a5d-be27-d3c7c39af9d7", "value": "T16024027FBCBA42E4D22B687B140E9171A60C06D860A6A27F35FD09851D78E6C0753EDF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692702923, "uuid": "7b52fb73-07f4-4886-be65-dd6740d9f425", "value": "6144:bXwq/OG8JOlw2am6p3u2JR5cz23liz7UyTWS:bD/ObJCwft+2r5qzAySS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692702923, "uuid": "f290a76d-6433-4854-9b05-2ad2268b4108", "value": 224901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692702923, "uuid": "e09c9850-765d-442a-b304-2e0f2a0b9c2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692702923, "uuid": "d7b98f8e-c6e5-41b6-9eed-77956edd2e65", "value": "PO.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87fc3ad-4129-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692735820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735820, "uuid": "5a5ebbee-b0d0-4de4-a183-fdfc545a9240", "comment": "Malware payload", "value": "78703d75e8dcf000f6571304cb1c732f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735820, "uuid": "2ffd45d9-4cc4-4247-a700-de973307460c", "comment": "Malware payload", "value": "8996729638cf0f623030fe6636b991077d7a0969b6d9238779b21b557ac9d15c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735820, "uuid": "def19546-9390-41f7-95b0-524f689df7f0", "comment": "Malware payload", "value": "aa7d73b391eac3367db158e1da5627955a9c2e22", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735820, "uuid": "ef0ad050-66ce-4f95-8e93-9d0eb0ff469f", "comment": "Malware payload", "value": "1663fbe07f54542b1038ed464d9c33e2366b4ef1df7d0391d5d7a19a4481c3498cbee235f9d91fc3e79fc94eb546eb5a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735820, "uuid": "39202c75-d06c-4df6-ba0c-45cdde878d38", "value": "T1AA65F00398109B97D40D83FC7E231D990F0E6F19E895BDDB14637F8B3B326A2195A61E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735820, "uuid": "98ed1b28-c524-4252-abbf-dc8c970963a2", "value": "24576:xrTZy1w6VsAXZSI6ZyCw6VEAXZSsHrt/IbrlFpb6UgT4BLzwqxjs:xr1R6VrEtK6VTESrFQZT6zTaJm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692735820, "uuid": "2ade9724-2b2c-4b30-8dbd-1f9a148bea10", "value": 1418752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692735820, "uuid": "4d582296-a6fb-44c0-8883-4863c339229d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735820, "uuid": "52c0c89f-090d-4f4c-a702-3986082a6ac7", "value": "new order 32724_10.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9ad250-4144-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692747315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692747315, "uuid": "5742893c-5888-4f2f-9f5a-a4ee751d7739", "comment": "Malware payload (RedLineStealer)", "value": "c25fd9d53657d92233259f60d999701e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692747315, "uuid": "159d87b7-68e4-474b-aa5f-47bc25059034", "comment": "Malware payload (RedLineStealer)", "value": "8a6eac04b8ee4b9125039a90e6d76de30e47e12ee9694bf779f6e0a0203ed240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692747315, "uuid": "c7701419-069a-46a8-ac82-1be7fe5a0a88", "comment": "Malware payload (RedLineStealer)", "value": "f0eb077fe1e99aeb73fc6da6faa56e761bd77254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692747315, "uuid": "d7b9c345-16b0-49bd-aa6a-48390da10eb1", "comment": "Malware payload (RedLineStealer)", "value": "fdb5f52248a6ffdbfe3affe3615b5999279a6f418bad817c89622414fca21b25cc428bee8ef3a13b19ae8b00d8bdb64f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692747315, "uuid": "8e03fb98-6c84-4988-a492-ab95571c08b6", "value": "T17D942921F31554A8FDA2CCBE49B68C751BE9288D7A053F12513C3E27A83F94A5D3E9D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692747315, "uuid": "225462ac-523a-4fb3-b952-c801b6771f73", "value": "e9b89dd14503bc763f2f9c58c504e067", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692747315, "uuid": "0bd8c829-bd25-4992-90f9-ff1ff7b7ad88", "value": "12288:ZUFkSw8ZM9Otw8PEk1ORrFxeAgt1hxX20NCDyFhlux:Z8kSw8ZM9Otw8PEk1ORrFxeAgt1XBNCn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692747315, "uuid": "cdb0f283-5304-4ab6-bc6b-aa294152ffba", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692747315, "uuid": "8ab7b865-665c-4b9c-a648-4ca863e8115d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692747315, "uuid": "b790b52a-80c4-4530-abbf-d9a1eced62e0", "value": "c25fd9d53657d92233259f60d999701e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6a07fa-40aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692681311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681311, "uuid": "3ec21416-797c-4560-ab0f-173d475b1e57", "comment": "Malware payload (Stealc)", "value": "3abbc9069a163b18c039db37099e3e4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681311, "uuid": "5e726883-f14f-4f95-8c4d-edc3143653b3", "comment": "Malware payload (Stealc)", "value": "8c3379cd31478527d1d0405a836a59220a3cdd3135661b40d30e1ed509c34993", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681311, "uuid": "abedc9b6-d7eb-4098-88be-d7b1ff5bc105", "comment": "Malware payload (Stealc)", "value": "dcd67af8797d07ea6d704213f62673498e82832f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681311, "uuid": "a041cf7b-5ae3-4e3e-9145-a55ed0a10e71", "comment": "Malware payload (Stealc)", "value": "5fded670763628b72bdc89148a434f5c84b3a6053ebb287061e80a7e5dc6c50639917cecb08a7cfe29bca0133cd48462", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681311, "uuid": "775d29ec-59c6-4d2c-bc7e-942f721e0c03", "value": "T15F44BF12A7D5D432F2238A318F79C3B56B2BB8715FA5AADB23544A3F4D702E1CA75301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681311, "uuid": "444e5ab2-ec2d-49d5-ab98-2090287be396", "value": "e2432ef21843616ddefcfdd02654b31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681311, "uuid": "c58bf4ba-d167-45d4-a88b-79b0d801cc73", "value": "6144:ln5+cLBeODoziEMJWYMIgnHCT/CmBbHReo:lnMctr8WEeLMfHqCWDRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692681311, "uuid": "aebbcead-603d-4e98-a4b0-d8ae14187f31", "value": 263168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692681311, "uuid": "288eb874-a6a7-41ca-8e1b-38ff3e95b6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681311, "uuid": "89bf55c6-ad12-4240-8d99-6bde319cd3d8", "value": "3abbc9069a163b18c039db37099e3e4b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adc2c10-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (PureCrypter)", "timestamp": 1692690593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690593, "uuid": "33e60a33-1457-4b19-8c0a-6f962d52032d", "comment": "Malware payload (PureCrypter)", "value": "63d5a76a6fa8e241653df907c8f048e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690593, "uuid": "49329a78-43fd-4679-bd37-9e9ccd459c52", "comment": "Malware payload (PureCrypter)", "value": "8cc440eff0de4c70b4427d2d0332dd8ccbadb36ead79bd1db5bc67b665bd3fe2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690593, "uuid": "b41c93d6-5f8e-4fc9-b0c6-9f1fe8da807e", "comment": "Malware payload (PureCrypter)", "value": "19d3f1f51eede4e7c9bedd6e3efbdeb39a2c0f55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690593, "uuid": "75a7d892-6b88-41ca-b91b-3fb5554b2c09", "comment": "Malware payload (PureCrypter)", "value": "c999f7edb0d4cea888e9f839eb09739fe6f2e3ae1b85bce2d5b6c90c88bc2967bf006672a21f17f5342ee87e48208aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690593, "uuid": "18943430-bf0f-44e0-91c3-5e0aa7c20b11", "value": "T13D922803B64C5A21D229CB3BC89FF5100775A285B413CB1EF45E230A6D433AADE86E4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690593, "uuid": "29694528-ae5c-4c8a-9fcb-de92dddfac33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690593, "uuid": "31382bfa-cb09-4514-8492-9feef1b60d7a", "value": "384:3TXhfwbvS+GPBXaJNM4smfzxmi/f4Fo1Y7rDfA:3dwYP4NMK3aU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690593, "uuid": "df69ad3d-d469-4ad2-84bd-66d3738c066e", "value": 19968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690593, "uuid": "77c8c469-a99a-4966-b57d-74b7527559c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690593, "uuid": "fe4e323b-1fe1-4eca-8c6a-d6c90243ae3f", "value": "\u00d6deme 31722.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98978734-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689784, "uuid": "54470def-3969-43ab-a938-0c2d5afc5763", "comment": "Malware payload", "value": "344aec43e478218ea592e0eedc9a9a43", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689784, "uuid": "9a232b7b-400a-4d0a-9acc-31b91f488bd5", "comment": "Malware payload", "value": "8da4349af395f2b6bb89302731277940f2d3633a6b3c03e5633695d83ccb902a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689784, "uuid": "7b115bc3-ec6f-43cc-bdc7-e5ffacfd67f2", "comment": "Malware payload", "value": "1350dc057e79086f07478d6d42829b54d17d9fed", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689784, "uuid": "721b821b-b569-4443-a6bd-ff5d31169cd7", "comment": "Malware payload", "value": "84adbcbc23069e782b535809171968673394c07d37b220a13d2d60de6ff28784d4ca80d5d1ebdb8dfbeae2a16b7aae54", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689784, "uuid": "8fd5083f-5548-49f1-a5b0-80eae9f26008", "value": "T1D355E003A8149B97D40D87F87E631DEA0F0F7F19E895B9DB14523F8B3B316A2185A60D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689784, "uuid": "75eb2073-4274-4484-a469-c88ee1a3725d", "value": "24576:crYZyaw6V9HXZSiQZyTw6VJAXZSNLf6ObW0qTAp8t9AwOxT:crKO6VFE3v6VuEVfPWlTriZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689784, "uuid": "e5ed1824-eddd-483b-8fca-efc8eb3c5889", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689784, "uuid": "9ac7e73e-b71a-4c3f-ae39-9d9893c3889f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689784, "uuid": "025dc97c-54d6-47f2-a35f-e21f5b0b03f5", "value": "5890796959.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36f6b42-40ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1692688218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692688218, "uuid": "83f5935f-9df7-4077-a0f6-272913264aaa", "comment": "Malware payload (AZORult)", "value": "e14f22741ba2603e74a78dcbda43c0dd", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692688218, "uuid": "c7fc169f-405b-4a36-bac0-4a8347117b4f", "comment": "Malware payload (AZORult)", "value": "8dc7b9eedb066a8d43982bda09b8df9e8b21d6f1a1dd4f701ddd4b01e9065a9c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692688218, "uuid": "bb847ea0-d563-456d-a210-278d7adc2221", "comment": "Malware payload (AZORult)", "value": "2f1f16522ef0921c710566609b131fed11f66de2", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692688218, "uuid": "d250de06-bb35-4d23-9cf4-3cc54d2801a2", "comment": "Malware payload (AZORult)", "value": "43438a115d2f794552c43ddb32a242ae392aa84fd140ea8684ae3a47ea5b74f801310a03849d995f2fe10b3d6d6c657e", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692688218, "uuid": "6e1be93a-4a12-4b23-8405-560aa5799ddb", "value": "T12E1402582AF0C177E96006329D7B5312BFFAD91132EAD70B93109F997D37261CA0E762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692688218, "uuid": "4eb29888-0458-4bc3-b44d-d445c97c14d4", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692688218, "uuid": "043bd0a0-d2d6-42ad-a72e-362ab1ddd412", "value": "3072:3fY/TU9fE9PEtu9bNXu8WApKEkylFY1FwF94Le5jUrGRcZ4zNaXfPhhl2Xyx4RUp:vYa6rNxWoKEpDOFBLMBRW4zNaXBhl0Fk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692688218, "uuid": "4bd0f071-3a2a-48d9-b620-f40810469bb7", "value": 194120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692688218, "uuid": "c90233bf-d354-449c-b455-c9388b993d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692688218, "uuid": "d5e299b8-1370-4657-9e43-c86fcfdc84ee", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbfc04c-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689789, "uuid": "4b298e34-7c66-4295-9933-f7430b8880b9", "comment": "Malware payload", "value": "e5e74d64e80b60bc66bea1e42563785b", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689789, "uuid": "726188d8-2a2a-4d95-8de3-95ef9d7175a0", "comment": "Malware payload", "value": "90a268cc0130f94d728bc9d2b617fae81779de2f4e4956a42fef6961ea7f1c51", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689789, "uuid": "6c4d56ba-c201-4349-a653-ae12db05d191", "comment": "Malware payload", "value": "c4c5b357ede7798d494ea9fa9642a4cbd4836fae", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689789, "uuid": "bfbff501-3304-4fd9-9317-fc67a6a84c15", "comment": "Malware payload", "value": "36f1e799aa4026655c63485587beda00ce5a81ef33d4d060208be81ebb47f95f258be74a08daa816bb33c4418cf2bba3", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689789, "uuid": "7bc58472-460e-4443-9487-d5fb2a571772", "value": "T12115230476EEC1EAD4F359389C86E1EA410DBC229947E24335DBB3AC1532FA7936D1C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689789, "uuid": "03de8f19-e7bd-42b3-ac26-cef165ac8f02", "value": "24576:xr/+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXIVBdrkAXZSAUrxREoQns2rz:xrG6bV7rzE5rffQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689789, "uuid": "b8080344-52cd-409a-b4e4-872f51b74fc1", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689789, "uuid": "51dbf4b3-ae5b-4f0a-96c6-b169fd032e96", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689789, "uuid": "e10ce3e5-6482-4d1b-8391-af268876d209", "value": "RFQ No. 8202023.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f50e77-4083-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692664280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664280, "uuid": "6ae7662b-273a-4b25-a87c-e184c6fd0af0", "comment": "Malware payload (RedLineStealer)", "value": "45adb4a7be86aa93b76280258e1939d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664280, "uuid": "aac58217-bc07-4696-a691-ecd20bc45b3a", "comment": "Malware payload (RedLineStealer)", "value": "91336ee97f2f34f2da43bed03e48fda811da5a633c84371e66d9a5caea7b87be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664280, "uuid": "70ba0e7d-b2d1-43d3-a021-1905655f0412", "comment": "Malware payload (RedLineStealer)", "value": "2070e3ee907feae8170a995b8abe4d7b5884aaef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664280, "uuid": "353a5286-babc-46ea-b1f0-b53002613f93", "comment": "Malware payload (RedLineStealer)", "value": "49fb6cd9535ec164ed4dae44b9854cda2862278623cdd0d8dd24616938109fb2eb76004bd5a74e4942db36e5e5a96ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664280, "uuid": "7d7ca3b2-6285-4237-a4de-ffe5312e3773", "value": "T1D0059D213B81443AD63230B14D6AE37659BEFC210B1666CF5BD8B9BD6F345C26B3190B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664280, "uuid": "6d5cedcc-b751-4120-8ced-fd47857a5b4c", "value": "034f0d020ac1c43c0a84ba23dcd4c85a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664280, "uuid": "0db59509-bf37-497a-bcf7-2fea0922095b", "value": "12288:PfXJJaJkbQjvRluy4RhsAXzUVaQ0/CvVSo7sG65Wvltb/ruSDCe8pp5qzgZqT6gs:H5JaJkbQbRluPUYQ0qEo7sG6krem8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692664280, "uuid": "b340b694-2f5c-4603-ad1b-058cc76b4c70", "value": 836576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692664280, "uuid": "6e3217c8-fe78-4310-ac4f-6c5e7452c179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664280, "uuid": "cbff1f86-894a-47a8-ad54-88da27bb92bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79523a83-412d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692737405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "e02611c1-48d4-4a6a-9054-25cf0fbf3064", "comment": "Malware payload (Mirai)", "value": "50054d04f9078cab248385ea7c18e435", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "d0cca1d7-b92d-4f91-9cd1-43f309b83d62", "comment": "Malware payload (Mirai)", "value": "9396c24246b7105866feb042857e015d6faad9c2cdf973ca33b54bc03ad004d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "de7103a6-81e4-4cd4-8409-29904891a2a5", "comment": "Malware payload (Mirai)", "value": "d7a31cb612a35b479e1172c2b45dd7617762d1d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "8e16ddc1-0503-4860-8fc1-a3bc013e91f3", "comment": "Malware payload (Mirai)", "value": "efda2f32451864e916ec5b4ddbc2c4823f36bd4cce5641a4b84779f3d87b052b7e387acf720038bf02d432b6b09b6b32", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737405, "uuid": "731d126d-5f14-4f38-a4cd-3fa3b53b745c", "value": "T1E7A2D059BF1C86CBC832293555D9EAD22252FC61F2EDDC0D2940C16BB4A33A95470F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737405, "uuid": "7022b4e7-6b09-482c-8293-9abd7b43c7d3", "value": "384:M0hLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXadmTb+502F2vwA9dWuMW21bAK1oT5:T98o08kxofBE+ZkXaITbp2F2TWul0c59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737405, "uuid": "8a407067-d5e9-4213-8d5b-6c04c6cc5f07", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737405, "uuid": "54ebaac0-8190-4621-b335-f50080a0368e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737405, "uuid": "5337828f-c8e8-4a4e-8a26-1986fa00a1e5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f677e86e-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687364, "uuid": "c5c939e9-eb9d-4d38-aef7-c91f4f2f1285", "comment": "Malware payload (Mirai)", "value": "a12470282c38ad8a6a035ca371cdfdb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687364, "uuid": "994d711b-ffbe-4456-8038-8cf694ca046e", "comment": "Malware payload (Mirai)", "value": "93ba4f0caeef02800672512ffd2c06c28017f7980de756f8443d8c3a35faf5b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687364, "uuid": "8daedfc5-f81c-4f9d-bc9c-b28d2518916c", "comment": "Malware payload (Mirai)", "value": "a28abee604a42f20b1cce2967c987b7d114c2386", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687364, "uuid": "4891bfd6-c880-44a5-8114-7b4ce4261fce", "comment": "Malware payload (Mirai)", "value": "65aa67a896143c839daf6932f3e9122abb289dd752315d6cba2a7b2521a8df6036227ae87b973b7f76f45a9e6882be40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687364, "uuid": "a6ccc4e9-ee43-401b-ace4-f52b208bfd18", "value": "T119333ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687364, "uuid": "4a034ad7-4fc9-40a5-b950-b9cf5bdb4ef7", "value": "768:mLGOe2kf9e9X9nbermI7vc59QPQs5gFHviPuzWeHXpi2UJTpDnH638gj:mL/4f8F1ef0YgFvimzpZi2UJJnHY8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687364, "uuid": "62358cdc-df15-4118-a0b7-95e68ea52e85", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687364, "uuid": "96193660-4c15-46ef-b24d-8972e682db8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687364, "uuid": "99eff4b7-38c3-4d7c-b4ce-7c7b1ca7f6eb", "value": "a12470282c38ad8a6a035ca371cdfdb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9818fbca-40fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1692716841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716841, "uuid": "50dee901-4f19-42a9-927e-f07d8802125f", "comment": "Malware payload (njrat)", "value": "db762e1dae5b35fe09bd2dabe9d3ffc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716841, "uuid": "52533bbf-174a-4024-8fd3-4ce5fefb0b54", "comment": "Malware payload (njrat)", "value": "93cdc9b2f926d0016cfe88d3eca1baafbe9c376a0ccad2ee9e15d6d600f64def", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716841, "uuid": "f0c750fa-5466-4caf-b528-41a136b3d0f3", "comment": "Malware payload (njrat)", "value": "9c1ef383f9400335438589d8961c9ae767b5ced8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716841, "uuid": "5e41a1db-ebc5-414f-af36-0e545d9d5b85", "comment": "Malware payload (njrat)", "value": "8afbc2e2f930849cd167e94c9cc6e8cb93281f7a0ca6539f48453797835807c8bdf161d1998c113f792d8df43f440872", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716841, "uuid": "a64a4745-ceef-4f18-b82a-91ac8f3fb654", "value": "T1ADE218467BE98215C6BC5AFC8CB313214772E3438532EB6F5CDC88CA4B676D04256EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716841, "uuid": "e8f89679-ab8e-4a93-b95d-f7df39aa716d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716841, "uuid": "f0567ec5-efab-40d5-9ea5-e4760aee3788", "value": "384:tm0bUe5XB4e0XEpOjfrw0Q0mS03AWTxtTUFQqzFV3Obb9:lT9Bu1j855d6kb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692716841, "uuid": "9320bd2c-d61d-47ca-9006-d873fbcdc97d", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692716841, "uuid": "f9e1bf4e-5cb4-4fcf-80f9-06be1b1bd78b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716841, "uuid": "16c5f0e7-7941-4261-91c4-c1a98313fac3", "value": "bPdP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af1ae95-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738643, "uuid": "75de5701-93c2-467f-a549-cc75c1aa70c8", "comment": "Malware payload (Mirai)", "value": "80ff66b8242568cc9e67a8866bd4dfc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738643, "uuid": "e6f1fd9e-6003-4725-833c-f302aa787b94", "comment": "Malware payload (Mirai)", "value": "93f911cbe73b95e6cf8e2a02eb0411d10af86e5ba16eeba6dcba6c36d793197d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738643, "uuid": "80efee33-048c-461b-8ed0-53d176ec13c5", "comment": "Malware payload (Mirai)", "value": "029ea8766ee0315c6610dbdc89dddd8f260edd15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738643, "uuid": "ec61c89f-b540-4c9a-9c05-e3aee6c7fdc4", "comment": "Malware payload (Mirai)", "value": "5f354fdf95ce67208cdf628151effb921e1b847c3d694283cd8ed403fd0a53dc9b0ede86a30526d3988d8f9a078b1257", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738643, "uuid": "af77833f-0bc4-4744-ae7b-1a1c86b1f45b", "value": "T17AD2E12CC55DBD48CA9D3DB950DE96B53C8CB1C0635DB6CE17228448B61BB8BBC070B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738643, "uuid": "7fdd65e9-cd49-4f93-8188-d68da0a63f32", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNEgbmJbUWUd:kbDs06t4BEub4sU/MbUfSYd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738643, "uuid": "9e970c9b-5325-400f-9e99-ff10d57edcef", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738643, "uuid": "f903c303-bd12-410f-a4a4-2445bdd10dc1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738643, "uuid": "03a58bb8-8951-41e6-b25d-9d3d8d299e30", "value": "80ff66b8242568cc9e67a8866bd4dfc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074af679-40eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692708867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708867, "uuid": "571d81d7-e737-4e32-ba93-449636f92da6", "comment": "Malware payload (Formbook)", "value": "6538544949ec82d58940dbb98504551a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708867, "uuid": "c7d586af-e7fc-4872-82c2-9e709b781806", "comment": "Malware payload (Formbook)", "value": "94624d4514f91f314664e8d9e09dac46cd6aeeb841dda13f6a2ff9320e6e1902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708867, "uuid": "2eaa38e3-01c4-4838-9626-161813720c0e", "comment": "Malware payload (Formbook)", "value": "0315e4809907c7648583a059980c78cda0999265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692708867, "uuid": "7b19a6f5-228f-4194-8eb0-507983422d01", "comment": "Malware payload (Formbook)", "value": "1c7b59e85571fd3c5ab95655513254823fe03960b41bcc4a0a18328a3dd6753412655a0ecb7f3857877d6c36f526118d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708867, "uuid": "6f7baf7b-5579-4ebd-9186-612f3071c031", "value": "T1C7E4CF11B3BB4755C87E93F43F61120C07BE655923FBD2257E82A0DA6961B808E5AF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708867, "uuid": "3b0f7800-b73f-4e46-8fe4-782ab6a164e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708867, "uuid": "e8d24941-e0e2-45f0-b1bf-cbda2dd2ef61", "value": "12288:z5fDEww2d1mbT4HeS8XQpBhda7AkZ9MrN5fKkUuY9RkiKMr1T9:lDEw00DOt9MrN5ffY9+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692708867, "uuid": "a0dd74ae-3f32-4a03-9168-63e86f12e6ea", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692708867, "uuid": "209f62ec-e7d8-42a6-8072-dcd86d1b9ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692708867, "uuid": "fa1799f5-36ca-45fe-8d43-55f5c747a4f0", "value": "RFQ#0080220023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339cd4c3-40f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692713666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713666, "uuid": "2f48bcfb-5fe8-41dd-9581-a9921ec56ce7", "comment": "Malware payload", "value": "3148dd0da1f8851782b82dfa37ab21ff", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713666, "uuid": "024c992f-933a-43aa-af3f-a8448eb42ecd", "comment": "Malware payload", "value": "954fe5a029ddc55acc658311beb82b95c6755a07101efb9cbe631a42e2bd00ef", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713666, "uuid": "f403799a-442d-4f7d-b995-8069150b2aed", "comment": "Malware payload", "value": "00222324fb2d959cb7863448351858b2f755aef4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713666, "uuid": "aa2c6d39-9020-483d-8e39-f07f1d67207d", "comment": "Malware payload", "value": "e54116751cdb22afea8754ad8401ae2219cb4133d0871941a1a34894dec4ccdd4692556740783f924e54eae4218f93b5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713666, "uuid": "1f01bb57-7c32-4604-87a2-b86600321207", "value": "T19835232692E6C9F7C2EC0271484667C07A10C63984AAE53FB57480BED1D358DE376F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713666, "uuid": "db469a27-2d91-40a3-ad2c-9a8b07e76dd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713666, "uuid": "fddbfa96-2b4e-4286-81da-8b1f0f613013", "value": "24576:1mEp+bl2LZ894kTja81N5Fjk4LfmVr2b2DamK0lF5:1jMbIZ894kBk0eG2+mKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692713666, "uuid": "76dcdbe7-6dc7-4d40-aa7e-715a86c7481a", "value": 1063573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692713666, "uuid": "21210fab-0189-4354-963d-908f54ac58f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713666, "uuid": "5c0387a6-ce2e-4c0b-82dd-82939e4160e8", "value": "Ransom.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52da9e1f-4114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692726604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "d68db3b1-f77a-4427-aaaa-6e9bc94e1adb", "comment": "Malware payload (Mirai)", "value": "13c6c6423c1a7e23cd9107353145beb2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "3e0fcd2c-b5f5-4dd1-a457-710afa002da2", "comment": "Malware payload (Mirai)", "value": "962b054e4e693f7dda9b36af75190a3470acd39d737a8a43965f8ebadf0385be", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "46cf2d3b-87e7-407b-84d3-3452aec182a4", "comment": "Malware payload (Mirai)", "value": "e647a3a41abd52e9603318c76c694602bf88d928", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726604, "uuid": "452c3b2e-7c45-416d-a7bd-478ccf716252", "comment": "Malware payload (Mirai)", "value": "09858dd6003801dbe0021315332357db7a4378bafdc5593366a54ba3cedcb7937c7684be35aae465ed71adef551ba8f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726604, "uuid": "5b8f39cb-8f21-47d8-9587-6c81a5e8ee97", "value": "T1D5243B46E6409F17C1D317BAFA9F414933329BA4D3DB730689186FF43B86A9E0E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726604, "uuid": "563a54d8-f1ee-4bd1-a9ae-82917d92d5ad", "value": "6144:0sNA4exMf9Xmpdacp37Gv/5KdqHMlSecTPT7FqKstTpLM/9/koVmXwgFUdWYS:0sF8pdacBGv/5Kdq0KTPTBqPr4/tmX99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692726604, "uuid": "89aa97dc-be99-4b77-a3bb-3b93da197d2c", "value": 215204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692726604, "uuid": "d6aa9d90-6dca-4630-a469-8ad3cc5adc90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726604, "uuid": "a10cfc7b-f3ef-4497-8560-6540a04334c1", "value": "cutie.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f6cda9-4142-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692746421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746421, "uuid": "8015530d-86a4-48b6-972f-f9926b30484d", "comment": "Malware payload (RedLineStealer)", "value": "4d58d5bc93859698182bc00259002554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746421, "uuid": "09ec9ec9-486a-48df-94ca-aea660ecc6b5", "comment": "Malware payload (RedLineStealer)", "value": "97f739acd32886d4a0df621839b6a61be81b54f230f12c93f6797dea3a015200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746421, "uuid": "180281b7-6a3b-44f6-8cfc-2075d14291a4", "comment": "Malware payload (RedLineStealer)", "value": "dec31f9b3ca85bf88a01d8e99e9ee0b1e0655e1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692746421, "uuid": "d84ad5b7-87e3-4755-a819-7638c8c602db", "comment": "Malware payload (RedLineStealer)", "value": "94d625e409bfffec272ba3398cd1b518ad7245d53098fbad7f6b694c9652b316512135e30b8bdcb3f6cb9a12b9516d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746421, "uuid": "285641de-a47b-4ebf-a63f-f7ae12a8c7fc", "value": "T1417429D0338469CDCC8F9AF1616217788A70D442AA57BB53FC8BACF73859365AF051E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746421, "uuid": "3fbea429-dc2d-476d-8d0c-5253a86f886b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746421, "uuid": "15e36dbe-b64f-4ab3-8fd2-d30b76420d43", "value": "6144:kuqDoRU6H45GyETH/LchD7mGy0bDu+MOYR1N1arTi:dq3A4l/3y0bDu+MOYRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692746421, "uuid": "5b450f96-c321-4e23-b699-2f5c1b9ad82a", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692746421, "uuid": "968ad581-c77a-4b9b-aad4-29c8adc756e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692746421, "uuid": "aefcdbf1-f332-4fdd-8d8f-7aa13487bcc5", "value": "4d58d5bc93859698182bc00259002554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f7937f-4136-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692741272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692741272, "uuid": "da49ed5a-4347-4aff-b8b0-73e6d62aff75", "comment": "Malware payload", "value": "08dbf693da8c604300690cf67dea7f25", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692741272, "uuid": "6f83b11c-ed0f-4ed5-8ed9-a8ba79e8807e", "comment": "Malware payload", "value": "98315b7532c19e0a02937d11347be344bba1ee3a2231725840a8f244e431509f", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692741272, "uuid": "3c6d3d7f-5067-451d-8abf-b57ff9dce748", "comment": "Malware payload", "value": "a251f9ccd0b522d18ed0dab65eaad86e49c3ef46", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692741272, "uuid": "fec3c0cf-44a4-4a83-b959-cb67f86232b6", "comment": "Malware payload", "value": "e3df1dc1994fecad9ed98c357c43693ead7455b810ffd0c9970f6311aac2c9874e0bc23c24ff92487b142f0a070099ac", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692741272, "uuid": "52098aab-280f-44a5-bc45-e8f7f8363f24", "value": "T16F1402D3613C59C0FA47A3B77A7055D7DA417C7293CA8CDA33AA3ADC89062BA12C1394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692741272, "uuid": "1a0dd26c-1b76-4562-bba7-8ec912dd6c68", "value": "6144:x34h3Uw/Klfr/Ca94uhFSLA6Q7As4CMtV9x:mhkwCtX9nHbMtHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692741272, "uuid": "2a8b8611-44e4-4bf0-b665-7cee4ce332d7", "value": 197528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692741272, "uuid": "b49a0de9-5678-4ce9-a3eb-234e51f540e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692741272, "uuid": "c72c75ec-3ac4-4552-9a0d-cbf416647e3f", "value": "FAX_EMPIRE HOME LOAN.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6079a84-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687310, "uuid": "bc01e0c3-170b-4482-af0b-1579410bc27f", "comment": "Malware payload (Mirai)", "value": "85feaf3f8bc49a9a7e318fb24b7ab666", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687310, "uuid": "f8bcd18c-d03e-4d1d-aec1-b65034f95dbb", "comment": "Malware payload (Mirai)", "value": "98bbd3e68d1d89f18017a2b9fda6177a6ccbabe1c21dd8984834216ea1ca03cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687310, "uuid": "c5573aa6-1ac8-448f-9474-4cf869481288", "comment": "Malware payload (Mirai)", "value": "31b547f39de1c13da481eb853c47dac03d779541", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687310, "uuid": "26b71e08-47d9-491b-b1e2-ebe2ac94611a", "comment": "Malware payload (Mirai)", "value": "2298ed9a90c933325e0536bb58f341ea3fb54b0542c641ccace48e0f676422c1d8595d975eef577c59fdea5686f10427", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687310, "uuid": "eae6cad5-2d14-44df-acc2-ad613496f894", "value": "T149D2E1017640FEE1C5B00236ED668A5B72257D79C1D134FA973D0DF8A6E9A0D4BF4983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687310, "uuid": "3c02ea97-30f5-4b50-86a1-e690dd600400", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXghcSd9q3UEL7G:HRwynNIOQQ1KMwhZwLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687310, "uuid": "1eff280f-5a6e-43b4-b961-e1fce600a1e8", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687310, "uuid": "426b19b2-3c59-4ff3-8426-a296e61d0cf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687310, "uuid": "374b62ea-257d-4095-a02c-67c12d3918a2", "value": "85feaf3f8bc49a9a7e318fb24b7ab666", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bf7826-410a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692722493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722493, "uuid": "c590ac15-9923-4238-9041-d74aef52a4e4", "comment": "Malware payload", "value": "8e49e45d2fde73c984b6b761cf9b70a0", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722493, "uuid": "603f0574-5f4a-416b-a9a0-53cf162cad72", "comment": "Malware payload", "value": "99545fcdf6bd58cb75565df0e7d83a6f0bbf64c70f212c5eaa6652921e21d48a", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722493, "uuid": "a9c3ec6d-a2e6-4ded-9e08-09f1099caa4b", "comment": "Malware payload", "value": "7ff1f8c34dfad152a2ac39dea6abe4402ec0e10c", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722493, "uuid": "3ac45715-5958-42fe-86e8-6816adb9ceab", "comment": "Malware payload", "value": "f3037b29a99c96daed4164b8fc40eb0c897e027ea4dfa3cdc9b5b62303578dc9833409329dd676c3cf12a1c498bed1f9", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722493, "uuid": "5ef290b3-f763-4a71-a972-82e005380e72", "value": "T1B705D09F66F30FB87806985FF39959723F07AA84A6797CD1AE830D182BD494C021DB53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722493, "uuid": "844783d2-0ad7-4cc1-9616-799eec0875c9", "value": "24576:BiAD+wo5Mu8jO1tq91OcMpnRWcKZ7XQkHB5dCQ:gKfXOcMy8kH3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692722493, "uuid": "ef57abce-a40f-4493-b5b3-db41b1c90444", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692722493, "uuid": "bf95af98-1ae9-4b7e-b463-197573bb3b93", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722493, "uuid": "712b3d3c-44c4-469f-858e-d82e008f2b3d", "value": "t8z65j.vdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63711e70-40f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692713746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713746, "uuid": "f06023b4-3ae2-4e4f-948b-c17a492fc977", "comment": "Malware payload", "value": "43cdea90bfe02953539194cc2612df96", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713746, "uuid": "38a6d91d-4c12-40f9-b8ef-38a3d1d46837", "comment": "Malware payload", "value": "995a91e668b85a992c8a71aed191fa0fafa3b1606bf205bef93a2457786de555", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713746, "uuid": "601bb42b-8312-453a-a786-54e8ceedfed8", "comment": "Malware payload", "value": "47028bc1510dca41b888db92f6f14d3a3c342f7a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713746, "uuid": "c746f5fd-d9eb-47bb-85f9-3600ac914fa5", "comment": "Malware payload", "value": "0bf95fe46be1d91e92be88ff9c73565aaea43b70fb4db121eea3e75ef715db443590dc76786c9c03509e8119aa6449e4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713746, "uuid": "c5b6f891-e7c9-4707-bc84-15d9b83d8941", "value": "T15745BE307542C132D56141F05E7CEB9A90ADBD384F758ACBB3C86B2E4A315D26E36E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713746, "uuid": "c21c5280-83a0-4960-9252-bd3481a9f300", "value": "f527e8080fac9432953c548a4f7317af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713746, "uuid": "27f7b0ae-161b-4bf5-8e89-9c86c30fd83e", "value": "24576:C2ALmtTEQcN3ALfxdkST1750WKRuTx/0OjuSIMxMgWIMz/IPBZMIGaVp:YLSyN3ALQK14RuTxruCMIMz/sBZMIGar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692713746, "uuid": "c0a2dd4f-3753-411e-bd04-1781c45b3acd", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692713746, "uuid": "869971da-d71f-4057-9b59-ac61bad23b0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713746, "uuid": "608e0816-5e7b-4deb-bd89-639598691704", "value": "Xinfecter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7adc0655-4128-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692735261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735261, "uuid": "2b6cc354-fae0-46c2-b4e9-072b1f2f957e", "comment": "Malware payload (AgentTesla)", "value": "5f76dfaed165967ccc8991ddbe43cf3f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735261, "uuid": "e3bbd2ff-f7bf-4ad9-9664-48160e82de19", "comment": "Malware payload (AgentTesla)", "value": "99c45490a0578c8f57c0393d483fe38aca73778baff2d2b7ec5f89fe78d55541", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735261, "uuid": "f9e99516-299f-4ef6-a19f-51d2ef227a74", "comment": "Malware payload (AgentTesla)", "value": "2e94be6241f6c1eab33738b23373c913bd7bf398", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735261, "uuid": "a6ece8db-8870-4e94-87ff-fa8130734aa6", "comment": "Malware payload (AgentTesla)", "value": "fbf1cdc1561853750fdcebb219703672729ec5c22347ff7d882abc7253e46f558c6d4cbd55144ae487fb85b05fa1d60a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735261, "uuid": "86eb3ecf-423f-46fd-813c-6dbb715f6788", "value": "T1A2849E063388CF25C51F15B6C8A3C2F81727BE00DD445BDB76C9FE2A79F22AA6951487", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735261, "uuid": "8640dfc6-d008-48aa-bb31-47248ddcc0a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735261, "uuid": "0ab6f85d-c3b6-4afe-a5fc-98893f0f23c5", "value": "384:MfRCSC/pdpn06CjFN8P3YsU6fCWYA8S/hs/E8sofOh/Q0RbnqyGt/Qz20BB8VR+T:ACrdM8sScz9Apqn+kVo6sLyYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692735261, "uuid": "46d56f95-0f12-4445-b4d9-057b8365d767", "value": 383160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692735261, "uuid": "e0918ac0-a3d6-4db1-9851-8e4b136b020b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735261, "uuid": "7f6024e4-1e9d-41be-9adb-2a8e3a5cdf16", "value": "Ybpwdqa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464be6ca-40e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692706396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706396, "uuid": "f686be9a-e774-457d-a866-6f193ce9005a", "comment": "Malware payload (AgentTesla)", "value": "5b447dc32d63648b96750658ff4fd024", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706396, "uuid": "902839e3-3118-449f-bb56-761a689c9f6b", "comment": "Malware payload (AgentTesla)", "value": "9ab21141018bf9b7884f4dba96fcd4d184bc1fb913f38e8267decba39f78b376", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706396, "uuid": "850f7859-b96a-4543-b354-ff4e32a5c1a5", "comment": "Malware payload (AgentTesla)", "value": "792bd0a9ed75dfbf7f2056d2b4d054250e481307", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706396, "uuid": "c82f9d65-b022-424c-8771-1557be1bd78e", "comment": "Malware payload (AgentTesla)", "value": "3898e958d4a2931926c04ae36905f52923f6361c0e00ba8f41fe0d22c9e7afe7d17b90c14b9d15159f2e050e47344b5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706396, "uuid": "ec65d8c1-9503-4535-9b41-5761bfc69907", "value": "T18E057AC1E2BADBD3D57A53F5249106000F767ECAB939D2544DA670EA35F4B402A83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706396, "uuid": "17941c37-92d5-484a-8c32-e7116632cf37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706396, "uuid": "39cf3662-1942-41e0-b2fe-d34539e662de", "value": "12288:dTzm2d1mbTdanBiRlqx54/A4GbY4tCsbWMaSG0/Vpx1N2g/0:dTedaiRUc/F4ttWMm0Tkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692706396, "uuid": "9f3b39d9-ff2a-4812-a055-4091cecbb61a", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692706396, "uuid": "c9b07285-8fb0-467c-a346-3ff253efabf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706396, "uuid": "1ebb9c41-d448-418f-bfd0-e39faff772e7", "value": "Awqn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf93dffe-40e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692705741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705741, "uuid": "543fec4e-dfd0-42f4-86bb-6655de8e445b", "comment": "Malware payload", "value": "578ca89033b2f223c5d4ca74e4df561f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705741, "uuid": "d9bde12c-9e2a-4060-bd95-0232cfd4aa80", "comment": "Malware payload", "value": "9acefbb6638612b03847da2c1652e3a1aae9d677b22f5c5d0e43022d8d08c6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705741, "uuid": "5ddacd17-b6ae-4a13-b623-1c5351b05dca", "comment": "Malware payload", "value": "31e6be8418af94b99b1773d9703e287008c24985", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705741, "uuid": "9dfb86a1-5398-4dff-a673-7ba2b7717f51", "comment": "Malware payload", "value": "3449e3cf2facd9f488d0d5adeb3791f251afa7550ab14662491702d99e7b15fbbd2322bcbe34c6e234f99d8c168694d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705741, "uuid": "9ff9dd5e-5c44-4f4b-ac1a-44a224089af4", "value": "T1EF463330E459CCF4F9298D3CEB1DCC24C176643E0CB9B5AAA99E2B7BBF22419C811557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705741, "uuid": "44ec86e6-a367-4b29-9f69-b3431934078e", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705741, "uuid": "458e6ee5-4d93-4cee-95c1-3cc6e42851fd", "value": "98304:KiqIfLwU9FcfbE/98lDxNw1vB7B2Eaj8vDPb58JYGUXHCzG3eXY3XkvjSsxQsoHK:fqIfLwU9FcfK6NNw1v9LbWJqizG3eo3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692705741, "uuid": "a109c5f1-9c01-4deb-9934-3400b4589bd0", "value": 5678593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692705741, "uuid": "665b0a10-a056-4c1e-b1a7-ad4462be3a9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705741, "uuid": "25b2facd-b119-4749-ae91-87ea3a44a14f", "value": "hydroneer-build-Zck7TKVtpaVL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9034de75-40df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692703943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703943, "uuid": "f300619a-ed85-4739-9d05-6403b1d17675", "comment": "Malware payload", "value": "41f1f91d637d4bfbf749d1a24aababa5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703943, "uuid": "c7a202c8-79e9-4af4-b6c8-83bbc04e56e1", "comment": "Malware payload", "value": "9b20c63d3f0c1d24e05187f89f281c0b9a606344d6764179198149a405d5bc21", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703943, "uuid": "0246650b-ef4f-40de-9dc9-e963e884d1e8", "comment": "Malware payload", "value": "20e546569edfc0c90c0dd91ed518cea35b3b39bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703943, "uuid": "9a19bd61-a1eb-4e40-ac2e-294369a173a3", "comment": "Malware payload", "value": "bd81df22a4497593108bb34b5f708c7d76017d9cc3629a375ea60a073eb34f0e0fe6a3a2a588c6d5d7cdfeceb7fdfe9b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703943, "uuid": "9f57b77d-bd3d-4b7e-a001-586699ec425f", "value": "T1E816D6F4B2517AE60FB4591DF38F40B22C2BB86BF0BE5ECA2295195DC1C4244D9E6DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703943, "uuid": "a5b09d78-39d1-4e61-ad85-f3243d39b5fa", "value": "24576:pF+CKaAI1BrAbo6Rob7TKOGFTKrt8zTCOe+LVlrknVDM2z/1sb2FOLZSLOre5we4:DNkPBE1FADBlYbOUbUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692703943, "uuid": "9922e307-5bc7-48b2-8326-24e6976da643", "value": 4098610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692703943, "uuid": "5f4509e6-d9cc-494d-94dd-f29e68dea598", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703943, "uuid": "ed149967-3a7a-4aef-a0c2-6421e45df8db", "value": "46516879004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e218f9a-40f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714167, "uuid": "ff52111c-c46e-4f4a-9202-899e948e3f46", "comment": "Malware payload", "value": "058df3567926ad6520a249a3050e8936", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714167, "uuid": "2a621b82-9f4e-4ada-9890-474f6a17764a", "comment": "Malware payload", "value": "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714167, "uuid": "e968d455-c875-42ec-a056-8a1a1c9d014f", "comment": "Malware payload", "value": "6cc228fb8a77e57e597e80c8db8b935724276ff3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714167, "uuid": "8d5d8be1-04c8-4c4d-a281-e336d5304bb2", "comment": "Malware payload", "value": "896e035835aea3a828e3656a29c3b5bffb706be147e54661db40f9ab5b7e5c32ce389fabd0c4a005a728c73f80c273d2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714167, "uuid": "3fcb2c70-db60-46ef-a387-9cb108cc6d95", "value": "T11745BE307542C132D56141F05E7CEB9A90ADBD384F758ACBB3C86B2E4A315D26E36E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714167, "uuid": "5269f572-0b2f-46c4-a1fe-cc4622dd3236", "value": "f527e8080fac9432953c548a4f7317af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714167, "uuid": "1eab5f1e-9709-4825-b9f5-81ffac830bcf", "value": "24576:R2ALmtTEYcN3ALfxdkST1750WKRuTx/0OjuSIMxMgWIMz/8vB0MIGaVp:NLSaN3ALQK14RuTxruCMIMz/IB0MIGar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714167, "uuid": "2225cb0c-042f-4f89-9937-5139a0c66a36", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714167, "uuid": "e3d2f72d-8a9f-4251-8381-1a6903d48cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714167, "uuid": "7dc4d938-2876-4863-b916-7389a78a2431", "value": "Help.File@zohomail.eu_Fast.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ab5a8d-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692690606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690606, "uuid": "867665b5-b30e-4a09-a3a8-17d608e78139", "comment": "Malware payload (Mirai)", "value": "19b89a5d397116d95a1b74c438baf260", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690606, "uuid": "0a8f9847-e525-49c3-be43-7bb78e866012", "comment": "Malware payload (Mirai)", "value": "9dc3d0c60cf1ab6fd9a5d58879026503171204464e0e14a5f41806b3e0d805f4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690606, "uuid": "e61c5240-a9b0-4b77-ac95-6f5ed99e53dc", "comment": "Malware payload (Mirai)", "value": "98a4f59a9ecd60e227ca8162a09381a681da05dd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690606, "uuid": "f40a0860-d2ce-464e-b8a4-b4fdb89d0668", "comment": "Malware payload (Mirai)", "value": "8435ab90270c5cfd6096222ef33c551a3827a109725fa7160306b0418aec2ea12e36090e7c5f6fe75b657862706aeace", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690606, "uuid": "425f2fd8-220f-4839-b94f-583941c8eae2", "value": "T10FC2E1BC7EFB5F83CA1B00366988FE3382B0A5A5D35B7697B24441026C131E5BA67C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690606, "uuid": "37dbbed9-60ee-4756-a180-c5ccda10328e", "value": "384:MX1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjz/+Y:qMw4DZdFbBy6x3K/KdWnH5Ijl0N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690606, "uuid": "8cb8c5ac-d278-4970-80e1-ca61ed572620", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690606, "uuid": "fcfc9d52-e871-4243-b033-135a731c7d80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690606, "uuid": "216fca12-10bf-43f2-9108-c272917fde62", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f0d427-40c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1692691653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691653, "uuid": "ecd661d1-a02a-4c93-b921-74d8ad7055da", "comment": "Malware payload (Cobalt Strike)", "value": "7957ee930638f027afc2d4081e7258c5", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691653, "uuid": "96269b98-2f58-4bf4-b34a-630c8da63309", "comment": "Malware payload (Cobalt Strike)", "value": "9e0a919d3d424638da51b979be48222f565f97a1f21a536e3fe56e067ae80401", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691653, "uuid": "c80f1a3c-3b91-4061-9439-b6465d77f945", "comment": "Malware payload (Cobalt Strike)", "value": "6f3fff6b5081507c8c6cf586a4321c37cfc0a831", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692691653, "uuid": "ba03238a-5625-47fe-90c5-8a5ec8cacc40", "comment": "Malware payload (Cobalt Strike)", "value": "69d4990c3b41982d90a9fc9e36a9be3c5f35c836d3e8d0ea2113597632edbbb79cf89956b4f6d2b1e064613760b8487d", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691653, "uuid": "5ed6f460-fd7d-461d-a40e-1434ab357d09", "value": "T15AE58B86BC9524F4C1AAD330896616A2B6307C451F3177D73A10FBB92FB27D45EB9328", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691653, "uuid": "c256e2e1-8a36-46a6-aa13-b0b7c644bcbc", "value": "4b3214ddbdee3fb4b00e06e8fcd2b82b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691653, "uuid": "3c09c275-59bf-450e-bf36-4a027aae0988", "value": "49152:k8mLnaWu53K/4CdxaXejND10D3JpVciqrCyZAJaWI2DgErCgzg3Ddug:ZW+3KgCzoJ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692691653, "uuid": "6cb0bde5-a3db-4e52-ac10-ca8c8bf9837d", "value": 3129344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692691653, "uuid": "50fb2f96-8842-41ea-b381-f8f24c53f55e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692691653, "uuid": "371243e8-8179-4542-9337-892b6f92da1c", "value": "edr_agent.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb74b00d-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687346, "uuid": "28499a1d-b73e-4634-bbc6-8948137730ed", "comment": "Malware payload (Mirai)", "value": "5db4c8d0439db54591b9e8fef592ef1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687346, "uuid": "f5df72a0-2e3c-4ab0-a453-71edfa65c3f2", "comment": "Malware payload (Mirai)", "value": "9e0b2412fab0fdcd8b7359fdf709bf0f1e198a1bc4ea6784f5529775adf6ba8b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687346, "uuid": "ecb01bed-1e74-4a2d-8bd8-eed4ab569197", "comment": "Malware payload (Mirai)", "value": "b5d76711bb67734a41d2e19ecf875aa2f161cb97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687346, "uuid": "a7380280-d1b5-431a-85ff-45390a134681", "comment": "Malware payload (Mirai)", "value": "fe4b132f267cb0acf1226895c242b6670d8da88e45744bfea3cfd2b29aa76d7ef3acc7eec0667208df2d90d89a667c13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687346, "uuid": "8622fd83-9273-49ec-8b8d-05fd0121eed4", "value": "T14C23F2432093BA03E0349CFE4572CCCDB64AA6BDB1BE77AB25444E154C75D92ECB18AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687346, "uuid": "9201c6af-c03a-4c78-97c9-61c4d2f65636", "value": "768:ITK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFdcV9q3UELWt/iw+kvBGg6+fYtrBHN:q12O1LCNguovDPH7TcrFLWhiw+kvBGgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687346, "uuid": "3fdc5077-a9b4-4f52-a77c-e68dfb679312", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687346, "uuid": "d5726906-c7d9-41c9-ae11-2dcc301108dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687346, "uuid": "56c072c6-c646-41ec-8e2b-1a44b78f4cd3", "value": "5db4c8d0439db54591b9e8fef592ef1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffbd3dad-4086-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692665905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665905, "uuid": "a084435f-74b2-45a3-bf72-8ae6d72af48c", "comment": "Malware payload", "value": "b120cb7c1fe7c877611e91f93931f342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665905, "uuid": "ff5dc990-7fd1-421e-95d2-3410cbda26af", "comment": "Malware payload", "value": "9f22c96561344f52775034819a2a254a158b530bd22e041dfc1ce718a87293aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665905, "uuid": "1f4c0823-2478-4a69-a488-950d4d75d765", "comment": "Malware payload", "value": "6f2e428fbcd4de4033d5f58a63f45a6c937d000b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665905, "uuid": "7b7bc20c-311f-45f9-a96a-978cfe4b4709", "comment": "Malware payload", "value": "8629121e8bd4c261c21b45782b385efc7c585176d2e6f51843b03b23dfad7d92a46dab06798737c3e5f11b274db41be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665905, "uuid": "7fe2dfbd-34bf-4257-8dbd-9de040ce9d6e", "value": "T16F63072E66E524FBD4B983B884E30297EA7174B11B9A27FF12D4C5BC4E032D17135B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665905, "uuid": "62028a4e-3350-4112-8660-35cc7df9349e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665905, "uuid": "9ad23acc-3bff-41c6-acc5-06150f798edf", "value": "1536:crae78zjORCDGwfdCSog01313Ls5gzfNJe:EahKyd2n31A5kJe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692665905, "uuid": "032aad35-7e5d-483f-968e-825474e7e0ee", "value": 69120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692665905, "uuid": "38f48023-5c12-45ad-bfc1-3c952c682498", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665905, "uuid": "28aa9749-3271-44ec-b865-97fcb5d20ac4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5535d316-4114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692726607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "c1ef0d4a-da4a-4342-b2a4-033084eba28f", "comment": "Malware payload (Mirai)", "value": "655edf3969e720544b018a2607107f14", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "8f7d5e08-5c8f-45d5-91e7-a33a324752f5", "comment": "Malware payload (Mirai)", "value": "9f7ea3432aeb31b23cdf287ce855bc47cec91930f8e29aacfe8dfc3f5cb37c08", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "2143d8a5-b09b-4cd5-b0a4-3b55efa32ac8", "comment": "Malware payload (Mirai)", "value": "a79ce6b135d35851dd997bee1f92ccb6e0adf52e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "37caeb34-6835-460d-ab63-2ec3a773d2c8", "comment": "Malware payload (Mirai)", "value": "2771c8cdce2732d6bd2878c9b7337795dd4c39a8c41a770833fe628880e86229959fe18ddc5206bd329e214776505f4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726607, "uuid": "274948d2-79c4-474a-8ca0-d68340506860", "value": "T124C2E130A7AD1CB1C6600572F6B896CABE530FBDEAEE3C90114147FA3941D0969AD9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726607, "uuid": "22a17938-305e-4c06-aae7-54443607fe9a", "value": "384:AOt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEXtLjhymdGUop5hy:AWsoTAZ3alkXLvFh8nNEVs3UozM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692726607, "uuid": "222b1e70-632a-4920-882a-3ebe1651b04f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692726607, "uuid": "3f4cc236-3bbb-4185-82c8-87764f44558a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726607, "uuid": "b1cade21-4e19-4254-996f-bc03c9dcc29d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9544e27d-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689778, "uuid": "772bd190-1f7e-44da-9847-d3de4fc56ab3", "comment": "Malware payload", "value": "1dbc95177360416d54f66f526ddec4f6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689778, "uuid": "96c3cc85-6015-4424-b0d0-4800dd2a9550", "comment": "Malware payload", "value": "a22f70525427041cc1c522592a81e7a8b2bc2c9e592d4a102d03478a55bbd119", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689778, "uuid": "99843f05-a437-4887-8d10-9df6a9effad5", "comment": "Malware payload", "value": "63bacc1ac778a1b5b960e86d5d9dfbf079356284", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689778, "uuid": "96521b5e-2764-4ebe-8c3f-968182ea08a9", "comment": "Malware payload", "value": "3587ca85c02a4e840d4cd72416eaa7c6d77bdff95db797bf9fb7d4089de14378333335571a2bb6ba0e923765f98b4af5", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689778, "uuid": "0cb027b8-c95f-4074-97f9-146afb38d33d", "value": "T1A075F10398009F87D41D87F8BE630ED54F1B7F18A995B9DB14623F9B3B317A2189A21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689778, "uuid": "c281bbeb-53e1-4e4a-ab37-660063912894", "value": "24576:hrsZyrw6VZjKaWlEzp7aYZybw6VbjKaWlEzp7aXzdl3ZEFQA3QpAxgEuw3chg:hrev6VZjKjOzp36VbjKjOz4d0F/37Os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689778, "uuid": "4d6b1c36-02a2-4913-ab9c-7eb4c9111615", "value": 1580544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689778, "uuid": "e2dd7d4b-e8e3-4d16-bd0a-b2541b8dbd29", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689778, "uuid": "e013bb09-98fb-466f-99e0-45bbabe0b3de", "value": "MT103 SWIFT.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f18ea97a-40fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1692715703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715703, "uuid": "8fd21b8d-b3c9-425c-bb17-2e73dc872030", "comment": "Malware payload (GuLoader)", "value": "109635edad85c5c2a37341a936582835", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715703, "uuid": "207a4d91-9e49-4d6a-acf7-7bc99c9e5fcb", "comment": "Malware payload (GuLoader)", "value": "a482f6c112dd04b77f4f36720ab637ae26ab2e91d3edb2b28cfd8022322055e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715703, "uuid": "ffd2cb74-a675-447c-b627-db3db470b9f6", "comment": "Malware payload (GuLoader)", "value": "0823997386aad5a60edbd6c76d03d6e2f723b43e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715703, "uuid": "239e331a-d806-4639-8ff6-2c4623c73fb5", "comment": "Malware payload (GuLoader)", "value": "ff69f958214080e8cf23a839f66e92e4732a383918e6d124c02c0a18effef04b2fa4d93e59fa215efd1bb09f64cb0825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715703, "uuid": "2bee7c1d-ff78-4fe1-b1bb-537554f8d50f", "value": "T18DC49D9239C9656FDC2F8A35035FEAB62B755CE0738148AE4F80361D4D35A4A80EEDC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715703, "uuid": "796ce1e2-9a81-4fe2-a83a-90bdf944ce5e", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715703, "uuid": "d27cdd07-f11b-4a13-8916-11c372e6c666", "value": "6144:+MfQPZVheNA+ff0OuCNiaeixCYFXR2oQb30nwMyS9Zspy1uhYxHSpZq30rl+I5ZL:X2nhe2e5tia4EgoQL0oyswB0JZA0eGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715703, "uuid": "70bb3595-9608-489a-97a0-ad623bef876b", "value": 554992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715703, "uuid": "3bbc3d3f-fb8e-4ccc-88ee-c98fb0bbe35c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715703, "uuid": "63272189-6ae7-46dc-bfce-d6d22e6b27a5", "value": "r01489AbuDhabiCommercialProperties_ADCP_LLC_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b8916a3-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715961, "uuid": "34d9eb93-b095-4015-a285-6837075d72a5", "comment": "Malware payload", "value": "ce4d60928635dd4d4abb874224733f71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715961, "uuid": "61c1b669-b35d-48cd-b8ef-b8d02c41bed5", "comment": "Malware payload", "value": "a4fc5a4d4ab1c6834e63f2e3d7e9dcd5e874357c0cb5673215e97d67752b4a8f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715961, "uuid": "368e7cfb-6e06-4b50-8502-5fed9b329e30", "comment": "Malware payload", "value": "831ebe472632005fe56c06d0fd03190bdf76dcf2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715961, "uuid": "e33c65eb-cf38-4090-a917-166b3ebe3006", "comment": "Malware payload", "value": "cdcb4a92a3c641ee42de44b8d29a22990d16dcd16b1100bb5ec68a3365b6fff3e485794a01755ffe7a0764b6e47af36f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715961, "uuid": "ebc10d78-f834-462f-a120-15563b1ed502", "value": "T1E9F38C1971D1A0B2E4F30976D5B8AF12446DFC111BB07CDB72E61A9E19320E3AE39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715961, "uuid": "abfaa754-e910-4d44-9157-474c553d5373", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715961, "uuid": "e7915067-955a-45bd-a4d7-b138a5c05075", "value": "3072:l5K/B0toLQSNJklZHQsozTS+SMqqDL2/TrKvOG:lcytwtE1yTS+xqqDL6HKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715961, "uuid": "ad788379-fa21-408f-be8a-50db848824dc", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715961, "uuid": "a647a4a4-7ec2-493e-841b-2e045c95b185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715961, "uuid": "bb00f5dd-fe3a-4918-90e3-1fb548191fbd", "value": "2023-08-22_ce4d60928635dd4d4abb874224733f71_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6b139a-40b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686084, "uuid": "8a33d570-e6dc-4411-90af-0df0bb76094c", "comment": "Malware payload (AgentTesla)", "value": "d6dda4b1b3d4a780722a05c1992a1a4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686084, "uuid": "5f9eb995-f908-4e92-81be-48a6467e11d1", "comment": "Malware payload (AgentTesla)", "value": "a673f0c5de030dcaa3de2d4bc8a01d8f89aaeeb81829bdabab5fcd14eb7c44f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686084, "uuid": "06687648-12dd-48e7-9aab-03e880bf7dd5", "comment": "Malware payload (AgentTesla)", "value": "cb1ab0f17c1737cdad328f8de76875b357d1acb3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686084, "uuid": "1d87e2bd-aa2b-40bc-bc34-612e0d0fca72", "comment": "Malware payload (AgentTesla)", "value": "28e1c664863bb8209508ec29318c1454a67f713f74aa04b1706ccc2c25e1386e2bc53f2272d37ec305e8de23ea657279", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686084, "uuid": "ef51d2e4-9571-4dc0-b07d-e9a493204321", "value": "T19CD433A09E80D3A6DF5074F4C4F77C8E6692951B02FE61029BBE6C529C77A58CF00F28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686084, "uuid": "57812690-707f-4a18-bf58-723ce1ecba2d", "value": "12288:2ShJHSa3KXX8GP61c8yfkbWbPpgWnOz3qday5DsB1Xg0MBPYi8lC8aA:LfKqK8ygYml3qwmsBeBPYzC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686084, "uuid": "3ae1f395-4105-4ccc-80dd-ca5234a1d1e6", "value": 610391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686084, "uuid": "e29235e2-6129-43a3-98cc-e20f1aaa481f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686084, "uuid": "14f9b00a-649a-4326-a43b-06167682632e", "value": "New Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c340edb8-4087-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692666233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692666233, "uuid": "81d2a7b6-142a-4969-8f7c-b7395c153360", "comment": "Malware payload (RemcosRAT)", "value": "5ba4bb4bd14a87d9adf7373588be5f95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692666233, "uuid": "136a331a-ba98-464e-ba95-7529c3d99bbc", "comment": "Malware payload (RemcosRAT)", "value": "a6e0bb78ff01b34d44f452edc954795ee6aef2885fddbd2ee06cfc0f19273e65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692666233, "uuid": "021ae49e-03ef-49e4-9056-4793a61853d6", "comment": "Malware payload (RemcosRAT)", "value": "7f227db042e80ac92dfa78de08dddccebe97abf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692666233, "uuid": "39eb8b52-c7dc-4dfe-8265-7a73f9d343cd", "comment": "Malware payload (RemcosRAT)", "value": "fda4d9a0678bac96b7497eedfb8596223052184ea16fb2d3e8b63023946eeebf2cd8078191339aa3b7e3ed65a7e13772", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692666233, "uuid": "6680d555-c1da-4a18-94f3-b5089c5f3258", "value": "T18A15C07A37D29470D1BEAE70A7B844E841BC394B5923CE5B04409FE9FB316C929416EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692666233, "uuid": "10aea19e-2e7a-40aa-bb41-5ae439d87625", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692666233, "uuid": "44e6bb6c-3e8a-4301-9ba6-a1c5e03b8d9d", "value": "12288:YRFX9zeYStlF61+l8VZTor+dG9xh8+wesZlYP6xL2uEJxf1cU:IFNLol01+l6tpysZKyL2nP9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692666233, "uuid": "5b5dd9bc-c384-4a4e-a16f-ada986153e34", "value": 931328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692666233, "uuid": "fb8f646c-089c-41b4-bfe5-cb220d9351ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692666233, "uuid": "dde088ae-0e37-44ec-ac20-016107b7b366", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a964b819-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692690671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690671, "uuid": "10c4fa3e-9532-451b-8ad8-b64149a380c6", "comment": "Malware payload (STRRAT)", "value": "af772b1f43e0e271d49afcaa532482d4", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690671, "uuid": "f1e77917-6bc3-4295-afbd-7361304e87c1", "comment": "Malware payload (STRRAT)", "value": "a945c26625f04a77db7a61b171faa6b1e5f5ab83ea49f601d140498546f7c9d4", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690671, "uuid": "7bfe39ff-73ba-416c-92e1-979440b7715e", "comment": "Malware payload (STRRAT)", "value": "d610fe96ebb51c4e6de313f01371eddfc5b0dee6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690671, "uuid": "3563c8ba-587f-496f-93da-3cedcac09af0", "comment": "Malware payload (STRRAT)", "value": "8200c9131828c0609b0b50023f72a71fc68da24f0ca3068930037779dfd2a818b7d60f1b8840fd59d2c7ab0b535f3aa7", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690671, "uuid": "c6220e42-b66d-4a47-ac1f-40fc60ffdfd3", "value": "T1A96302AC7EB0BAFAF353CC383C42B512A05DC88E4785C913059DA4353864C9D9789E9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690671, "uuid": "6d72d705-e76c-4dfb-8e7b-4535e2cf65a5", "value": "1536:lWS20ZxbsDkHeU0ekMKG9ZrbxXkh8hYOTlN/qon7FAbLXag:lWmOcXvKGrbxa67T7yon7FyLqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690671, "uuid": "987f038e-08c9-4637-b33f-e8dfb8d0e2d5", "value": 69676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690671, "uuid": "15add0e1-e44d-464e-aa64-5b5c948fc6ff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690671, "uuid": "0645a6e0-cbd8-4de9-a7c9-0089eb3030b0", "value": "PO-0802123.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d46870-40d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692699549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699549, "uuid": "d036b32d-675e-4d82-81ea-49f3b2c799ff", "comment": "Malware payload", "value": "7b67ab99d632108c09d8680c851ab3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699549, "uuid": "ac1826ea-c07d-4409-8ca0-67b80f59c5d2", "comment": "Malware payload", "value": "a984faf760a7cf721200ca8f1f8c4c70477a4aa14864b377c63851ba475cc9aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699549, "uuid": "e727419b-046e-4e54-81f2-7f566d55142d", "comment": "Malware payload", "value": "4cf75340d4bbce4846e70a38ad9d6d0c0bd4f9bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692699549, "uuid": "33438cab-97a3-40bd-a177-2888e0461e90", "comment": "Malware payload", "value": "8663670da9af28e6205d2c09b866de54038733a103ecc990dd6f12b0a833658521e8ca996c00ea9fa88ca0d0d82e4003", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699549, "uuid": "fab3c596-b0b0-42b4-bfad-3ee1a2580a13", "value": "T1E9D40208876FAF93C67D83FE8933541443E7A19293B2E39B5F8B18E95A45BC4C542B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699549, "uuid": "c6a70556-685b-47cb-b980-a41e0d7652fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699549, "uuid": "67e31d8e-d8b1-4a8d-8799-9cf7472da775", "value": "12288:Bh6yDYefMncYmpOrVP6OuCBmZWF4j4cUlVeSD9Rn526HjCTMrxydu:B3UcYTrV3aUQ4cUlV5D9R52kc7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692699549, "uuid": "874c7708-8cad-4ad9-b0c0-ce14a3a1bbc8", "value": 622080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692699549, "uuid": "1cfad259-f02a-4cd3-9bde-ee96b0de809e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692699549, "uuid": "7b0f1862-ada3-4f8c-8204-e58fdf9a0aa5", "value": "Refund Payment 274652.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8886d66d-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715956, "uuid": "b5f3699b-3ef3-4bcb-8ba7-9a63e293711a", "comment": "Malware payload", "value": "2680bb33c8f1185b2f42c1320cb6e1dc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715956, "uuid": "160007d1-821c-4890-a78e-042b99efdf1d", "comment": "Malware payload", "value": "a9904c2337a9da922093cc51e185dc1ef2744db6ccacf46968b36698ce6a0f1d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715956, "uuid": "e075b4d9-441a-49ec-99e2-e0844806c838", "comment": "Malware payload", "value": "91cf335c0beed0c498a0067ca55edc95c2786198", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715956, "uuid": "17c78319-9fc4-4681-9f36-4f1201f4c38f", "comment": "Malware payload", "value": "2fdfa647d71b0470078fac88b5463910490291d77d7a9232366345f8f29a019390dfc2fa88ce0eb0ff56450b417563a5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715956, "uuid": "2b5d8f58-62c9-4e97-ad28-cacc61fffe4c", "value": "T171F38C1971D1A0B2E4F30976D5B8AF12446DFC111BB07CDB72E61A9E19320E3AE39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715956, "uuid": "59a945f4-379b-480f-b683-36e65578c223", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715956, "uuid": "6148c3c5-06ca-4c8b-ac37-8e26d6ed2f7e", "value": "3072:l5K/B0toLQSNJtllZHQsozTS+SMqqDL2/TrKv1G:lcytwtbV1yTS+xqqDL6HKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715956, "uuid": "06c33308-089d-45e5-9e58-d844313e0de5", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715956, "uuid": "b524cb93-430d-4af1-aa84-39d805786066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715956, "uuid": "aa0cb4ea-a38b-4b73-b777-80a71f4d581a", "value": "2023-08-22_2680bb33c8f1185b2f42c1320cb6e1dc_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaaaf21-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692683404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683404, "uuid": "2dc07889-c9b5-4215-9b0a-d1f0127fb5dc", "comment": "Malware payload (Mirai)", "value": "5588027431b609808d0f2b4822ffd2dc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683404, "uuid": "da7c9147-dbd5-4c6e-9940-20f1eff929c2", "comment": "Malware payload (Mirai)", "value": "aa143848782cf78edc09ecf6b1acaeed648a0bc90d542c435e74d23f2faae6cf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683404, "uuid": "2ad571bf-9d5c-4ebe-9532-724dcfc6a366", "comment": "Malware payload (Mirai)", "value": "c07b2fcfd0d0e44442ebdab190f8af85d6f9d2a1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683404, "uuid": "e9e0ecf3-449a-4552-92cf-7e0bd25eaadc", "comment": "Malware payload (Mirai)", "value": "a1d8bee8f189e31ed244ef87e9c5e587643517f7ed00cfbf7806f46aa552c4c985acba85d60f2ce08c4970c2348ef823", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683404, "uuid": "28b783cf-384a-471d-8266-33d0c7acf38d", "value": "T17A230271880A9DB125703C72DB95D39376E11AB5C6672013DA290B3C2FB97131E5BE4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683404, "uuid": "1fc694b2-0bcf-4e9e-ac88-f9347d6aa23b", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3YL9q3UELbUXfi6nVMQHI4vcGpvI:DECFd+A6YHAxDLRQZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683404, "uuid": "9c0d5279-2cb2-44d4-a171-7d86a9e6995f", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683404, "uuid": "4b9bcec4-2bf8-4b0f-89a5-be99a9362edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683404, "uuid": "d7ed7c86-76b2-4d09-ab77-7e71e08c369a", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889028dc-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689757, "uuid": "e3af017b-1f2b-4da5-bba4-b84303d22304", "comment": "Malware payload", "value": "5cadb1c4fbc68c1b6502ffde5e14b291", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689757, "uuid": "4bfe5a6b-0c1e-4430-82e2-c076111e69cc", "comment": "Malware payload", "value": "aaec6bfce0c938fecab356734c510c02f16f3457bab7039f8c9ed1a694410c2e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689757, "uuid": "9f8e9402-c3a5-425b-b2ad-0a51748722bd", "comment": "Malware payload", "value": "355680a5520935ea4be7d9221ed0ab4ec623170f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689757, "uuid": "b5bf3a1e-dac4-43a2-b992-2062e7e67256", "comment": "Malware payload", "value": "e4818a27dc839c99386c0c10006d01243009e102befe4aa2cb745b11bd20500608511450656816abd8ac4cb24d8581f9", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689757, "uuid": "de2589da-ff6d-4cb3-aed2-695f59f71bbf", "value": "T18265F0039810DB97D40D87F87E631ED91F0F7F19E895ADDB04663B8B3B316A2195A20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689757, "uuid": "e09c9405-97e9-4359-9f35-6f71bf8ac348", "value": "24576:QrTZykw6VsAXZS2DZyCw6VEAXZSUDr3/I6wJypbMMQTghZ6fwDxS:Qr1Q6VrEcK6VTEqrPZ8wMbTO28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689757, "uuid": "97500fb3-d852-4ce0-bbee-7d8aa154deb2", "value": 1418240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689757, "uuid": "bc950306-d952-4c73-95d8-e9db093f7e87", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689757, "uuid": "beadb21f-6436-4235-b720-bda69ec40133", "value": "Pedido 080882112.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46cb0803-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690506, "uuid": "c43303ec-2d98-4d18-9d7a-12b4ba820944", "comment": "Malware payload", "value": "2449abedae5587efcf34409ecd071d9e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690506, "uuid": "64da08b2-9225-4cdc-9ec1-c0b881374662", "comment": "Malware payload", "value": "ab01b00bcb24c63b7d4658857872004deab836fdedbc631359dac5a5ffb012b9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690506, "uuid": "1e1e8e1b-9ddf-4570-b611-3f381c50ffe8", "comment": "Malware payload", "value": "121e01b3296bd71216e62aa4492b70eb4be47c0f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690506, "uuid": "18b4dc58-2e93-455e-849d-0baa0ee9f20c", "comment": "Malware payload", "value": "214cd98d6a5e7d77ef638122dbdbfce7c8176b72de6033462bb3503a48a57f73d5f2cdc4d8121d2220294efe2ea9395e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690506, "uuid": "5848b6d6-21d3-4e3d-8a93-62cb9f170362", "value": "T1DF252320FE88AFA3CF1581306527AE1941DABE9D134FD0FB93E27A96127477603D7849", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690506, "uuid": "ef5f4444-eec1-4ee4-9057-a703233fb5a3", "value": "24576:s0rX+6auOUfC3QVIanV9RRYED6hMioVjGtfYV+ZwqH+Ou:9i3QV+6qy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690506, "uuid": "a67eae14-67d8-4974-a85a-08f651dcfff5", "value": 998529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690506, "uuid": "d0aee305-211b-4fea-8465-e8ab8b2331ed", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690506, "uuid": "a74bc7c0-58d7-42be-bda4-998bd97c765a", "value": "NUEVO PEDIDO - GF0003.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88650f44-40c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692693622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693622, "uuid": "e6450c98-06fd-4bda-a86c-d81dab1569bb", "comment": "Malware payload (RedLineStealer)", "value": "fcdfb8dcb76224802c945fe5b3ef6f83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693622, "uuid": "05fb9dc9-ce05-4c38-a012-2c890021cde9", "comment": "Malware payload (RedLineStealer)", "value": "ac3ca04df65a7de6fad42a734ffb496d1c10cc52d14a88201f2a8579530d72aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693622, "uuid": "de57c1b8-4d99-4362-b261-3aaaf1c7bbf6", "comment": "Malware payload (RedLineStealer)", "value": "a0ae31bcb8b0ea1439de66ddfafda130617226ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693622, "uuid": "65fa08ac-3d88-4916-81eb-65b2ee27d897", "comment": "Malware payload (RedLineStealer)", "value": "adea6a518bc8bb64cc59436db017b0a2168c9a71ac44177c05c269cea8270ff3a6fc9fe9eafd24e79476c73a2e124f48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693622, "uuid": "47b4f997-bc10-40d3-8f59-4a4c361e0243", "value": "T1F9F40221BAC088B1E5B619345EE1B332AB3D7D301B799ECF9B00065D9F351C19635BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693622, "uuid": "a082ba39-7969-4899-b872-02d2be85baef", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693622, "uuid": "f873bcc3-5034-4c3a-aec2-ce83f016826b", "value": "12288:f3DkEGDINi1EwkG8hP/6bnCN1ovf5Iwaj4p2Pz+XamnmIKhUpl9j5TChfI+:/DkUNi1EvGdm/oX2wacKZmnfYUFjoC+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693622, "uuid": "7774a1c1-0c6b-4b17-b7c2-de302ad7cd85", "value": 759174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693622, "uuid": "a18f714c-6f85-4402-9e37-777e0d8fabcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693622, "uuid": "851a0683-3429-4ed9-92ae-3267fe639747", "value": "PAYMENT TT COPY SWIFT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a887b3-4131-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692739176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739176, "uuid": "96bc504c-2612-49d5-bc5c-b231f3b239da", "comment": "Malware payload", "value": "bc76cedf6fe9ae2a7357ac9cb6b5f290", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739176, "uuid": "caf63ca1-865a-4c86-b004-b7de9dc9e2ef", "comment": "Malware payload", "value": "ae07b159e7a3695ed1b6936f7378760800fd15d75fa25e465e334e404ba5bb03", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739176, "uuid": "c4340d15-51db-480e-aa5f-10b70c9c14cd", "comment": "Malware payload", "value": "ad7fc221ebfe7bac85dce5feb1b58c40ef9f5beb", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739176, "uuid": "683dcb6e-ac22-44c9-9a38-923fcd8b471d", "comment": "Malware payload", "value": "ccc7c65aae0bd077a59d48ef143459a7397ff1c1c43f2b4c00a0e5a1ae283d7d336d0c6335df1c833f33b1c6c4f5f95a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739176, "uuid": "338f9f49-7439-44af-bbc5-c37d697f527d", "value": "T162F356135848DB83E42897F4BE430E9D2F4B6B08E98679FB11524ECF3E612625DCD52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739176, "uuid": "99e81c09-988f-40e0-b825-bc591b1a9f3b", "value": "3072:pBiHxb+/UV7bGt+of3gh6+rGDpr2q+OcXdAVN:pBil+/0Gcofgql5+OXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692739176, "uuid": "0cfbbe82-30e0-4221-8af0-f023f436c5a4", "value": 166389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692739176, "uuid": "e0e7954b-a650-4170-a598-c4f2aa5c3678", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739176, "uuid": "73a95990-688b-40a1-bd09-81f88d00fb20", "value": "FACTURE DE PAIEMENT VIGMARK.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e47ffa-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690643, "uuid": "3119e204-d679-4ab0-b391-92808ea354c3", "comment": "Malware payload", "value": "608274322fc3df53d80dbf0f25b052d2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690643, "uuid": "839a490a-d6cd-4114-bb1d-8f22969f91b5", "comment": "Malware payload", "value": "af185ffe83668713bfe6a5a61742190fb1462c303318afc4c973fa425e10ac9a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690643, "uuid": "401db35e-505c-414e-8636-c07a6af3b4a6", "comment": "Malware payload", "value": "c681d388beb683788987d8b11edcac11f2890274", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690643, "uuid": "666732b3-5421-4a20-975a-c29878b40dae", "comment": "Malware payload", "value": "553d7feccf6247f8d7af714319fe7bece428c9890d26578e311814d4213c1b9941b4df32f81d408fb48d0800f0832447", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690643, "uuid": "60a84031-24c6-4051-9228-3a7608c58dcb", "value": "T1E1A4232EBE5694B5C30BC3336204E833AA5D2158C445B63E15AE188A1D75CCECB97FDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690643, "uuid": "e7905fe0-5a15-4f1f-9de6-3dc53ebabb3f", "value": "12288:Ms1pGL26L7+kumLHAFsyX/HsQzJEvi4EVoNYs:NDGIkxg5mvi44oN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690643, "uuid": "d76703d3-9511-48d7-94d4-d9a2309c59ce", "value": 457767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690643, "uuid": "0ef8203b-8f3d-4ff4-9cf3-0571b9baaf0c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690643, "uuid": "41652440-6d7a-4af6-a530-b03728d077e6", "value": "Offer 2300755C.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a63ba0-40b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1692684729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692684729, "uuid": "1c3bfb53-1886-484b-93a4-db91979d7988", "comment": "Malware payload (AZORult)", "value": "b6149f93bfd5965f6619a10b002baaeb", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692684729, "uuid": "829aaecf-dcdf-438f-bf9e-404aea9219f5", "comment": "Malware payload (AZORult)", "value": "afc97428348462bec3f5f1a55ff3a39dd7b8c49bad76b784024ad2476ba43172", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692684729, "uuid": "ef1ab04f-28dc-4d94-878b-f868e79db9e5", "comment": "Malware payload (AZORult)", "value": "c587df9d164c59c775d8f05aa5988e5fa2538495", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692684729, "uuid": "e64e6a59-6605-49f8-a5e6-f30c9629e131", "comment": "Malware payload (AZORult)", "value": "409e9aedb1e535abd28a758314c1cd3b438e6916be44433c95c7b2475103b7bc71e28d73e6b8b1a0b0915cdec5c751fb", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692684729, "uuid": "baf43515-c03a-4542-9ac0-bfe64300a9f1", "value": "T128C4BF226F2DE851C90CC4B3A623C4CFA970AE6413D52593766BBE3F817C357EA1E149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692684729, "uuid": "2a30d31f-0396-4808-ae22-8c088cdf670e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692684729, "uuid": "1ed2e381-b910-43d4-a8bf-2941cadb6a30", "value": "12288:mYY4WeImE8C2Gu+6WGR9xPhFi2GGQDdJL:mYYn1zu+KXnHQ5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692684729, "uuid": "8618ab3e-1dbb-4657-974b-f9aa6ae9a437", "value": 565916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692684729, "uuid": "32aaeee8-328b-481f-9066-b573869acd7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692684729, "uuid": "06a94b39-29d9-4369-8141-349bf129b52a", "value": "b6149f93bfd5965f6619a10b002baaeb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a17dda4-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1692714482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714482, "uuid": "79578cd2-ad99-4f84-bd33-b4d4def99fc9", "comment": "Malware payload (Stop)", "value": "c4fc05338646a5132121c99adb6d3f17", "object_relation": "md5", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714482, "uuid": "009ee561-9181-47cc-8395-ed35bef89ad6", "comment": "Malware payload (Stop)", "value": "b03dd67bfc32132c63da78e037f5ffa6093275f3c81ebf68cd10073bd1b9bcd5", "object_relation": "sha256", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714482, "uuid": "a256ba73-cdf3-4882-af2a-7c57d250d757", "comment": "Malware payload (Stop)", "value": "ff631632c638a888e67040ac1ea886e4a0a8b710", "object_relation": "sha1", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714482, "uuid": "cd87842d-3df9-4aba-92d4-a1a9267172b4", "comment": "Malware payload (Stop)", "value": "3cb2e9db40cf3a88c9d42b5962f65d4bd01af6f092b7d4ae0397d054dcb2cabddf676c619e6af27f12671ffedf963ad4", "object_relation": "sha3-384", "Tag": [ { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714482, "uuid": "159cb5b8-c516-4a49-b39b-a4ae19437f6f", "value": "T155F41213B6E1D032F72346714FB6C7A86A3BB8728FB152DB2785952E1E711E1C6B6301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714482, "uuid": "32f1cf42-a05a-4dbf-afd5-d8b7de3bd833", "value": "a58360eb10a18d5dc70efe7d39616fa7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714482, "uuid": "ac5e5b54-f30b-4ef5-b8db-2d884245f729", "value": "12288:kl1MhmfZjFT7W6qy7i0Wa6gl58IfcRf3gbogv3vShDjEZCXqVabL6KawjcIXA:kghWjt7rZ8S5ffcJ3gbogn0DjEc6Vm6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714482, "uuid": "d43c1dec-5ef0-4db0-b975-65f437533a6b", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714482, "uuid": "c9c12508-89c4-4f9b-9860-ed973743b465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714482, "uuid": "3a3760db-faed-43f9-b285-f006db225ec0", "value": "2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4659a58a-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738608, "uuid": "4be65cd0-28f1-46ec-afb1-86a1796e886c", "comment": "Malware payload (Mirai)", "value": "6ea67c28daa46c0f28865808a2027f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738608, "uuid": "13e56261-b12d-4d0a-bc8f-ea703b90fc18", "comment": "Malware payload (Mirai)", "value": "b0b44a19db4dfd33f3ae200e9006ab17db947fa6fd576b28061faa075a7f8710", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738608, "uuid": "74491b4d-7dca-44f0-b319-54366a401602", "comment": "Malware payload (Mirai)", "value": "a6046066d85947e7e8793a3647dbc15c0042f99e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738608, "uuid": "c167b91a-909c-4e06-92a4-e9360706acc6", "comment": "Malware payload (Mirai)", "value": "566639339891cf7bddb7752394ebecf7f0c43f29dd6b0f06690e6254a7a75f65f008940feb0b4990e6ae31f36b7f01d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738608, "uuid": "b65cd855-908d-4e3c-96db-0382c0e06909", "value": "T120336C36E029DED0C6960134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738608, "uuid": "e376b4f3-3269-4d26-9151-fdd4792b75c5", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738608, "uuid": "6c714f5f-66db-4e92-b785-8cfc87ec7bb8", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738608, "uuid": "14c3acaf-7758-41ff-b97b-66d11cbb159a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738608, "uuid": "202d703d-c8dc-408d-bd48-075f75236339", "value": "6ea67c28daa46c0f28865808a2027f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550cdbba-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690529, "uuid": "c06e8368-478d-481f-9570-5ff12e9e3c1a", "comment": "Malware payload", "value": "022f366ed09624606c47165d25a72bfa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690529, "uuid": "7bb9a425-4189-4ed0-bfb1-dfc938ca3cd7", "comment": "Malware payload", "value": "b122473d00566758d09c695d191b368e0c815c65e8acc0f00da7a88e45cc8a9e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690529, "uuid": "99dfee0a-0e0d-4021-b698-49536b4cc918", "comment": "Malware payload", "value": "e4fad106664d2fef583bdacd068f4face5baecbd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690529, "uuid": "2c6b6f6f-7d52-4a9c-8e3c-f8cfc0cf055f", "comment": "Malware payload", "value": "a659b3ea1eb0aa7c748a87085d47b04d5a90a082e46a86bb9e1d3eb19348140d42095f1af284b8334654544c9acbf1be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690529, "uuid": "b9235287-4d4b-42cc-8000-9035959b435d", "value": "T169747E1794CE0B128E78BAD548BBD717EFE2D6489304446B73933BCE9B26E69143E344", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690529, "uuid": "eb280c83-79d4-4d6e-800d-e869ae16e078", "value": "6144:rGzKe3WrPVBH49qDzLLzD/L70xz4/mzoEBIKoFgL4qcWU9Lg+NLtZUWXB+5:r3vbkqzD/0CEBIKJU54r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690529, "uuid": "f8958bed-6e75-4693-90b0-2bf54e9721a8", "value": 361948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690529, "uuid": "d2cc499d-dad2-4460-b821-30fca9dbd804", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690529, "uuid": "6bd0cf08-879e-4eb2-9962-ecda534a5e7f", "value": "Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aaf0d22-4134-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692740468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740468, "uuid": "498fc971-7560-4ae4-9c40-1365f6e56c73", "comment": "Malware payload", "value": "e3a3f54ea407a6778d4a98e49d7a2426", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740468, "uuid": "17ee31f3-00d4-4a0d-b4b9-f40265ddacca", "comment": "Malware payload", "value": "b22acde884c3e56ce6e27f53620ba8060f79939d2545cc03b03296e7391778fd", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740468, "uuid": "7368c503-99dd-4897-92e2-510e9813e9bc", "comment": "Malware payload", "value": "b407cc79b3ad6614bb8c226c8a7aac7a197116e8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740468, "uuid": "a41c2306-1118-481e-b4c1-4dbe5aa3dff0", "comment": "Malware payload", "value": "9227b0ec45d7024fcaa56425dcef23f86906a1e3c18d36463dc90b2c13bbb2e36e1c97a06d48e944548438231395b86e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692740468, "uuid": "6bca8698-864b-4699-9e4e-95fa98750fc8", "value": "T11CF357135848DB83E42897F4BE430E9D2F4B2B18E98679FB11524ECF3E612625DCD52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692740468, "uuid": "29dea40b-bcab-4776-8053-d97bcdf548a6", "value": "3072:pnAxb+/UV7bGt+of3gh6+rGDpr2q+OcXhqO:pK+/0Gcofgql5+OOqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692740468, "uuid": "791f6712-4797-4066-9fd1-92170fa51c3f", "value": 166489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692740468, "uuid": "db5d73ff-6c31-4649-9694-2c3a48aef046", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692740468, "uuid": "0e71fc88-12d7-49fa-b2bd-2f00976dc635", "value": "PAIEMENT DE FACTURE Andre\u0301 Labbe\u0301e Inc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7391622-4146-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692748220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692748220, "uuid": "36cb8a0d-ef3e-446c-a896-d116a3e54343", "comment": "Malware payload (RedLineStealer)", "value": "0f44ce948fb795200e49a385da663fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692748220, "uuid": "6291a94f-8a7b-420d-a9fd-39d6002b1d45", "comment": "Malware payload (RedLineStealer)", "value": "b27a6d841380f2dc3e011b8dc60fd30524898675d5fe3f0070d594330b3ea5f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692748220, "uuid": "bb7204cc-5e70-472e-a88e-2b66a765fc66", "comment": "Malware payload (RedLineStealer)", "value": "9d9efbc7a363f5ebda0e8b70dca669712aa20c34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692748220, "uuid": "b1a907bf-c211-40bb-916f-82064727f898", "comment": "Malware payload (RedLineStealer)", "value": "6db70891d988c5e97c26c7ccab8388ee0d00964406fb94b4aa9ae074196a4964e68f7e8f5204c368b7c87696373dd172", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692748220, "uuid": "f8a6d7bd-0d6d-420a-baeb-b9867b8fa5f8", "value": "T17C051202BAEC4437D9F627B06DF902934B317CA14D7047562B85B9AB0DB36C5BA32367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692748220, "uuid": "6154d394-cc6c-45e6-a8bb-2a6193dc59f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692748220, "uuid": "cd137dcc-c01f-4f9b-a083-93b753f1c682", "value": "24576:gyvFGW10ijG8t9hqB285b/4wW/vbBWIvdM3:ntGW6L8tnq0Mi/jBtvy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692748220, "uuid": "ce9b93d0-aecf-4b80-96bf-2480b680617d", "value": 848384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692748220, "uuid": "c418d95a-881d-4743-8f80-3422024d6ab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692748220, "uuid": "b159c01e-b7c7-4e51-96d5-b774f690c376", "value": "0f44ce948fb795200e49a385da663fdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83d12b9-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1692689837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689837, "uuid": "c655bc99-67a3-41fc-b6e0-268eb447c1e8", "comment": "Malware payload (LummaStealer)", "value": "1bcf03b31489b63436d4216249bbf246", "object_relation": "md5", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689837, "uuid": "fd92bbc5-53f6-443d-990c-62d543ad0c3f", "comment": "Malware payload (LummaStealer)", "value": "b287c0bc239b434b90eef01bcbd00ff48192b7cbeb540e568b8cdcdc26f90959", "object_relation": "sha256", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689837, "uuid": "b3465856-f4f1-4757-a4e1-b177c6ca5c1c", "comment": "Malware payload (LummaStealer)", "value": "e330e5b7f62ca55cb6e6c97406e0b56878806960", "object_relation": "sha1", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689837, "uuid": "2598fdf4-f355-43ba-b03e-1530313da7c2", "comment": "Malware payload (LummaStealer)", "value": "e803c6e2878daa39e4fce22e090c3e212490fddc549183719284eae0a05c997421d50f65c9d060448ff0ab25da512419", "object_relation": "sha3-384", "Tag": [ { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689837, "uuid": "498c628e-e772-4153-8f63-7d61562ec026", "value": "T11816BF12B98AC53AFA3F6172957AF7B6117E7EE00B7244D762D93A7D0A704C14232E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689837, "uuid": "c8b4d35c-9394-4881-8745-00193e61ef50", "value": "98304:SQCt+uKTFy+XHBflMPzidUtyWmk60KAOmG:DCh0BfMEWt66DG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689837, "uuid": "dfa66b01-8c8d-4ac4-81cc-b83d8e91a668", "value": 4230656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689837, "uuid": "ff6492aa-5b45-4eac-b153-34498e8b6e62", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689837, "uuid": "248399fd-f3bf-4e71-a662-6fb889e0ca96", "value": "1bcf03b31489b63436d4216249bbf246.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "973d3500-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689782, "uuid": "7a38b02a-f282-46a2-986c-b84096a86430", "comment": "Malware payload", "value": "12f77fb3868cbbc35ae7d8422f186839", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689782, "uuid": "af517e9e-c643-4fd8-914a-86b0cb36b877", "comment": "Malware payload", "value": "b37304e682b165879ee3d600e392eedced16f3baa65f1636b10187d29e2bf9f0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689782, "uuid": "5de56ab7-9ea2-49b0-8902-5f2758b98cb2", "comment": "Malware payload", "value": "810f8b0f16af4fd1babc31bea3d55dd1be7d7451", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689782, "uuid": "bd46dd32-da03-4554-b414-a780596d4c58", "comment": "Malware payload", "value": "56952250e9dc9714f14f4ac5b1621c8e324e2016388385cc326ddb585ee4c68ac5c7942c4bd411f94b8aa7d5dbb3d8d2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689782, "uuid": "5e4b916c-858a-47f7-8a61-05badbbf9e15", "value": "T1FC55F003A8109F97C40D87F87E2319DA0F0F6F19E895B9DB14533F8B3B716A2195AA1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689782, "uuid": "8e66fd3f-f894-4f56-845a-b6d0447eb98e", "value": "24576:urYZyaw6VOHXZSC1ZyTw6V0AXZSdHdcbOcyTYx0FHQwXx:urKO6VMEAv6VDE4OlTDwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689782, "uuid": "e25135ee-4a10-4c82-bdd2-100d74e59ad2", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689782, "uuid": "fe41e684-580a-4454-b539-094760ab8e55", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689782, "uuid": "122a37ed-233c-4be4-be60-b4064d04b860", "value": "oferta 202308-10_21.08.2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8743f4c1-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692689755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689755, "uuid": "dbdeb04f-4739-4d88-8ac5-abbc9ae31c95", "comment": "Malware payload (Formbook)", "value": "2f3413191e56d51c92e0b65d6cb70236", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689755, "uuid": "1cdc53df-eef3-44f5-8c80-2df542143f12", "comment": "Malware payload (Formbook)", "value": "b3951d633b83ab57576f4b68837edd8866747f56db5c7b64311d67ad407d9b49", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689755, "uuid": "e6154f1e-81cc-42b4-b238-e14905467b04", "comment": "Malware payload (Formbook)", "value": "1d7881d0abd787424867629ba2d9b94e4caa3dac", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689755, "uuid": "1af1ca60-3745-4a27-b723-a3843a2d7d46", "comment": "Malware payload (Formbook)", "value": "6698059b66c2f9d52ce8b3e57e4b210b5120435ce99251a2a3963e532a2da9430499d938cf6764ed1e45d024d344f1df", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689755, "uuid": "384f07f6-5b65-4f56-bd0b-08dddabab84f", "value": "T1C2C36769D34F0269CF6252779B1A0A4542FCBB7AB38412B1306C937533EEC3D91266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689755, "uuid": "d6f84b03-6f11-41de-a24d-f19b686a78ca", "value": "768:rwAbZSibMX9gRWjuMpVZzih42+Vbaq9td/kAtMBF0TZB4M3/0a:rwAlREVZztaq9t+mgF0T34Qsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689755, "uuid": "de0a411b-b7ea-43ae-bf60-eadbf97f7ef6", "value": 127639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689755, "uuid": "f2ebc262-6596-48dc-a350-58e5cab71c27", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689755, "uuid": "c8422477-2c35-4d7a-8de9-2363e455fc7b", "value": "INVOICE-4500986-GMARK.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837ce9c4-40e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692706069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706069, "uuid": "233ca5ab-7f81-4f3a-ab93-f96d5dc63d52", "comment": "Malware payload (AgentTesla)", "value": "6a0a9e6e1d0d18b353682868231719dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706069, "uuid": "e6ac6871-e3d5-4b7a-898b-d6a0a8dceb48", "comment": "Malware payload (AgentTesla)", "value": "b3be1fe7098ff321491612d574fa9b51205e823f9883abe7f234aaa39f0a32bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706069, "uuid": "8c1ebe25-e775-43b1-ad18-ad26c0c2d918", "comment": "Malware payload (AgentTesla)", "value": "388db5c1eb3474699a4a2c98716da0537e3fc4db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706069, "uuid": "a69a5a59-f46a-4c2d-a56d-df7130013949", "comment": "Malware payload (AgentTesla)", "value": "264dee8353332c2e402dd93c48186eb9e072296510d6d4cfe72ce848e104f553dcf5478bcb99cfcda40aa6d65c08a622", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706069, "uuid": "7f07e641-48f0-4f0c-a704-d0d190b61290", "value": "T1B2E1B72363D89732E6720B76D8B39782027AF360589BCF1F5888110E6E533554793BE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706069, "uuid": "41adccca-b483-4fc9-9472-3a7dcbfb8714", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706069, "uuid": "287f0fbd-d0f6-4734-9775-a4a22fbe4b82", "value": "96:3cVIpfDNi//Q8iQM3G4L9VDjXzKDFC9YRzNt:4Ipf0//Q8iQM3G4LznX+Lz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692706069, "uuid": "8bdf2447-852c-47de-b9aa-e26bd03045b6", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692706069, "uuid": "f2306cb7-88c6-4388-b397-314cd9e4469b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706069, "uuid": "44d188d1-4168-434f-a46a-cf9534734cc9", "value": "DHL OVERDUE LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375a77b6-40f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692713672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713672, "uuid": "1b6c2a94-1099-4574-963b-59ca1dda253c", "comment": "Malware payload", "value": "fe1bc60a95b2c2d77cd5d232296a7fa4", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713672, "uuid": "c5b8f631-88e8-4946-9cd4-f2400edd251d", "comment": "Malware payload", "value": "b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713672, "uuid": "b7639123-1c52-4d6d-9be1-969360c3d953", "comment": "Malware payload", "value": "c07dfdea8da2da5bad036e7c2f5d37582e1cf684", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692713672, "uuid": "f61fb56a-f980-4a69-8e62-70e9ba22b330", "comment": "Malware payload", "value": "51c9526437d69f6c200f0acccd295826dab3e409fc33ac19a32baac9e9d17f34d9f41e71cb024243bbe8751b79b30672", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713672, "uuid": "41688a61-e5ed-4b8d-862d-1a67ac9ea158", "value": "T19F645BC3BAA883CBDD2D43BA12B41F3EBC499E24158F9449D1D4C8D4D98E73278766C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713672, "uuid": "52493845-7ab4-4d08-b1b6-de638a0489e3", "value": "604de9c4534997ea4f32f86753fab871", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713672, "uuid": "e40b2dce-557b-4ace-bdca-9a9225049487", "value": "6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692713672, "uuid": "5e232168-4d5e-48ea-84f5-dc15daa7bb19", "value": 320760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692713672, "uuid": "8f82ba5b-c4c3-4abb-af64-dc7b7ce82974", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692713672, "uuid": "c1b775f5-517a-4e8b-a786-16a6221491d9", "value": "Endermanch@Cerber5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf57d409-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692683406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683406, "uuid": "64f200ea-3b24-4a2d-8f1c-5439d5b1bb00", "comment": "Malware payload (Mirai)", "value": "813421413e08fd7701442eb486f89292", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683406, "uuid": "971b06a9-3ecd-4aee-91fe-fcfc7a8c9e0c", "comment": "Malware payload (Mirai)", "value": "b5bc32cb96e56e787f0f4eb8be30ee792f0519f2adf908cc9d032ca0f9710efd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683406, "uuid": "655b1c03-40de-4d79-94ed-16dcdf05b864", "comment": "Malware payload (Mirai)", "value": "a8eb976c22cda8f7a35d0d5f5814cb52f03e51a9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683406, "uuid": "98eaf400-3221-407d-8e32-b0722775b132", "comment": "Malware payload (Mirai)", "value": "d0fb6fe492238e6b5efca8eb20700c27a9c9018f42d0a41cde831d1945bd37d05fcdf7c44d04bd51f7b3ff7bf130b5fb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683406, "uuid": "5700e445-de74-4723-be33-00bfad98e164", "value": "T1ADA2E01472632DA5F3ED1C3DC8AE8367F9671BFCD0F6327629405620C94924A3E39A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683406, "uuid": "4a4ce9c3-76ba-4370-b5d9-48b99bcea7e4", "value": "384:vvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjohymdGUop5hb:vvQn4j+ZO5fKAlxMs3Uozt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683406, "uuid": "33eee0ed-8db5-40f7-8121-9024080ad4a2", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683406, "uuid": "2ba6a8b7-6ce3-4363-a213-edc120a32853", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683406, "uuid": "c71822b0-cded-436a-819c-9c819862104a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55a3c34e-40c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692692248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692248, "uuid": "aaf18043-ad64-4601-8426-eda8266d1396", "comment": "Malware payload", "value": "56c99c2c9eea00e2e41f2dfaca014912", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692248, "uuid": "920cc66b-c443-47a6-b194-07f1a4f8316a", "comment": "Malware payload", "value": "b6b35d3d47a8e88850b0845e3b71c97afe0243964d053b657a8f32443ea17a5b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692248, "uuid": "8b1fe507-d1af-48fb-8495-533125da6245", "comment": "Malware payload", "value": "402d8a76d86f71b22b86a9c37a45fbe3df859b2b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692248, "uuid": "73a71631-3974-44b5-bdd2-f09ea7224a66", "comment": "Malware payload", "value": "0469fd615f296d8fa3a67184ca9ea83f2f162c8ba251d204ddd14ab995e864aaea900395182cc22339121fd1a4522b87", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692248, "uuid": "915053f4-b949-4009-a7ec-ec8fd5d8c268", "value": "T1E54301DF0A47ADD8B66B6CA4D52E9C617389C0CF2BA7F8B5204D67B504C0CF3B594292", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692248, "uuid": "d51f71f4-8f95-4858-a8bc-71b8deced712", "value": "1536:j7DNk41w5mWLjVoTi8e7DN0Lb/cooi11TlkI:j7DNk5PPVou8ev2LYodjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692692248, "uuid": "1c4a6bdc-1887-4da8-bd36-65b9ba50d211", "value": 57325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692692248, "uuid": "f223cba7-b4c4-44ea-afed-22d9d7f4c5de", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692248, "uuid": "eab99142-9818-423c-8d99-4d77b335f6fb", "value": "cf87a44c575d391df668123b05c207eef04b91e54300d1cbbec2f48f5209d4a4.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0bc4a10-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689797, "uuid": "67836642-2620-4728-a36a-117a2a08287d", "comment": "Malware payload", "value": "12aaa2b6ec495c030203948c42858571", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689797, "uuid": "7474eb7f-7214-4b2f-828c-c2e68fce635d", "comment": "Malware payload", "value": "b751d28097f637d6cd142ff6f3fd32cc446a586e7f194da932e09db9d22b816f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689797, "uuid": "f0ecb6f8-7d73-4c37-b2d4-2e4497ea1d09", "comment": "Malware payload", "value": "ae76cae012a9185de5a2101039076bf427b9e936", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689797, "uuid": "d579d214-a858-46ef-9b06-e6c6222377d1", "comment": "Malware payload", "value": "943405b16fbefffba0ab5e36f28cfaaf56d62d067fdcad3763526a5feba1892957d859d5d3b89cb05a24ec5b905a5fa3", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689797, "uuid": "8d1236a8-a1c2-42a8-8580-7f21bc724539", "value": "T151152309B3D7C1DEC8B205389C8A94CB450D7C26AE51D1A3659ABBEC0172FD7C3AE256", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689797, "uuid": "e9d2b8a4-5a2e-43d8-9993-32a601f591fb", "value": "24576:Or/+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXIVBdrkAXZSAtrVX92CrjZx7XK8r:OrG6bV7rzEgrVXxzK8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689797, "uuid": "5f347c65-e38e-4ea3-85b9-d18eea17bc7f", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689797, "uuid": "500e6184-7775-4cab-bcdc-85e5c4a1c96c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689797, "uuid": "07f75a6a-eaeb-450e-a5e4-4043a790da2d", "value": "RFQ No. 8202023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f139de7-40aa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692681017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681017, "uuid": "0b370d20-f083-4af1-b06a-ef3fc54954b2", "comment": "Malware payload (RemcosRAT)", "value": "1c35a30c13de88ca3f69ef12c0d89262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681017, "uuid": "e852fac6-6bf0-4ed2-aa00-c1a1dfda6b94", "comment": "Malware payload (RemcosRAT)", "value": "b8b9c2bfe75178cec0d3b26b863bd451bf0233171332cb08e79bb6113a5b42d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681017, "uuid": "a89406db-8543-43bc-b381-cf8fcdc05cd5", "comment": "Malware payload (RemcosRAT)", "value": "608e1885ac8504394543b9d6224a4a88a4eb6b02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681017, "uuid": "2bf54c45-6bac-4f59-866e-d8b497bc6fc5", "comment": "Malware payload (RemcosRAT)", "value": "c78727092d834c51826f707a6c581c6dc4fbd0959ae9673a8b158682b3077c1703c9a6541799360fc7623d4d99eb2eaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681017, "uuid": "4e674c9e-9817-4e2a-9678-217bd618f054", "value": "T124646A1663E18A55CC7537F8907E214003AABF5A1631D356DCB83EB976B6783DE402CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681017, "uuid": "b4691096-dcc7-4e3a-8069-4262fdab770d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681017, "uuid": "3789f761-eda5-410f-a3a2-6d94ed8eaeab", "value": "6144:8Idki46oScBWfI7GRxL/kIp1kO+jQ54mqjomjTBuEVD:8Idb465cBojEOTim6omvBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692681017, "uuid": "2fcbabd3-a02c-4aa4-bcab-292a9902c377", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692681017, "uuid": "4026ae23-59e7-4b41-96b0-693e8c2e757e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681017, "uuid": "6b7e98b2-bfa7-4ce8-8140-cf01b6c3fc53", "value": "RH00986545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6022097f-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738652, "uuid": "fa790585-e191-4f6f-bbb3-d8f07578dda4", "comment": "Malware payload (Mirai)", "value": "59a88ffd101242ac1697d39e89a534a6", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738652, "uuid": "7070e051-fe2e-4026-ab3f-0772ce916aef", "comment": "Malware payload (Mirai)", "value": "b8db10d2c2284fc74d061720478245dcd14f325b6baf4bef482030ceea583974", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738652, "uuid": "c8b43c0a-0928-49b0-b687-5b6fb25b2799", "comment": "Malware payload (Mirai)", "value": "314947203286ee826915ac58bc0014295cd1f12a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738652, "uuid": "8d03db9c-db22-4db9-b7e6-b94f98d62c0d", "comment": "Malware payload (Mirai)", "value": "8143b2a30ac869ea6104804c3536a3f75586068596d672c4e9e9d7ac2d0f9b7838eb8f7c881c587eb6be07603dfbf26d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738652, "uuid": "c4eadb64-e391-4d27-8f3b-9756a390e8fb", "value": "T11DD2D0E685E3F6BCD0ABA6B5043D0784FDB67256C12606B708E82466DE571C91E30DE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738652, "uuid": "46703e64-e237-4c3a-a565-ca654eb8000b", "value": "768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBzUvVpSx0sMl:kYJdJZiy1aBnQfTqB46tMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738652, "uuid": "7000cd55-4a13-4696-9ef6-d70bfe1c7348", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738652, "uuid": "35b38347-6f17-4613-8be2-81123c614a42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738652, "uuid": "b3282b98-e837-4fbb-ad7c-77fe59e41851", "value": "59a88ffd101242ac1697d39e89a534a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef3356f9-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687352, "uuid": "f8568bd5-db3f-490c-96bc-fb7a964cb273", "comment": "Malware payload (Mirai)", "value": "9920cfbccda94b61bf203e010672592d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687352, "uuid": "0e481a9d-a107-4337-85d2-a8238411192e", "comment": "Malware payload (Mirai)", "value": "b8fd969063af3cb845d5910b7b2bc7bfd75309073f827b8a3df1ba2955a535df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687352, "uuid": "481f9239-e13d-40b0-8d42-bd9ce0cab893", "comment": "Malware payload (Mirai)", "value": "71339baa5ad591124a1b0b2374776b04f5ad5647", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687352, "uuid": "268c745b-a060-443e-b208-13284de4588c", "comment": "Malware payload (Mirai)", "value": "3bc783573723c019f6c101615e590c5c5fb92ccc7f35dee458cff84fdb0626b46a69b39da33d57b549a354864e300950", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687352, "uuid": "d11e30ed-dbe9-4bac-abc6-af0c24d0b35c", "value": "T13DB2D11EC0AA2EB4FDDB7D755D41E2817B619BDF3A61CEC05AC15A110322D281F8C9D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687352, "uuid": "4544121a-0832-46e9-91ce-a4e5a29cf214", "value": "384:2A0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIojHM4uVcqgw05VxJ8:oApCdvwJr69VJoA8FZtxCo8N4uVcqgw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687352, "uuid": "292d848c-8a44-4438-bf07-ad2e3f48ecbc", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687352, "uuid": "085e3190-ee13-4669-80c2-773bf6a670f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687352, "uuid": "562e55aa-0aad-4aab-999f-5fd3ee36b333", "value": "9920cfbccda94b61bf203e010672592d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912bc956-410a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692722413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722413, "uuid": "bacc5553-1d2d-435c-8439-300df9ad5d25", "comment": "Malware payload", "value": "6611d09b189022dc685a871698f02144", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722413, "uuid": "9d12b06f-c5d6-4132-b7e5-7a7b0466e5f3", "comment": "Malware payload", "value": "b9d6ead9baa77c5933e78e648e97f9f73a94ffb0a306affb908c8f31e7a88ec6", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722413, "uuid": "d622c28d-1086-4fa2-b26e-231de78b3c03", "comment": "Malware payload", "value": "b24458ea32b8afef685199a53de7b00c92993a53", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722413, "uuid": "5358addf-c786-49c8-ad62-be707cdafde9", "comment": "Malware payload", "value": "92dcfecd325246d0c4106c2c80db6ea002efa6efd05e6ec7931c1f80b740b2828df536955daae2b284ebb63d81355e2e", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722413, "uuid": "8ac21823-339d-4f23-b231-89003a4d3716", "value": "T17BD41294A6AD9F27D17E9BFA8271610457F250031877F3B81EC520FA7BAB7814E12723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722413, "uuid": "82686570-5fff-4007-a241-7508e0e603a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722413, "uuid": "eaad6710-3a80-4c88-9242-9f659cbc1721", "value": "12288:ZrcOh+xGb/8joNrz4OlpzC9dvyfu5YyxdeQXt7ZjSg:zh18+4OlpzCryfuvZ5kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692722413, "uuid": "d30230ab-6214-4430-ad0e-9400c2c1451c", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692722413, "uuid": "3bed6dc8-5eea-4122-b639-91640366d74b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722413, "uuid": "65cbceac-37cf-40a5-8083-f3847d4ef05c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc049a9-4104-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692720015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720015, "uuid": "943d160a-3c5b-4ea2-b0a3-b40939b125af", "comment": "Malware payload (RedLineStealer)", "value": "00b7354438e3a2483c5c4e0c52d10f7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720015, "uuid": "5e22bd41-d684-4b90-a0a7-49e230e01fa4", "comment": "Malware payload (RedLineStealer)", "value": "ba85db2614120d1e5b26b4c89847f219317a823bf1e3382cb379666677b0a8fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720015, "uuid": "b268b8ec-d3a2-4214-a1cd-04dcc65f70e2", "comment": "Malware payload (RedLineStealer)", "value": "c1c3b90b1cf7541abd6bd9f098811c368078ed0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720015, "uuid": "d9d8e133-9e2e-4090-9111-db78079062d4", "comment": "Malware payload (RedLineStealer)", "value": "681375b6b38330fc5df489755af95e5ea338b304acb70b900a1ad8d305b80ba91b54625d7fcfb4f81da7b88b5e8fd7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720015, "uuid": "62c7ff90-24a0-4f58-be1e-fead3917f7af", "value": "T1C4050220BAC188B1E8E618340DE1F771AB7C79300B7A9FDF9B4449295F705D09A35B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720015, "uuid": "e1660e1b-84aa-46a1-844d-5cca83a7812f", "value": "fa8d20faea9ef7b4e2b7fbfe93442593", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720015, "uuid": "48c9a2f9-f426-478c-b183-34cb8f4eb86a", "value": "24576:/DkUNi1EvGEW93Gtx1Lhrds4t+whW2ANQyj:/DkUrOEW9GLhds4tdUGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720015, "uuid": "7583bae9-02eb-4eca-8f2d-14b6299b67ab", "value": 858004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720015, "uuid": "1264c924-6354-465a-a136-151f884e4b2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720015, "uuid": "5a2a4bd2-47e1-4f08-ae98-7da0641dbae3", "value": "ORDER QUOTATION LIST.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4d8ab4-4100-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692718165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718165, "uuid": "eef2c351-7668-4976-8f82-bde0ef26a3a0", "comment": "Malware payload", "value": "38893997b22415ffdbf58672c19fab82", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718165, "uuid": "1446f8c4-a922-4cf2-b283-acef59aa0ac3", "comment": "Malware payload", "value": "baec113322a15700b9d26e5d180145e79f8857ae493fecb69049bd9cc506e926", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718165, "uuid": "1327db76-a0b6-4087-bb9d-73d1f848e8d5", "comment": "Malware payload", "value": "ec63e3d2e63220a43e0bb6ca85e5c4109863c320", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718165, "uuid": "4cec4aaa-89ff-47cd-879f-0a74aaf39abb", "comment": "Malware payload", "value": "d1652b7893e1b64fe2095dd2ee90741ae50a5975ea288190f48a077c60a43e85ac75f377fd85a80b5e01401df3669295", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718165, "uuid": "ee820973-ed7a-4a56-aa80-08d9fce9703c", "value": "T105236B0477A2C173D6DB173469B98661077F7C93AAF0945B3FA9060D8EB06D07A2D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718165, "uuid": "9acd366e-31e1-4a61-9b4e-7f72dd65d2ce", "value": "07ed6970d80772ff905788fa3e1463f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718165, "uuid": "bb6c0ad2-3d44-4943-9f2b-52f10683771b", "value": "768:WhTxc0Je3ufiM9T6pf+zU4bY50EcQISWYNKGIPsQyddjk8HIsJRVselzhW76Q:WhTxTyIkf3ISjIPQfrfpVGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692718165, "uuid": "bd00bada-037a-42c9-b57d-81ef1ac70cf3", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692718165, "uuid": "d23ad859-ff9e-4b3b-807d-68e48d3854d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718165, "uuid": "e1d1f194-5753-469c-b479-2bdd8fead0e4", "value": "SecuriteInfo.com.Trojan.Loader.1705.31720.24653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6afd13-40bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690245, "uuid": "58c1f924-b308-4c63-ae66-660e7e50df9a", "comment": "Malware payload (AgentTesla)", "value": "bf3bb6d76d480941f01f473e07bc61fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690245, "uuid": "8aa4fb5d-0a5a-4479-9c14-b46cfc105812", "comment": "Malware payload (AgentTesla)", "value": "bd1cfccc52b5ead10729558fda4e8827cd116c1d98529fd821709d6890f88b93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690245, "uuid": "dfba6b8c-f4d7-4620-ae12-f870009394ad", "comment": "Malware payload (AgentTesla)", "value": "d9126422c986b254ef06296768a9f6f65743093c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690245, "uuid": "a275aa0a-46ed-4daf-b335-92ceba6d3808", "comment": "Malware payload (AgentTesla)", "value": "205e06c8c01b8420377c40fe06f6dfc375fb8136841bc76438f5712c362bdb649541ea0ee674d1272dde8e8921e7a7db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690245, "uuid": "749b74af-231c-4ded-9f11-11d06b3129a0", "value": "T19754BF1020EE648DB1B37F921BED7CE94F6BB7A51A3A645D204C434B8B53E84CE55B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690245, "uuid": "2efbcafe-e633-415a-a647-335b0d818e82", "value": "6144:6zi6wrr2crrSreAQWhLpdwauSLDm0qaQrrrrd2BkLSWBsNw/2w2r2hoT/REHT3HH:6O/2w2r2hoTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690245, "uuid": "d0fc183a-b3f7-47d1-ae62-0f53dcf217c9", "value": 300634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690245, "uuid": "44605c9e-a815-4d3a-9d40-b5e494a2e71b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690245, "uuid": "bae5bf8d-c5d4-444a-87ad-07db26e91906", "value": "S_D_93020304994440.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed79f2cf-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692704529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704529, "uuid": "e0dac91b-d0b8-4a78-91cc-09f1a254736d", "comment": "Malware payload (AgentTesla)", "value": "0c95b75279999d69391477a183c458b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704529, "uuid": "92941026-2718-48df-acfc-c8c25b096412", "comment": "Malware payload (AgentTesla)", "value": "be0844c44e24e3abe80a169bf181bfdd2e26cd402f10329c62b6175467a83937", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704529, "uuid": "47a115fd-81c2-4df4-a7a1-0ed049aba008", "comment": "Malware payload (AgentTesla)", "value": "c1facdcf9e546158041c2aeddd74257fc28ec58d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704529, "uuid": "2d0b3bc8-ae5a-403c-8fd3-651d3f0f3e55", "comment": "Malware payload (AgentTesla)", "value": "e79e5aecb050d67eda2dc169ac837e0f54db40210fa2eb3605e5c422f2b15593b6adf5f787f11b34fb6fdb33d7fedbda", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704529, "uuid": "d9c1508e-71a4-48e1-877a-242bcbae8df8", "value": "T1EF05D03477642F62C3E7393BA744C4938752C0F95F6428FB2C6F2068184FA7A5919B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704529, "uuid": "a3b02c33-0a22-443f-aa8f-d4690728b566", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704529, "uuid": "298b9ea4-a6cb-4fce-814a-46dc38f87ecb", "value": "24576:wyczkOpgmYXdB2wi6gXlD1u64troNAeeCWKdvs:wre8V6gvujtroreCWoU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704529, "uuid": "4632d1c1-6617-47b4-a1ea-4f6ed89db7b4", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704529, "uuid": "9311fbd1-fb12-4f68-89e3-8ff1db058b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704529, "uuid": "b5940d64-6fba-4966-b2dd-c1bd7b762299", "value": "SecuriteInfo.com.Win32.CrypterX-gen.13490.7335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793f9a9c-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720655, "uuid": "7a3bacf0-a754-4db4-a393-2959da615889", "comment": "Malware payload (Mirai)", "value": "7a9e38e7960558f8c00ccb2c7fa4f3a4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720655, "uuid": "cecb9a77-23b6-4ac3-85e5-f9e89f5e6814", "comment": "Malware payload (Mirai)", "value": "be812ad052a343aef9d261d231e33db8cc6e46f672a13e922b6de04012cbe0b4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720655, "uuid": "248906ed-309a-4489-b17c-d66dafb61c53", "comment": "Malware payload (Mirai)", "value": "13513374a7c13a75f138843898deac075485a9df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720655, "uuid": "c5b638ff-b114-412d-963b-54ea79d11b07", "comment": "Malware payload (Mirai)", "value": "b095330c5155925161716f3612082746d2b3a022d0ef486b47d6e1775d336d8e5a2b905f78b4ab58757090c90d567488", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720655, "uuid": "c47c2390-50b0-4615-9bc2-ecbea11138a8", "value": "T11CD34B1BB6C190FDC4DAC1B44BDEF536DD32B0A82234B12B27D4AA362E59E305F1DA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720655, "uuid": "8f8c2f17-690d-4fb5-8458-1120cd8cd321", "value": "3072:3k7Q3T9Da/s2UwW+aogOJeesRh8zceMOm8+:3k75vTcS68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720655, "uuid": "54aa87d6-501b-4ea2-8dc1-9740b0445b71", "value": 135480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720655, "uuid": "b53299b0-fa0a-4ec5-8a6f-9851fa9b2f96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720655, "uuid": "24ce05c5-22d2-428a-9a82-966fb4894a62", "value": "concakhbtandhuy.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad480bd-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692690620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690620, "uuid": "cb49dea0-d7ec-4245-88d2-991c7abbf618", "comment": "Malware payload (AsyncRAT)", "value": "195083d2c52533c9a0b1323a96198314", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690620, "uuid": "419b93a1-0fe3-448b-98d7-f25248dba2f7", "comment": "Malware payload (AsyncRAT)", "value": "beba711e481d1ded542da5be8b7b6a6dbc97b922830a2785db3b3c891fe0bad9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690620, "uuid": "0bacabb9-538c-44ec-b986-40aaf07d9860", "comment": "Malware payload (AsyncRAT)", "value": "5ca31514fb6d742590f93468c347c0fe20e9b7b9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690620, "uuid": "4eebfd8f-02a2-4679-889a-787a513abffa", "comment": "Malware payload (AsyncRAT)", "value": "719b8c977d6c5168632d3748c714363d0faa9edd112fa76f416989d52d1f244941ddc3ea6d6661da48ee4a853a988e89", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690620, "uuid": "5127e569-df4b-4348-b076-d745dc39827a", "value": "T12354F59D351432DEE917C073FAA8FC67AA243876471B4702A0D395AA9A0DCDFCF141B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690620, "uuid": "54e43c5d-d320-43bc-9e05-e29ac22e8205", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690620, "uuid": "4034b37e-53c8-4655-9c39-efe6d7db9055", "value": "6144:I2UA3/ZUwmWtAswSwL9Et6chQn7GiJ8NOaH6cI:I2UcZU1WtfwSW9EtXhQn7GiJ8NOaH65", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690620, "uuid": "7364fa1c-561b-4759-a114-7c901bc1177a", "value": 286208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690620, "uuid": "cb5ed41e-e16a-44ec-9f7c-16c1b829d414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690620, "uuid": "23479054-02fa-4f4c-929f-eb2bb1cb3bf6", "value": "195083d2c52533c9a0b1323a96198314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac539e1-40fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715477, "uuid": "c827d33b-6b07-4d85-8c44-bea93b7ed0ba", "comment": "Malware payload", "value": "21c7814c95e5a510c2e6e538e62dba15", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715477, "uuid": "638fc633-409a-4ee5-98b6-29a72649513e", "comment": "Malware payload", "value": "bedda55a233c9dff70e80311718207465dd17795b582f3b73bef45de9f5eac1e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715477, "uuid": "9e632735-9b45-4b90-a977-ad7ea6bd6adc", "comment": "Malware payload", "value": "e57d1312d10c43a981299c12af06d54fda5ac902", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715477, "uuid": "daa64c90-11ea-4a26-b624-856e05accb03", "comment": "Malware payload", "value": "5142a358cb22ef0988f99cc1eb2d9e657bd8eb17fcf69343c8f7ccc8e027e509277b892df7d9bc373b7fc5fcabfe174b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715477, "uuid": "a56aaf5a-289b-4850-81e1-d6080047d66c", "value": "T1661419396FD394B2D0B3C2744AF18583FE23FD9235614E0E25D543458C62A62EDABE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715477, "uuid": "cd7ad2a3-b93a-4029-ba10-92f78b8d88a6", "value": "ba23a556ac1d6444f7f76feafd6c8867", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715477, "uuid": "819e7907-433c-4f1b-9807-3bfed1e7a9e6", "value": "1536:1EGh0oTl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oTl1OPOe2MUVg3Ve+rXfMUy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715477, "uuid": "323c2064-94b4-4421-88f1-3c128aad4578", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715477, "uuid": "349d4c75-bdf4-49a4-8562-0f4464eb7bb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715477, "uuid": "b736789e-ca2a-4458-a060-5bdc0fea34ba", "value": "2023-08-22_21c7814c95e5a510c2e6e538e62dba15_goldeneye", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541b9d98-4114-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692726606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726606, "uuid": "5b7ce0ad-5e14-4651-b93e-1b3debf5f7f7", "comment": "Malware payload (Mirai)", "value": "78bb1df9a5f77f7fe24145e840f59b4a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726606, "uuid": "e3d74ba7-2e8b-44aa-b7c3-c00160fd2e8c", "comment": "Malware payload (Mirai)", "value": "bfa87ff1a797915aff500e3407bfe74de2df60f6a54acdd13ab9144844873794", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726606, "uuid": "efab41fe-9383-4532-9cda-d7e52c466641", "comment": "Malware payload (Mirai)", "value": "471c8f2027e53ac7d518238312cdc069f8e2b50d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726606, "uuid": "9f91fa44-080a-40ad-ad2b-c5138881dc96", "comment": "Malware payload (Mirai)", "value": "74da0a0723a092ec31694b944bc9dd8d923f8fecb7d3cc55f5d72f3ae5eb17a7535bcdee383df6c2f355f5b312e94a4d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726606, "uuid": "145dc9ab-2360-42db-bf32-267590755bd6", "value": "T1673302625BBE26E251B15737FC33AC16A3DC17F9987730962CF05A1577C580249F6382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726606, "uuid": "bbf0b7ce-3f5d-41c2-ae5a-00c1d2585126", "value": "1536:s9O/ZMAXIxNUk0FRLcPqF1aBexo4opKZbF:s9O/ZNKyPLGqFUFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692726606, "uuid": "c06908b4-d3c3-4bfa-b18d-740faa67c613", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692726606, "uuid": "876e9c03-6231-4830-8737-51acd0fcbd68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726606, "uuid": "2359dcb3-03cd-4079-ad0e-a2d3df86f5d5", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993cee51-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692728869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728869, "uuid": "d7981f08-ced2-4b6b-aa2c-a0b09a1d2562", "comment": "Malware payload (AgentTesla)", "value": "d7f9883d7d1e2598cdb4bc244292d951", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728869, "uuid": "6f813522-2b44-4265-a4f2-c4aa4a8cce31", "comment": "Malware payload (AgentTesla)", "value": "c01aa0e49d9443f5f4a9c46893397d054eea93f921734704e1294d77d44876af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728869, "uuid": "5cd2b8f5-ea92-40ce-9fcc-c67a05aaf505", "comment": "Malware payload (AgentTesla)", "value": "bd56e1ea73bf48350640d8430cbada1997a8435b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728869, "uuid": "4e2aac8e-ef9b-427a-bee9-0d62989777e3", "comment": "Malware payload (AgentTesla)", "value": "1d8ae780c1b8a5dd83d2740085c97f6f3029da134485597bd4af9ff772d62bea7efc789d306c0611a640c16e1b637da2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728869, "uuid": "77686054-d191-459b-b7bd-4b80782e4ffb", "value": "T19205DF7424B74A6CF1A1D07BAD90E4087F68B302F4DB91252955EB53928AD902CFEF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728869, "uuid": "627de469-4e69-4a6c-aafb-e88a3787a7c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728869, "uuid": "c82dcf4b-cb33-4176-8aba-ffb61b62f8d2", "value": "12288:ClLzC4jRyum9eCEmmV3IUpTO43eB8HvBC6yjKjM2CXvsAdlMLkhf9f:GLO/PEmM1pThuBevzyjAK/d2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728869, "uuid": "43760c6c-5292-4c6e-b453-55abbcc8bfe4", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728869, "uuid": "664006cd-2609-462b-ba09-2e2bb5eb0358", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728869, "uuid": "31e64f6f-b639-4d8a-aa68-90f7b17fdf5c", "value": "DHL OVERDUE LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e8aba4-4109-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692721752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721752, "uuid": "b4d89ee6-2ffa-4a42-b22a-3629de373b56", "comment": "Malware payload (AgentTesla)", "value": "b80ccca905f4d6e3f2495791c0038661", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721752, "uuid": "5d3a2950-f084-447c-a273-f3ac712cfbc9", "comment": "Malware payload (AgentTesla)", "value": "c033a6fc3b710a99f9f149f1b43320d29460d4dfbd94413e4bfba78e92228acc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721752, "uuid": "d6c8e5ac-6bc1-4e00-9125-1aac74ed68c5", "comment": "Malware payload (AgentTesla)", "value": "3c99b0205fdb4bd1d48c805b5c8873cf3fb01eff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721752, "uuid": "58f06002-9d4e-4e7b-83b7-ed24f74b5c6e", "comment": "Malware payload (AgentTesla)", "value": "630a82b931d8e8459c09ac58d62db4aed8a61ab5e1adc56c7471aee588fc536957c916c5da26335537ea6ae8f001408d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721752, "uuid": "0d9c3863-d97e-452e-804b-3282c16c727d", "value": "T13EC4020D51EEFE42D27987FD8023406827F7909AD332E61B9FAD55E95E627D0CA42B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721752, "uuid": "2ae4ba72-b033-44c4-bae0-0c254ca3b3b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721752, "uuid": "ba9ab7fd-6ee5-471f-ae7e-2164e7a6615a", "value": "6144:Zv2kGWBviYtnKTm48mxAoKvI6iduwhabLX8+n8OkRWP8/hUNBpytOvjRKjAGk8/C:ohW7Rg4iduN3KRWEedKO7wZZvCS0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692721752, "uuid": "133b40bb-2bdf-4536-be74-081986f7a154", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692721752, "uuid": "a2869f37-1b88-427b-9836-bb10878ad161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721752, "uuid": "2f32d557-19c1-438b-86b5-dc24cf09d421", "value": "SecuriteInfo.com.Trojan.PackedNET.2292.6479.7749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c59a27d-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715963, "uuid": "0c5262c7-e242-4e7c-9d6c-037d7971f411", "comment": "Malware payload", "value": "ee7cc21d62fd495198159bbae80dbcc2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715963, "uuid": "c33db948-f0cf-4dc8-80bc-9301b90d1fdb", "comment": "Malware payload", "value": "c14ebfc076f06e2194587fd7246a520c648f78c4ed730be88c6f6deb0ae1f70a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715963, "uuid": "f99da465-5d17-4abd-bf7c-2a3360aa1bce", "comment": "Malware payload", "value": "19f3d53a63dcfc293884006d779471d251c32570", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715963, "uuid": "f8227f9a-1313-421b-94b3-ece23651ed6e", "comment": "Malware payload", "value": "d97c718d34e754981f1be89783bd89b3ade5093080dbf40c607b9e11a72a511c47b741625518e7501002fcff3ac49c8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715963, "uuid": "29b10975-9db6-481b-bebd-4ab55f79479a", "value": "T120F38C19B1D1A0B2E4F30976D5B4AF12442DFC111BB07CDB72E21A9E19321E39E39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715963, "uuid": "319ca305-70e3-4a96-8bb7-fbcc4379a8aa", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715963, "uuid": "bee018ee-d166-4a75-9c50-4feb8dedc3a1", "value": "3072:l5K/B0toLzSNJklZHQsozTS+SMqqDL2/TrKN1G:lcytweY1yTS+xqqDL6HKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715963, "uuid": "3e32b51f-b279-43c4-b2ed-aa66d00d512a", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715963, "uuid": "1330c168-52f8-456c-8bc7-f4eb751711d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715963, "uuid": "744764fa-9ccb-4478-a5aa-a58df123ba37", "value": "2023-08-22_ee7cc21d62fd495198159bbae80dbcc2_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6857ca74-40f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714184, "uuid": "3ea704bf-75f8-406a-926d-c39ded99b73e", "comment": "Malware payload", "value": "788468a5de98d598c32fdaaea7171e8c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714184, "uuid": "85eee843-bae0-4d82-aafb-dced73d0c18e", "comment": "Malware payload", "value": "c1541dabff4ef4cadea71595847685b69a3d61c0dc858357bcb9a275e12fc1f3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714184, "uuid": "168d2850-b5c5-492f-ac92-35c6c439bd1b", "comment": "Malware payload", "value": "898e4596ef53665893a1943611ee0ce878368830", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714184, "uuid": "8e5db70e-ff5b-4d5c-8e5c-cac68607b1fc", "comment": "Malware payload", "value": "0405751bc568d2cdbfeb29b3a9efe24b38cce9fe877fcee19b9ec2a39ba850feb8dbaec4d921de155b91749abcf411a2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714184, "uuid": "dfea506f-7904-4165-973d-ae05a7745952", "value": "T1CB45BE307542C132D56141F05E7CEB9A90ADBD384F758ACBB3C86B2E4A315D26E36E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714184, "uuid": "ccb26bd2-4f6f-4180-9c05-1e69cef5b166", "value": "f527e8080fac9432953c548a4f7317af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714184, "uuid": "86a6e24b-4ed5-4e86-a3bc-d37f03fe6128", "value": "24576:BdFLBWMFVfN3YL/pts6T1r50WiRuTx/0OjuSIUxMgWIMzHk6BMEIGaVp:dLcmN3YLwS1ARuTxru6MIMzHxBMEIGar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714184, "uuid": "e178c572-0dba-42f7-8305-ee74c945ad72", "value": 1257984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714184, "uuid": "f4ddf5bb-67c3-4d51-bf8d-f2ea4c92f20e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714184, "uuid": "4d108c30-7985-469d-add3-20ccb846741d", "value": "Help.File@zohomail.eu_Manual.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9110ef91-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692690630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690630, "uuid": "ccfa71c6-7885-4d76-851a-b57da1fca819", "comment": "Malware payload (STRRAT)", "value": "b5cb2e8897ff9336f08944a278e02705", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690630, "uuid": "ef8df0e9-ba46-4152-9870-ce3a09e30b66", "comment": "Malware payload (STRRAT)", "value": "c1bf31b2a598ef4c86904c417912b0d7b729a3e180dc4453e24e8c3cbe698e65", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690630, "uuid": "e1f0ab59-615d-4c4c-b623-da46b7ffe58f", "comment": "Malware payload (STRRAT)", "value": "156a63d3d3deea694cb5a9c65058efd1a34dcf32", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690630, "uuid": "9000ec8c-e901-4ae0-bde0-2cd92a16b993", "comment": "Malware payload (STRRAT)", "value": "2a766fcb05b17306526d68e01a2db9f87b1c5dd58c75722e3b046384d226e4f0ee9effcf9d37dc9b601e3f066637af7c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690630, "uuid": "f119aba6-7d19-4e63-adbe-2d500e02e0f4", "value": "T12EA422EF3EDB807EE623D57A4652A33A32CC060CC805416F55FF659A0CB09BC47664EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690630, "uuid": "182d325c-e253-40f3-ade4-2c0c72f1924b", "value": "12288:syEcnfUwZ1mHRF0QGz1y8AhXDxCw6huTFkpnWLRR:sefUhRFqzjSTcVwTcnwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690630, "uuid": "47bc01bc-761a-426f-8af0-af3ae02d61cb", "value": 457741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690630, "uuid": "7be6fbfc-0b35-45a4-a2e2-f3c9bf06633f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690630, "uuid": "31ba95b9-60ed-419c-89d3-45a69b5e12a3", "value": "SCURTHVNERI586594.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd0fedc-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692704528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704528, "uuid": "468ec2e5-1f14-4109-989d-f88458278ef8", "comment": "Malware payload (AgentTesla)", "value": "aac2eddf05510e3d8d9950399d7a6240", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704528, "uuid": "7494da26-0193-4344-9b8e-8e3129a5ae54", "comment": "Malware payload (AgentTesla)", "value": "c203ce634a1d32ea10fbc654272e1a1e4aaf253a9fc45cc4204c695bab93364b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704528, "uuid": "2293f4a3-a29a-4854-96d8-502448a38d28", "comment": "Malware payload (AgentTesla)", "value": "5622f050b0c3d4ffe9f0d97d040add905096dbbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704528, "uuid": "2fbc4e9b-6cfb-4084-8e40-bc5b6ca06143", "comment": "Malware payload (AgentTesla)", "value": "44f4a8e33d9cbf917d63c0557417c4dcac22182e8b58361659ecf8812057a14a58df68317d3d838921537f4b019ed8fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704528, "uuid": "0ab76d63-2b9f-4f54-be70-63809c264150", "value": "T18405D042637B190ADA4AF83E944FB29C48E758123B6642FB7CBEE39045D60C197D8D1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704528, "uuid": "83c89c94-5487-4a2e-9ac8-ce3f8674e5c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704528, "uuid": "4163151d-bede-483b-9036-fefb2b88a592", "value": "12288:hfnM0d31mZ+3fWw2svBd6mdyAh3VH5Jx3hozsxlNt8JJEVk0CAccX3eY2aI2OJiR:hfhlmZ+3/6mEArH5HHSQDI2O8p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704528, "uuid": "d4cccbe5-3f3b-4886-8925-0131943dc931", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704528, "uuid": "78c21a73-f3fa-46be-be75-87f9bff9e35e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704528, "uuid": "3518d8c0-33bf-463c-ae0a-c58f6a9d458c", "value": "SecuriteInfo.com.Win32.CrypterX-gen.4659.14211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9d303c-40bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690225, "uuid": "2d26e336-265a-4c4b-9c76-7aaa8d7c373e", "comment": "Malware payload", "value": "7ac6761738d63d4c596a8315982f6299", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690225, "uuid": "436872f9-7f5e-44b7-be9c-1d587109d7a2", "comment": "Malware payload", "value": "c4280cebb2542b61e82d44a1b8dd9ec6ff1063d3a33155641ce05148bb288ec8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690225, "uuid": "42b5ab26-f6fa-4275-af44-b19c61a12600", "comment": "Malware payload", "value": "61558316549ddbe6e0123baa2f9b4c995043f571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690225, "uuid": "8b761f9d-945f-41be-8451-e2d33c0690c9", "comment": "Malware payload", "value": "cded7f4ad63b313cb43a59a368456244bdc8573c1d6be24fe31e7a422034c6783bbad9e1eb4fc3e26061561462085bed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690225, "uuid": "48a871d1-510e-44c6-b961-d7eeef1c9763", "value": "T17F93B448F387CDE4EE6B227414B15D172F22DC1E9955AA9F21CCF6A63D32212406BCB7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690225, "uuid": "048e35f2-9b7a-4708-bc94-070b31f52052", "value": "768:0i7y2h1PBbr18KF70E5KtIqhcBv0UG0DU8woKGuSIB8t+pMs0GwfsrLL0tro:DO236tCcUz9HWrBZNwf8LL0lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690225, "uuid": "a315008e-eaeb-4f0c-86b3-d2c7a00241e3", "value": 91648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690225, "uuid": "46348017-66e2-4ed6-b9f5-d9559f1e73a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690225, "uuid": "da91804e-e8fa-4b2b-a994-0c2b9033a55b", "value": "\u516c\u53f8\u8425\u4e1a\u6267\u7167\u590d\u5370\u4ef6\u53ca\u6cd5\u5b9a\u4ee3\u8868\u4eba\u8eab\u4efd\u590d\u5370\u4ef6pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7474877-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687339, "uuid": "545e49e6-2c16-4226-895b-6628e9204044", "comment": "Malware payload (Mirai)", "value": "06e5b637c383f08f3069592323b836c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687339, "uuid": "c6e05a09-d773-42e3-8cce-9ef80444e5f3", "comment": "Malware payload (Mirai)", "value": "c53c91b98ac9bc9f69dc623b8d751fa66cc7a69afbef014b34accb7ea8c38df5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687339, "uuid": "5250ef74-8515-4148-9716-1f511672fc1c", "comment": "Malware payload (Mirai)", "value": "4b51fdd25252a68f1e0966fb9aa614ebcd4723ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687339, "uuid": "f32eb403-1881-4703-a6d9-b6c4fe653630", "comment": "Malware payload (Mirai)", "value": "5e69134bf306f09df5c65a4b9fbad52726bd573a9f408b13d976466414ea4fd6575b86af40d88885dca0793593322bd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687339, "uuid": "bf1e252a-22e3-4679-9ad9-6d65ef93606b", "value": "T153C2E1981B8959D9C1F9C13C07B81B681D640FAAF809DC8678F8F7629D8E4753413ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687339, "uuid": "f63026b7-fa21-43d1-9d36-9c744174e414", "value": "768:f2G214DFyosXqgvV9o1ndB086NJgGlzDpbuR1J4:f2GdDgosaaO1ndeVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687339, "uuid": "307ecf4f-daa9-4360-901d-99871cf2c9cf", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687339, "uuid": "2c292892-e46b-44a4-a92c-4a437a3824d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687339, "uuid": "27993b1d-29c5-4541-b6c8-839e017f1be7", "value": "06e5b637c383f08f3069592323b836c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5decf25c-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725334, "uuid": "2b08dcec-b6b2-4f9e-bc58-46f0b4e16c28", "comment": "Malware payload", "value": "dcf0b4d4d48dcfa98f63b1314b15c0b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725334, "uuid": "b5727d36-d508-4b7d-9dd1-b41709f993a5", "comment": "Malware payload", "value": "c73cc62cd96a82ab2045fe879560e908540b2330bd4ea1b0560794fff67f4b8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725334, "uuid": "5a09ca9e-126c-470d-bf17-0c14cc2037c1", "comment": "Malware payload", "value": "4e9c1a1491fb9727dd910dadc92cc2ff0debaced", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725334, "uuid": "fea128ad-1a3e-4637-80af-5a0a37e50caf", "comment": "Malware payload", "value": "026ae8827e234324a267a4180273dbdabb02a0cfdbeb9b77c274a40bea0a46b2fff7ddbbe5cbe359a22609838a64dd8c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725334, "uuid": "3edc9c07-3cb2-4152-b764-c7a70eeca7be", "value": "T18933206349983B3AC7CAF47DA81F82FD65EB3591023591AB88A35C4F08CDCF5C552E64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725334, "uuid": "1ef4e48e-3ec5-4326-b667-17b2bee12330", "value": "1536:U8UOfT8GuA69lseV01pHUyAS7UnezVsY0Fy7:bUOfIGuA69lszUyAS7UnezVwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725334, "uuid": "d4e33386-9f5a-4515-a76e-96dfa4ce0df6", "value": 51512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725334, "uuid": "9d34f34d-dd4a-4651-b193-5cfd662c115b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725334, "uuid": "e6c36b03-9e7f-4f19-bfea-e6bc5d174d13", "value": "SecuriteInfo.com.Trojan-Dropper.AndroidOS.Agent.10933.12926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4ae737-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IcedID)", "timestamp": 1692690458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690458, "uuid": "abaaa6ee-dc4f-49c1-890f-06183924e657", "comment": "Malware payload (IcedID)", "value": "2e6531450ab076dd1ef9b9732ef4daeb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690458, "uuid": "16239e93-be3f-485e-aa43-7e350fec4307", "comment": "Malware payload (IcedID)", "value": "c7d4fd24bc684b1d6132f8435cba9c9120df5a08dee714985e94ef4caae17a72", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690458, "uuid": "7f6f33a4-07f5-494f-9234-2f8b84572c9c", "comment": "Malware payload (IcedID)", "value": "cabb1852fbaa6e866eabdfefdf7c3e4419f3b4c4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690458, "uuid": "c7871de5-b19c-4f5a-b679-c0ff81e78222", "comment": "Malware payload (IcedID)", "value": "35fbcf903d88878cadaf3aa9b825dc4c3543f212579710bc8343ece963e4ee537282b3f6d3c189678615d1e88cb191e7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690458, "uuid": "b24d022f-99cc-49c8-9415-095714098ba3", "value": "T11E820818AAADD433C6ED077E98EE03460375E73BA492E34F9CCCE65629533C499C09D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690458, "uuid": "b677e372-f7ae-484f-8b2a-86527c25f073", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690458, "uuid": "d0451396-fb48-40e2-a06d-724c9c0d1743", "value": "384:TExClkRymn8nSDWNihns7fZDrUY5KRf4QpYaAk/Qa8scwvE:UInSDWNChY4VjrnvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690458, "uuid": "50f79770-da8b-41d2-9ded-ad0a9e7716b0", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690458, "uuid": "16fbbc07-1ef0-46a6-b3d1-3c81cf9bdee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690458, "uuid": "08c4039d-83ca-4aec-8bcf-6774ec643133", "value": "dhl-shipment4820911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e04311d-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720663, "uuid": "7ccdcc0e-3ce2-40e4-b814-155e8dc1d8d6", "comment": "Malware payload (Mirai)", "value": "74141ad264ba2a1487bc0d9b303088de", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720663, "uuid": "8a0efe55-46c1-4771-bcc6-2adc84ae8689", "comment": "Malware payload (Mirai)", "value": "c7f6a68ffc040134a094abf30faf948e5f266b4e9afc1e85358befdd4d065123", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720663, "uuid": "8e904da9-d6d3-45fd-a150-759daee4af46", "comment": "Malware payload (Mirai)", "value": "42dcfc76393ec4ff88c1bc2349204b74b693602f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720663, "uuid": "51513c64-ac32-4198-bff5-615b95f3d08e", "comment": "Malware payload (Mirai)", "value": "bf3c3239bf7751a367fc9d8ef7fe53a98fa6be23ab3fa68f1965a39af2c7b4d5773147c509675c307dd474008f38c870", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720663, "uuid": "2fa30843-c9b2-4e9b-ac19-ead42f2e7215", "value": "T1D7041946EA404B13C49627B6FADF421133239B9497EB73069528AFF43F8779A4F23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720663, "uuid": "346cef7e-9f94-4073-be83-9eb112afb17e", "value": "3072:TbGto1Sg3ZkfaXxpF2kTthYzVVB5un/+ixvowM/RCKg5:x1SeSfaXxpFnTLGBIn/TywM/RCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720663, "uuid": "a0380ea7-fbe5-47c0-ae01-f80509704a6f", "value": 174413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720663, "uuid": "cad875d7-1a7b-43ba-9ab0-fb39c78f9ab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720663, "uuid": "eae860d3-4ee3-486c-9011-c427a0f63853", "value": "concakhbtandhuy.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bbb931-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692728940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728940, "uuid": "d03e33da-dc42-4774-8afb-77d491d27a6a", "comment": "Malware payload (AgentTesla)", "value": "8407e16ebcc39487490eeae735dcb23f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728940, "uuid": "8fe5441d-e168-4036-a338-46df3e95bc63", "comment": "Malware payload (AgentTesla)", "value": "c84021331f3a411d4c311e09b6ba72b1d09e5efd771d3d049febcf227b43c652", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728940, "uuid": "fcb19449-c799-4825-a0dd-d0388e4d8a72", "comment": "Malware payload (AgentTesla)", "value": "e2f8bcc2e4639b072084a3866c70329c656ade70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728940, "uuid": "071c34f5-5eb0-40e0-8022-e7a6a474e865", "comment": "Malware payload (AgentTesla)", "value": "e1f32115a23b017e8b0278b1b4cf2896ec5b1aa93c02f3dfafd65cfa581123480d245064b926f6af636ad17e6eb49ccc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728940, "uuid": "4e5cf85c-4655-4437-8a9f-392e49b463d8", "value": "T18F250A1C6D6FCDB5ABE352F9B11A63AA4112744F58CEE0C9633B7B44C4CAE024F52D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728940, "uuid": "d8d2fb0b-e44b-4094-bcbd-7bada10d3000", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728940, "uuid": "c869679d-f4a2-4bb0-9050-5db49c1830c8", "value": "12288:EAPKEaMOuL8reHujNQY4sMc2L8BXaWW5gd76sUm7IaSWr:ywcXq82sG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728940, "uuid": "d606a30c-f6b7-4e40-8fc5-47a753ce85c6", "value": 977920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728940, "uuid": "0c083d22-110c-48d9-a13a-227f72a0c743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728940, "uuid": "437d03ae-96a3-4769-b6f7-4baec736ddb4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.23980.10259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39c64ad-40b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692687333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687333, "uuid": "d82de160-0dbc-4022-ab24-0583206b8bf8", "comment": "Malware payload (Mirai)", "value": "5fdb53baf93b5f2b373a637554390b28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687333, "uuid": "fa4db44c-a4ab-4f1f-a571-b218fae8cc5f", "comment": "Malware payload (Mirai)", "value": "c848e97a6336d4c368f011e86a6aebcef79c4d62b16f8fb6a1e835bc9689a9ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687333, "uuid": "e011dfdb-7f38-4e49-8591-685ead300e3c", "comment": "Malware payload (Mirai)", "value": "0dd8208de644774831ccbee797c13ebd36c21ac1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692687333, "uuid": "35b17449-598a-4574-acfb-fa6d8d8c1245", "comment": "Malware payload (Mirai)", "value": "44f0b243595481552bc1e564b8db1a5e32a59899af887bed4a5e66ddf6b0e94d04fcdb9a082526a1766da3e3454b4d0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687333, "uuid": "141f06ce-fb35-4a13-8393-7b4df14a21fa", "value": "T1F2A2D01921CDEA72D170803BE23CC347AEEB47B652FE713A1E080B9DE49591AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687333, "uuid": "7cdacd18-ab41-4775-8f6a-364646b3f06b", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbJjEhymdGUop5hXq:Ypoh/DxCvhdR4IjWVFbSFjEs3UozJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692687333, "uuid": "80bbd849-6b80-4b39-ac6a-88e7c2c669b3", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692687333, "uuid": "e68619d1-a7c2-42fc-8bff-998dafda3676", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692687333, "uuid": "94bd1e9f-1795-4037-8ebd-562f229aa08f", "value": "5fdb53baf93b5f2b373a637554390b28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd63f13-40bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690219, "uuid": "9ee10b42-a299-417d-a75c-e638827d2abd", "comment": "Malware payload", "value": "5209552db61b19cc3dcffe60168f4359", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690219, "uuid": "c6253778-91ed-434b-8e0d-141a772cc083", "comment": "Malware payload", "value": "c98f9d2a27cf5718577e4b9a2ed0f8bb606b1a5a79bf0f69b454ccd3d8522c15", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690219, "uuid": "875b1628-c629-4eee-aa86-4732f49f5f2c", "comment": "Malware payload", "value": "34a26c921d71002d1e396044a41a490ee3552cb3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690219, "uuid": "95f9a624-fb9a-46d2-ad53-04f7e8aae3de", "comment": "Malware payload", "value": "453622642c25a6a50b463f1a570831fb0314fc1e349f0a77489adb17f7834c483f7cfac8a76cf562a50ba5ffd2b6d2ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690219, "uuid": "aea8ac40-0730-4d17-bd75-14830401def2", "value": "T11444B92060DF648DB1B37FA30BEDA5E98F5BB6F1072BA02E2154430B8B96D94CE55731", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690219, "uuid": "a6ca0e00-8dd6-40af-8064-d8d63fc4c84b", "value": "6144:rpokHuoWbBIfeVhZFVJV25VdVDLBVuVSp6TD30ZN70M:rpokHuoWbBIfeVhZFVJV25VdVDLBVuVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690219, "uuid": "c186998f-c5e1-4eb0-9513-d4f2f3d72832", "value": 276248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690219, "uuid": "df829b9b-a744-4b80-8f24-453043fbee37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690219, "uuid": "740639ed-c872-4abd-b93e-c1e373d25725", "value": "new order.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520a50c6-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690524, "uuid": "12b7d3ca-558f-4539-9db6-771d486a072a", "comment": "Malware payload", "value": "38a1ff8689fc29e42ab21e7dcede8d59", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690524, "uuid": "ed3bcdde-e1aa-46b9-951e-2c343996021d", "comment": "Malware payload", "value": "c9bf8db0c06b85adbddae3e91d0942cb51418f2ef31ad0fa115360c6a194ce2b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690524, "uuid": "6b782ec2-2b50-4783-a9b0-7cb1cf3a9adc", "comment": "Malware payload", "value": "2497699018eb4b57c10bd34b22224dae613e0741", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690524, "uuid": "7b06295a-2f73-46a8-8aea-c25372cbd378", "comment": "Malware payload", "value": "c19f7957e36a76186675150c70e065d1ce4ac198fcbe4c942a41a1e2b7ec917153e0bc0d909e344e45e3d29bb0ac70db", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690524, "uuid": "75840357-1df5-4e1f-b127-fd2b6bf6b381", "value": "T1EAE42358E7440CBDB710466DE20D25E8AA1BB4729AA43F795FFF37ECBD469444082633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690524, "uuid": "8fe2804e-738f-4ea2-86bd-166317203fa3", "value": "12288:zk4MhqMdTuvN1Lq+XKcUDEQO9aWNM3CkdPLzBB8M8JFzDW0/WUVmlwriiK2Kdwlo:2oMoNw7jEQ+a+UJlqM27WuKdwNO7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690524, "uuid": "db533818-33b4-4133-9ea5-896a75a8ffa1", "value": 674271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690524, "uuid": "cd29a306-0098-44ae-b55e-57192806a882", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690524, "uuid": "b6d416e4-3d87-4a1b-b061-211d67b3cafa", "value": "pee.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fea5859-40fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692716318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716318, "uuid": "4b023a4c-0352-4b06-9a10-d33147840b9e", "comment": "Malware payload (AgentTesla)", "value": "ef908571961355adb61030cd32e23f81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716318, "uuid": "3348f5cf-dde1-4536-84e8-0389fa9524d7", "comment": "Malware payload (AgentTesla)", "value": "cac86a33653ddbd3fd4b90781b35d90ca94959583276a8bc0ded89d29b16093b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716318, "uuid": "c8bf29e3-ce21-43f1-8e5e-8a1f93d94fcf", "comment": "Malware payload (AgentTesla)", "value": "4d3d831791a874a3eeb3560ad9fd8434f683f7be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692716318, "uuid": "db5c928d-7e72-4c1d-99d6-1f4adf90c9b5", "comment": "Malware payload (AgentTesla)", "value": "b9cf761c6e5224ac1a02e5bce5814d47c24c896df6f2fcbb7bdafeacc2d02c3f6d58c7d31b9b22e8295c5fab1cd0580e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716318, "uuid": "553725c3-7320-445c-a63c-0ee1d2827fed", "value": "T189F48CC1E1BAD7D3E5BA47F5206106000FB67ED6B539D2544EA630EA35F5B402A83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716318, "uuid": "37e822f3-0d62-49a8-9da4-3fd96cf9bd78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716318, "uuid": "563f2404-27b5-489c-98d0-4d2c622d326a", "value": "24576:HTPdBWU1hriES6dKACzdNH7H4OGf6mhl:zPdJy6KfH7HnGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692716318, "uuid": "8cafc49f-8a6b-494f-b416-66202b869528", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692716318, "uuid": "67e7b506-658d-4894-92c0-489dd91faa67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692716318, "uuid": "a0625d0a-3f64-4673-a172-4b95386d8381", "value": "rOrderConfirmation_AW06846590.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "336c9db5-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690473, "uuid": "cd89d7a8-51aa-4f6c-a26d-829f52ae62fd", "comment": "Malware payload", "value": "a2244bbfd3d718b4d2dd7537203e88c0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690473, "uuid": "4efb3268-cac3-47b4-bc4d-e822e4cb995c", "comment": "Malware payload", "value": "cb00d6672bed5c53868803547f003c96e277609c441e7b4c3683a50700263f48", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690473, "uuid": "487d5592-be48-4198-9e95-75c08237ab2b", "comment": "Malware payload", "value": "c6cfe0e1d9b3af8dfec5893bf315849aaad9d9ca", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690473, "uuid": "cfe4c25f-a5cc-49d0-bd83-d420194a9cc0", "comment": "Malware payload", "value": "089a7f089355cc104f2dd4ef70a6f055855858a4e014c3e0546bddbb8048a2486ea7adf16583d27f8413a898e321313c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690473, "uuid": "5e7d80ba-2949-4ad4-8732-70d007562fde", "value": "T14DF4234863A19AE55CDEDEF228DC3F3063C0360235710A2255B997384E51EDEEAD39F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690473, "uuid": "70fcc42e-af30-4c78-bbee-6b6bbee8e4ba", "value": "12288:qZ7Uzq/Hplny0begGwFTI4S4uOCtklXK7XiYB5FwjKFKurDO2cvkeK60:hID3eTtzpme1B5FwBKcjK60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690473, "uuid": "7df8f79d-1a27-47b7-bd2a-07b6158ca459", "value": 728162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690473, "uuid": "ae039064-779e-4a2c-8071-ae0fbef74d56", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690473, "uuid": "de605291-a440-4573-b103-43c9c3ebe56c", "value": "cotizaci\u00f3n#especificaciones.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821b5d58-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693182, "uuid": "1d65fddb-1aa4-4387-acce-598402d109ef", "comment": "Malware payload", "value": "86da838fd11005370191f3d996ae6c44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693182, "uuid": "d4ef9bfa-721a-42b7-954b-14722d37bac5", "comment": "Malware payload", "value": "cb8dfb9d68822dbaab55ad9edab04617d8e70c1799183a64d44d4bd4d11c7711", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693182, "uuid": "147155fe-e5c8-4004-99cd-bf5c6358da73", "comment": "Malware payload", "value": "3d17c794f23032ff8d369294f031ad35e52af489", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693182, "uuid": "c2700815-5c38-49e7-ba08-fd36d6fcc5f6", "comment": "Malware payload", "value": "6e74d92057897b691e1b2a84ccdcd8a48a2c1c933d78ba7f7edd10c9819d8a8edaee4ffa83dc812e4fa41964fba9b8fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693182, "uuid": "5b7e864a-d092-4d5b-a0df-22dc51ab4097", "value": "T1AD311190A2D09EB9CEE4A1BFAE56031073759F84F0CB726392187719BD2EE7C5D27046", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693182, "uuid": "9fadfe08-b4b6-4f8e-a62d-19c4a716f6b4", "value": "24:vKGpa7Urz/jlfuBOXK1hnVev3gRGaJ9iMrBBuQ7dzhnlxrR+zLLh4:vKGpa7UrLZqG+J1BuQ7dzhnlxrsLLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693182, "uuid": "8cadf727-0ffa-40f1-b66c-2273a5eddb00", "value": 1452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693182, "uuid": "87a422ab-3316-47e1-aa13-3a117c5c7b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693182, "uuid": "1c998de2-aecd-4570-8138-c43d5814298b", "value": "86da838fd11005370191f3d996ae6c44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d93ca77-40d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692701308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692701308, "uuid": "4e5108ce-ca87-47bd-a7d4-c7b687a0d19a", "comment": "Malware payload", "value": "2bd7fc8fcc05ba76ca239826773f605e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692701308, "uuid": "0921ebf1-f902-4168-8cce-b0e47e78f799", "comment": "Malware payload", "value": "cc03bb8acee9ceab53801ac0f0681b25839d5fbe5376a74674fa4635c27976dc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692701308, "uuid": "f3ab22db-596e-4cd2-a891-5c7069c3a319", "comment": "Malware payload", "value": "81b99e0094edde5de6cec7d9f5cd391d9eca3eb2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692701308, "uuid": "6d3ae991-0313-4f68-863e-45717cb19132", "comment": "Malware payload", "value": "bd0a7a551b145b1e3c4bfc017113baac46486147fcac096359983fad804e95b87354f589c9d56d866d8d5f6a246bb1da", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692701308, "uuid": "182590b2-7433-4c0a-91be-33395a76913a", "value": "T11BD2F1CC5C9CA8C5CE7185F214B9CE4054192E3FF86849F6B92C888B41E6E6DFE712A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692701308, "uuid": "8611ec14-754c-4671-b820-2d5658d1949c", "value": "768:PHMaxeu6cHXHlwETUK5UQA4a+gEAKgKpY60gbA8bj:Uaxeur3HlwETUO93gOgKuAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692701308, "uuid": "44107d3f-74c7-42f5-8124-c69abd7d33df", "value": 30263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692701308, "uuid": "344fe789-ac57-4e3d-9b82-c88e9bba8507", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692701308, "uuid": "c6d49a50-41ae-49a0-b3fe-7e43eff1afc4", "value": "c31-Malicious-Portable.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a06421-40ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692710950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710950, "uuid": "0892d0e4-a5b5-48e1-b661-6e191c474609", "comment": "Malware payload", "value": "0b02d0636fb01eb2799cc38183456b20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710950, "uuid": "43207e7c-cd28-4845-98e5-b69377577c51", "comment": "Malware payload", "value": "cc43af6a81e5af67bf067b46f9be36c7e2a43fd80e5c70dd86100e46824e166b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710950, "uuid": "836cdd05-7a96-452e-a628-99c264fa73bf", "comment": "Malware payload", "value": "e32c62afd49b180e7e5afe08b09a23a49dbcc4eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692710950, "uuid": "d4ac016b-660f-4a21-a775-db6e4b8bcfbc", "comment": "Malware payload", "value": "ce40c4ee80d521d7b031c44e2ef0373e0909c9bbefcee4dcf03041b2f60101ccbb0575cba5bb736b858fb920f11530b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710950, "uuid": "3c7605a4-9d0f-4647-a9f0-09f572e2f6de", "value": "T16B02C0A13B1123C1F522EFB57FD8342BD42D973570CC1B217629828BC06A72D04BE22E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710950, "uuid": "9f6430c6-9380-48f1-9103-1e7188173a75", "value": "192:KXs4Lyi82so2yzXtb1MQFGKVeKJRT6XXmBrdIQ0:yb2eX3zAKuiN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692710950, "uuid": "cebd27ae-c18c-468a-b214-00cc8e62486c", "value": 8592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692710950, "uuid": "87eb2107-362f-4dca-b693-832682865a6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692710950, "uuid": "a6dca85f-9e13-41d6-ab14-d2475a16b357", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.679.27396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c07a19c0-40e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692706172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "34fb4a4c-1ae8-4349-87e8-5d5c61f1fbd0", "comment": "Malware payload", "value": "5b281b137e42662ef7f760a5c08b7e4e", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "3c293708-fbbd-4936-bf97-e8a9c6140b63", "comment": "Malware payload", "value": "ccb8a54d9891b5680d45758ae0ed0ead5bc36974f45eaa69ee8f31770310e1d4", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "2d1b0a3b-450e-4711-9a44-36a6f18e950b", "comment": "Malware payload", "value": "173fc662d772c981410e411f013e5a9c62ac32ae", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692706172, "uuid": "3172748c-a193-4a33-9ab2-7b4303070f70", "comment": "Malware payload", "value": "b419a250e73310fe55f079c5cfe950786cc64b7025993103483e1a8bb73c0afba36db41b9e9799a287e5e955d9d8e21c", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "2bcaf423-c38a-4880-9d0f-24a095969220", "value": "T1A805D08B51F35FF4BD069C1AFB989A717B035B8052397ED1AC438D596AE0DCC231CA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "416670fd-766d-4ad9-8456-7978d9cbff46", "value": "24576:qdH8G9fO11aYOPJ10XuH7ryFvd7z3+2Ynj30Y:qcG8118xSe36F7z6jX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692706172, "uuid": "29dc0ec8-c57b-4019-a992-d4e72664bb78", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692706172, "uuid": "6b914cf8-40d2-4b71-81eb-834f07cb9e42", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692706172, "uuid": "d23dab54-7705-4ab3-ab3d-2605545c5e10", "value": "ak93d3.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c1b456-40a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1692678308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692678308, "uuid": "1bc9a8e4-0f04-4901-aa90-a28ea31b2445", "comment": "Malware payload (TeamBot)", "value": "e53c1d2700dbd6fb782ddc8c651ffe6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692678308, "uuid": "5f8a80ab-8884-40a2-b082-1f0dcc714eb4", "comment": "Malware payload (TeamBot)", "value": "ce018d3dd40f35b0fbab944ee7c7f0b6fd7c313dbd9d6a7841ce95751c83e61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692678308, "uuid": "480ef911-db30-4867-a8c4-6b3af233062d", "comment": "Malware payload (TeamBot)", "value": "477d72390f618af08d04d9cc17cf7ac9f86a0542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692678308, "uuid": "28c60d6b-8e47-4690-80b2-c8f9fa97f5fa", "comment": "Malware payload (TeamBot)", "value": "29c8fc9489f0e94b93807023e703ed7a99b1c76b9cecef1883c211f25f3fe6ff16b3bda248d0c3a4026b033a753d7b59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692678308, "uuid": "6c180340-08bc-4c69-b391-406c542aa479", "value": "T13234BF1362A8E8F2D4574535DD2EC6A47BEEB8318F55969733080B6F0970EB2C26F352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692678308, "uuid": "78af2ba7-81c1-473a-ad0d-3e41a1225245", "value": "83f305571af3bad4fd0b459ab4b0a012", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692678308, "uuid": "bc0f4c3b-57f4-4b29-8f78-7eed198ec684", "value": "3072:bmqZVLHWrP37DVIIU49+PL3+I/5Dct+NHx3FDmZ45X9B9:5ZVLGP37y090KAAuHx3Jj9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692678308, "uuid": "57485892-ddf4-4291-a77c-fd09f341bc04", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692678308, "uuid": "4fc03eb9-3fcb-4713-b5ec-0d63b5addafb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692678308, "uuid": "ebaa9b74-e89d-4414-826c-0258a65b1742", "value": "e53c1d2700dbd6fb782ddc8c651ffe6f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4182c56a-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692689638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689638, "uuid": "c7e0b43e-b290-45fa-87b2-5b5098b67841", "comment": "Malware payload (RemcosRAT)", "value": "f61894b8b34234ba7b12215bc3328ca0", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689638, "uuid": "93c6a747-d93a-46eb-97ee-b3a9f169350c", "comment": "Malware payload (RemcosRAT)", "value": "ce7d8dc35f50388ccfdbfed28b7547148e1fdd9e9fcae25782ff74df865e9ede", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689638, "uuid": "c762b012-3b70-4e3e-8bcb-53e2fad3ea9a", "comment": "Malware payload (RemcosRAT)", "value": "c127eac31ea240f3c38370c8b5a3697c9d628b71", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689638, "uuid": "b07f8299-b054-422f-8eb8-e8501570b25a", "comment": "Malware payload (RemcosRAT)", "value": "d6c82fa65828d07758061d8f6d001ce8432965b1dc559eb0833078beda66138b620a2a7391d9712447d42cdf60a9e802", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689638, "uuid": "83cc5590-4f2c-4b35-a2e8-ab569ed6eedf", "value": "T17E55E025A2A444B6D25A7D7D8C07F3F8951D7C223975ACC26ED53A8DCF363B2A8180D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689638, "uuid": "0d7a4655-d8fe-4dd7-a5c9-8d5d387b6062", "value": "6d93e702d29a5a3decf1d11adcff6a32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689638, "uuid": "808b7ba4-8e04-4aac-963a-fed416f34f03", "value": "24576:s+RGJCckr7y+lf4MkEYHHMsxIdgi0CDxMKNK7:s+XHQLMUSgifVMKNK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689638, "uuid": "f22dd69b-67e1-487c-8894-f8237dacc746", "value": 1366016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689638, "uuid": "67e648ad-8aa1-4781-b94a-47795458783c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689638, "uuid": "9af51099-e0c6-45cb-b54b-f9c534343d1a", "value": "YENI SIPARI\u015e - CF0002.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee58e5ca-4129-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692735884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735884, "uuid": "26af29e2-a51e-493e-ba09-cf9f6ed1cea7", "comment": "Malware payload (AgentTesla)", "value": "7ef643b4f1ebb64afca96ba34cd74500", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735884, "uuid": "4f6c3f87-e4b8-4cc0-b46c-a2ed03c186ba", "comment": "Malware payload (AgentTesla)", "value": "d22c1eb74be09a0ea7e8794e33235a6ddfb2d04433438b2d9d94b2a7c32647e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735884, "uuid": "6cafa331-0b74-4f7b-b971-9b7ac2f1ad8d", "comment": "Malware payload (AgentTesla)", "value": "df103e3aef3a4a46755027d1589e49718aef255f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735884, "uuid": "9e86f536-c515-4da4-b1e5-abb371915698", "comment": "Malware payload (AgentTesla)", "value": "2518626d1eda27f55b7a9f95bd9025923908e8c94941c2b674dd9815d49f031aab7744736394f825b93160a6f0b8c940", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735884, "uuid": "69d71335-7c4c-4409-acf9-904ec080109d", "value": "T17E0533F09BDD48AD1DE978F66B0146899CCD88FE0EFC0070CE35A517E6116E6627069F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735884, "uuid": "91ee130f-2a5c-480e-9be3-b3f9f52310a5", "value": "24576:Z0X/uXHL02CQchHBfnNaUWwMNJoLwOyDHiD:Z0X/q0WcJBV7WX2QDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692735884, "uuid": "7f04be4b-6e4b-424e-9e82-1a8fc7f097d9", "value": 871129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692735884, "uuid": "273b10b0-741a-4970-9a53-a2a3ea29dec1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735884, "uuid": "fcc66014-c317-4e88-9d1c-37a753706a6f", "value": "TEKL\u0130F TALEP T\u00dcB\u0130TAK SAGE_PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e46660a-40bf-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690223, "uuid": "696f81eb-08d3-48b5-a400-b0be8449f372", "comment": "Malware payload", "value": "9775b12be2c5f6a1152f2450c8d888d5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690223, "uuid": "232e4a01-8403-477d-b66b-7ec9af23f9a6", "comment": "Malware payload", "value": "d2f74dbb944eb5699de861b7044b5aa9c9f3904d166bdab705a4024b0bc34eaf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690223, "uuid": "d657a5d6-82bc-4041-b72b-0e9eb092b51f", "comment": "Malware payload", "value": "6a6d01a0523059e270adae4f6511e0490f84b16b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690223, "uuid": "4b456a8f-73da-4b78-8da3-85e9981c2f5d", "comment": "Malware payload", "value": "e7962d7767392036d07a00bce9851fa5c1f30b29a5a6cb4b4fa520e0133a49abbc877c4591f0d31012b58d2dab0c9a1e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690223, "uuid": "f3fbd606-fcd8-493c-93c3-a499ddff1f87", "value": "T14464BB1051EF628CF1B37F5307ED68F88F6BB6A15A3A925D215C030A8B97D40CE56B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690223, "uuid": "539d656a-1000-4950-a4dd-803468dfe538", "value": "6144:zJnbA84EAnAlAjAsaZABSiWIr/0VwyC4gC4g94gMEqCBLrDI4b4t7isnlbUHAvza:zJnbA84EAnAlAjAsaZABSiWIL0VdmfwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690223, "uuid": "241e45df-1fda-47b6-8c14-7f332d69b568", "value": 325564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690223, "uuid": "8ee5b040-0b15-4234-bba5-2591454d6806", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690223, "uuid": "324fdaa6-b1ce-42d8-875d-b62746c7ffe9", "value": "S_D_09887766766676.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ac5268-4129-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692735819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735819, "uuid": "273864e1-6175-4e58-9126-8fe22e95f20f", "comment": "Malware payload (AgentTesla)", "value": "c6e4642f4e63f5e4cc9d3c41f1d8c687", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735819, "uuid": "13264f39-59bd-4b21-8a0b-9dae4e27d3e5", "comment": "Malware payload (AgentTesla)", "value": "d334d4da6b6cefcb77cf8a5a9ed97e5e1698aa8ddf60c15148bb949a9657a134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735819, "uuid": "dd43f178-2560-40e3-a544-ba1e1f703bc6", "comment": "Malware payload (AgentTesla)", "value": "d380a16767202cdf92551a9faf7f712d63efed02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692735819, "uuid": "46714ff6-6ca5-4c38-8495-74f3145ef152", "comment": "Malware payload (AgentTesla)", "value": "5fc134bf1ed6f07211dd2bc76a51a5041aa20ce9947e683f4401787cd34e3714909f26776043dffcdebd270a6faa903e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735819, "uuid": "b9da13e8-063c-40ec-b803-5309c9d6cc9f", "value": "T1B5B42363B70A742E2BD0D6EC190429606799536F500C3CA4D7292BD91F826DFF8EFD86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735819, "uuid": "308309a8-b95a-4e22-939b-45e4bcb9108f", "value": "12288:LMPpRYugs0YdrVyaPy2uXEHZXsyq+SlqZHZgZkM8:GpyYdrVyGQE58yqDuHdM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692735819, "uuid": "a10dda24-5508-47ef-abf6-9e05c9f24e05", "value": 512254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692735819, "uuid": "52355d8a-be1b-4c7b-a645-3c180a1e8976", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692735819, "uuid": "175667ee-0b9e-420f-9c2f-8f51b5f05dd0", "value": "Inquiry INQ0981.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37454c1-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727222, "uuid": "3a72fd14-52ed-4287-a88d-9fa519dc50f8", "comment": "Malware payload (Mirai)", "value": "0bd16a1e68f6dedea85840581300e114", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727222, "uuid": "f508b6bc-bb11-426d-96d6-839d6800c028", "comment": "Malware payload (Mirai)", "value": "d4edc5c5108b152c4ab3ae7b962be329c6c56d452153b0dab798466fad8f3c3e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727222, "uuid": "52df3b99-d0b5-4e7b-b63d-cb5df3053520", "comment": "Malware payload (Mirai)", "value": "89fe16d8ea33e82500b1f1b2a2045d3e4c95d4a9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727222, "uuid": "98316b7a-eb9e-43ad-9899-13a392302c2b", "comment": "Malware payload (Mirai)", "value": "989748fd502f2c1f3f5968ad4d1528d5d12fa2ab5feaf2a24cb9aa23dfa1bf20d24b72df25d6d19fb65374bff5520efb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727222, "uuid": "54b648be-b2cf-496e-8e46-a982d30624e9", "value": "T1ACD2D1A585E7F6BCD1AAA6B5003D07C4FDB67216C12617B70CE8707AEE471D84E30DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727222, "uuid": "fa6c32a7-c3e1-47ec-8be1-eddc2258982f", "value": "768:kYSoXdJZETc51aBfdNRQkHy3xWEMcw6qBZHSx0sw:kYJdJZiy1aBnQfTqBZytw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727222, "uuid": "43a5c4d9-4bd9-4ca8-99ca-ebc7a5e4a914", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727222, "uuid": "0b200284-1f47-46b4-9311-146dae84d863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727222, "uuid": "a6298f6c-8346-4754-b507-824ad50c742e", "value": "0bd16a1e68f6dedea85840581300e114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112ee537-40df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1692703730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703730, "uuid": "6d444ea5-0e1e-460f-b2d9-a121f0740acf", "comment": "Malware payload (Tofsee)", "value": "8179676a92f5c3f13b91b1268117c2b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703730, "uuid": "bd2611a8-98a6-4e0b-bd89-c87360508396", "comment": "Malware payload (Tofsee)", "value": "d5066909246cd7398f87888e9ec36816f4ceeea058156a279f02e9d3cd7bc860", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703730, "uuid": "208be2a7-6000-4b72-8250-e866aa8559a1", "comment": "Malware payload (Tofsee)", "value": "f2d27a9eff8bbc62dcf82ae28070df0c7fe3ed98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692703730, "uuid": "05fb98d0-1ade-440c-ab6b-4ced2892d98c", "comment": "Malware payload (Tofsee)", "value": "2f2ad6d2611e193cf41cc7e99c4d84d7f57740d25a2dfc11296fd332f7da17bc4562435809a8d674c7abecdd5801ba32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703730, "uuid": "922b0af8-8e41-467f-b134-46bdfe0b1764", "value": "T1FF34DF313A92D072C19B50355820DB707BBFB8316779899F37680B7D9EB02E29736399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703730, "uuid": "20888dda-b328-45f6-906b-c1f6066aaeec", "value": "d7b081df5aeced7021cc9bd078a5fcbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703730, "uuid": "2da21508-8b36-40ec-9f95-3be693c92858", "value": "3072:89Xk9Kx5bLrVbjMQC005DS9Y6fSe95mvMu6SjPQmpVK2fgJRWfSoOZ5eU:8iKbbLZBC0YD+YmSeT+Mu6HSVqeU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692703730, "uuid": "6de791e7-edbb-4bd0-baf3-4f291d738b47", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692703730, "uuid": "3bcfd28e-30bd-4965-aafc-e78aeed8df5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692703730, "uuid": "fa466cea-40ef-4feb-9b3b-eba6ac6c899b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394b59aa-40e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692705945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705945, "uuid": "8daec632-d148-47f6-9f16-edb524e4269d", "comment": "Malware payload", "value": "d75396f6e913b2f5bbb8e4aaeb1a4bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705945, "uuid": "2be5fc60-ce5a-4a79-b46f-bd3dd2c09982", "comment": "Malware payload", "value": "d57bd4eed2bef3986285e4063a369166c11750099cefc31f3a92eb69090d4c92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705945, "uuid": "a3db1326-b54a-4e66-8586-20aa206060d8", "comment": "Malware payload", "value": "4af154992e763254eb26be55f811269ee952129d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705945, "uuid": "3430afcf-f1d2-4eda-83de-0131092bb043", "comment": "Malware payload", "value": "4ba967971038c881611efa7b65cf85f0779d551c8ce540ce891ca8f49b5bbac0ff1e58c55865c9359aaea9fdf7109c5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705945, "uuid": "58f7e099-c049-4ac1-b250-75a2c817183f", "value": "T15D15D63CF616DB2BD0CC8CF988A5192F79F99CADD4F1B3A5C133C2A85BF981045A6452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705945, "uuid": "50a8f40b-f113-42a0-82f5-c6e771a76cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705945, "uuid": "d5fc7ea7-14c1-4fda-9fc3-c984e4017d23", "value": "12288:f+70pKXQl2FNGptSWrCP2GR7qvf7KT3OQ4CR9yV20BTJp/R:A6CcvTKT3rG20BJpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692705945, "uuid": "8895c62c-15a2-4fe9-9ddb-e61d31d3025d", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692705945, "uuid": "f0f205bb-4413-479f-89ba-d36032ff2e3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705945, "uuid": "9548e279-f532-4caa-be37-bbb6fd9d40fe", "value": "munachi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "702877b2-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690575, "uuid": "9f332ba9-f28d-4dd7-9d0d-60dd4bcaa6e7", "comment": "Malware payload", "value": "f7d5a6f405071c32a2e28035e8428188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690575, "uuid": "f46a9495-69ca-4e58-b1a8-14f4b42e1aef", "comment": "Malware payload", "value": "d61eaa663f5ec7583f4957965374b1a3c374227fd46897cd2fd276e4ed16602b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690575, "uuid": "f215a01a-3d32-4aed-a305-076e2203b15e", "comment": "Malware payload", "value": "4c374bdbd16bf3ca33a90e9dffd8a5586f1283a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690575, "uuid": "53197257-9e5c-403a-847e-1c7064cf4f39", "comment": "Malware payload", "value": "c6d479e559b3aad033c0f58a9065fb2d93ce505177014d5cdab46eae5c95532aa319fde2bed9d2c0dcbb427ac5df32c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690575, "uuid": "bed99f20-4a36-4d57-b306-bd7b7604d1bd", "value": "T1A5F4125062AE1F17C17F87F682B6610197FA15426933F3AD8EC924EE3267B418F1A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690575, "uuid": "44cd5726-893d-4f54-aa51-878de550fdad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690575, "uuid": "194c89d5-ae0b-4914-89d8-e3373bc90605", "value": "12288:8rn5h+xGb/84PcQQXXokhE3reu3bEtheVNa4Y3CVaF:Ch18mcnHokhgr93bK4Y3JF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690575, "uuid": "f53e7da5-9398-4cba-8c79-ad5186dc3fbb", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690575, "uuid": "d3f1f3e5-b482-4e4f-9a1c-c5029e35bc34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690575, "uuid": "45ad7b66-6475-4507-ad77-980ac6ee0e30", "value": "FedEx_AWB#50223274643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4335087b-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690500, "uuid": "250253a4-547b-40d9-8dd3-2ce7260bca60", "comment": "Malware payload", "value": "e9a978aa33faa8cc8643eaac79c681a8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690500, "uuid": "81a725df-d4ad-49b7-81a1-0eaca02d2e5d", "comment": "Malware payload", "value": "d69b3e8d8c2531cb28becb386beab2e5bfaf91d75e2ea86ace6b6a0d9759d10d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690500, "uuid": "36f28c2f-176b-4ae4-ad6e-1a0cbc39a17c", "comment": "Malware payload", "value": "4f94439c07987b5efcb724f26b645673e20531f1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690500, "uuid": "f7116a01-f348-4d41-adb0-ff6278952233", "comment": "Malware payload", "value": "0639ff28e115f6ab5db9fd88277412d7ac5c329ff4de9de36dd74757c34e41526353b5070098b12855026e932d033047", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690500, "uuid": "3c41fbe0-b07a-4643-8b28-47f6814f4077", "value": "T1C5D4238B2C46B28BE1D39F55E7F7BFF375CC69862C507490A1B0E29C274A9D827B4045", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690500, "uuid": "d11778ac-86a4-4776-91aa-5a32e06534c1", "value": "12288:vMPbrlS/a8Ab5zRfRyEfqnkKd4b661LId0L5GHJ8kIxwCD:Or6a8Ab5zRc0qkKaM0LsSHtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690500, "uuid": "7798d496-ee6a-43c6-9c74-58abd2284e1c", "value": 620051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690500, "uuid": "1e75e820-4b62-4827-9744-10eb70227e85", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690500, "uuid": "09b0d120-ef99-4638-a703-111dbe729f00", "value": "Orden de Compra 20181##.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d942181-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692693148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693148, "uuid": "7dbdc779-31d5-4467-8dc9-c657b4052130", "comment": "Malware payload (Mirai)", "value": "124cc5ef8e023494efb2adea5b74b7ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693148, "uuid": "d3d75f69-6ea5-4a0f-8932-d38188209531", "comment": "Malware payload (Mirai)", "value": "d875f2527b1420bd29e17d768f124331c7920b2b1d7db0925f0a9448e02267e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693148, "uuid": "37a1c1cc-ec5d-49ea-bda1-990df80a713d", "comment": "Malware payload (Mirai)", "value": "3d4565f771e41c087bc998ff621f9005358d0fe5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693148, "uuid": "10851e03-711c-4e48-9383-57529b29ea35", "comment": "Malware payload (Mirai)", "value": "9aa2b61f3e95ff20657f9da258ccb1b95bf91fbbd9d88c30eb92648ecfbdc08eac076b5733d56107fba47ac8593e0ce6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693148, "uuid": "7950dafb-3701-46c1-bdb4-40e9e7d55f3d", "value": "T1DB21026AA1D9EC73DA7201B651C5AE4A2721CDE525A7FF0B8D510402EC292D0D132374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693148, "uuid": "77d7e555-205d-46a7-966a-d539acbc6e34", "value": "24:FltC8MsWOJFHxgxCl6ZSiSZSLRsXWifGHwBrGuWpQruQ6Abe/MNfTanw:ftDoOL5sSi0SLRkWiswBrSpcHHdNGnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693148, "uuid": "eee12faf-91ee-4a06-a005-7ce61c3ac388", "value": 1176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693148, "uuid": "001c048e-635d-4bc0-9128-08bcd66a12dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693148, "uuid": "c9e2d4f1-75b0-4f37-96b8-a26473ba3b50", "value": "124cc5ef8e023494efb2adea5b74b7ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3f0b0b-40e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692704371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704371, "uuid": "0a5e0e71-b2df-4623-9ba1-0d0b3fa6a08a", "comment": "Malware payload (Formbook)", "value": "ac43233dd5fe6d55c112660dc700e564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704371, "uuid": "570350d7-cc69-4ef9-9d2e-531735348c62", "comment": "Malware payload (Formbook)", "value": "d93182b7b2c8633aa7f379efdc80aa778ecc0b59a01929bb10a02cd8349354d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704371, "uuid": "13b135a9-b568-4658-9a5e-ab363922d97b", "comment": "Malware payload (Formbook)", "value": "2f431f411c707593f2f4bd67da5db2e9a9593778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704371, "uuid": "5512e68f-6de2-4061-a245-840b119ca402", "comment": "Malware payload (Formbook)", "value": "de59501c02ac1a12f9bb7cd20c24b7167645329453d3271f41e2ad8dd88e5d6603bf1a23e641013fbcf82238a818724a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704371, "uuid": "dba6ea16-e5f2-4945-ab24-71aed1d9bc5a", "value": "T12644121458B0D85FE9F347722E35899D1AE6FA315DE8DA6FD3800E647C36200E92B3E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704371, "uuid": "12242c4a-46b9-4b5a-8fe4-6f946cdc2c15", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704371, "uuid": "cf372f01-5750-47a8-865e-7d8f42ac780e", "value": "6144:/Ya6lEiLxFG1cz5mqDoGPuduieEJE827qVkF28m4znusYtq4yC:/Y3EUxFzz57Dooudu9A5ko4zusYtFyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704371, "uuid": "50590169-19ba-48d4-8198-422bb7f2fa84", "value": 260228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704371, "uuid": "1a5e6dc1-e163-4060-92cb-9639355c32c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704371, "uuid": "12f1bc99-adbd-40a0-985a-0b3d0c764167", "value": "PO-230821 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91af28a2-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693208, "uuid": "2a0a8e7a-3148-48d3-8427-076d9cab6066", "comment": "Malware payload", "value": "d6e4169a85c84ea99f50f03a00bbee41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693208, "uuid": "b0e06abf-ec9f-420c-818e-f2933bdf5578", "comment": "Malware payload", "value": "d93d590bd779f2dd66bb198fe941bad9ec19376fcfa8be24124d7ceaf4e9dc1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693208, "uuid": "df98616a-66d9-4db3-b1fd-63cd47ece678", "comment": "Malware payload", "value": "8d16aaf95cc50ad4dd9dab59743357d80915e29b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693208, "uuid": "588f74c0-7546-47d9-a457-fe161f4fb099", "comment": "Malware payload", "value": "c4ba57a3fdcc4e60da778c61be83a67b66e5bb7fac4101aea1a80dc79396a63dfab43c8f946f655bb767fd1454b6afd9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693208, "uuid": "9e2b8270-302b-4c4e-9353-3fefc06a35a3", "value": "T1D941028E1F714EF5F55AE53847330B3937AA914803C18289E19CD6005EC430D89DF6D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693208, "uuid": "6fcae24b-2919-454f-ad65-760792e4732d", "value": "48:Oip5E4GYg2H7u1END/9LuEpUn3g7d0hxSBl:7p56WHKIMEpg3IWcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693208, "uuid": "85520727-4215-4937-b3f5-e81bb9d713dd", "value": 2000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693208, "uuid": "cdb025b6-3834-4d1b-b23d-90118eb56023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693208, "uuid": "4323bf63-f296-4d81-a8ef-03e9b8979b7b", "value": "d6e4169a85c84ea99f50f03a00bbee41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e2fab2-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692693140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693140, "uuid": "41bfd48d-4876-4b52-ac15-42aa5d0429a6", "comment": "Malware payload (Mirai)", "value": "8f80be01aa3efc7d8da004c3b951b7ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693140, "uuid": "d63e7848-6c4e-4229-99e1-2b41fed7673f", "comment": "Malware payload (Mirai)", "value": "dab4c96f9b37dd2709abaa6c4905a910ccd4bc2e03cc7d005b0ec58aea999ab5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693140, "uuid": "bfb4b244-7326-4827-a42c-9f2b1168edc9", "comment": "Malware payload (Mirai)", "value": "5f3b8bb3ceed9127e556b7cebe63451078dfae88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693140, "uuid": "37a8fc0e-c32b-4d59-868d-abf1d5378ec2", "comment": "Malware payload (Mirai)", "value": "4f803a8e2cade4c43243e4e8541897420be350c1d71b317c2be89812cdef50fabb57127466a5b98d8bf0c3b64109f942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693140, "uuid": "181c0ba2-f46e-41dd-8638-f66807bfd457", "value": "T1F3639548F9645729C3E172FFFA0812CF332B1BD8B3DEB13A5E31566123C9A265939614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693140, "uuid": "c0b6756e-a271-403a-a937-e99ecd3a68eb", "value": "1536:cgncyyWp3oqeZqqAGOnldxvSCD2wqe/QmwsnrMKiAjbP+jP8w+:35oqeZ3AGOnldxvp6w64jbP+jP/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693140, "uuid": "791b221f-6aae-45ca-ab8d-6653f05f21eb", "value": 72344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693140, "uuid": "447cb395-eefe-4685-971c-0265db074589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693140, "uuid": "529c0d4a-110d-4e39-bdf8-c15b0d36ba83", "value": "8f80be01aa3efc7d8da004c3b951b7ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bd283b-4098-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692673515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692673515, "uuid": "ad3deda8-1be6-46fa-9eb5-01bf165d595b", "comment": "Malware payload (RedLineStealer)", "value": "0c2c8913215d1ff6d62b76f8fff006e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692673515, "uuid": "6493a3b1-7da1-4939-b577-5f8043133f6d", "comment": "Malware payload (RedLineStealer)", "value": "db8b3cce27a2c25f0e2a7c60b52fafe0543a6bd7d0efeb2c4b9dedb2950e3b9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692673515, "uuid": "b56a9680-67d9-4d19-b6a1-aae940a041cf", "comment": "Malware payload (RedLineStealer)", "value": "758b99aedf06ea88bfc0e20840fe5356076ab02a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692673515, "uuid": "44c86b65-9b21-4668-a955-95c6585f98f1", "comment": "Malware payload (RedLineStealer)", "value": "bca2d0b10fdac2d3da49ee38f341dc521c22bebf8610532eb88d0b59980989f3aa0060343583ed22f19cea55d7c75179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692673515, "uuid": "42e4477c-e595-4a32-b083-0d5e8aba5196", "value": "T1CF743AC2338669CEEC4F8AF26921177A8A70D842E157BB537C4FACF73859345AE051D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692673515, "uuid": "d9f74bb9-9c53-4aab-8959-129c7ebf210f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692673515, "uuid": "e7ef05eb-3e88-409b-b728-2ec41da93c29", "value": "6144:OaqnEHQNi4aNBBv4lH3qzTf7MabDFmjxFWu+GNvN1arTi:PqCp4oTXMabDFmjxFWu+GN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692673515, "uuid": "ba1ef0f0-1e22-4f47-b875-40b95e5146d2", "value": 349184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692673515, "uuid": "55a80c93-5443-4788-a5ea-0589ec331a19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692673515, "uuid": "586e9328-3e14-43c7-9e4a-2ef35344a9ff", "value": "0c2c8913215d1ff6d62b76f8fff006e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c3e020-4084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692664942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664942, "uuid": "c25ebdf6-be28-4fd7-be5c-ddae7197a5e6", "comment": "Malware payload (RedLineStealer)", "value": "8ec4270a3eb87a80e64ef63eefbd9c0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664942, "uuid": "98ac9127-1517-441b-9e30-ed204f939b1c", "comment": "Malware payload (RedLineStealer)", "value": "dbf4792d01b66c70752fb1f935a8ddbc1442e0a931b81e8478f59aaddbc5ab6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664942, "uuid": "cc9374c0-dd68-4709-b909-e21ca6d9ccc2", "comment": "Malware payload (RedLineStealer)", "value": "d4bcb7862641648df048481b94d2d2e4e448e22d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664942, "uuid": "fe26176d-1af0-4a59-b2db-60bf3ff765b2", "comment": "Malware payload (RedLineStealer)", "value": "a41a67ce0ffee896150ca65570b86b0ba24b489022a94f464ae2175bba6a20391a466cecae8f4baca200ee6ee9c2de64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664942, "uuid": "493671cd-1f3a-4cb2-b795-58d187676ec8", "value": "T17384F12F67F0F835C8964631DF1DCBF4769FB8618E659A9623044B2F09B02A1D667F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664942, "uuid": "70f843ca-1ea9-49fa-af55-5dac393691e5", "value": "369416073ed39eb88716e6b4aeee9423", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664942, "uuid": "2d4eddf2-7511-4151-88a6-f9807f49b1fc", "value": "6144:xs7bLJAPpNhNLUvJSt5lJgjYNvC08ISbA9fzoBZ78RHi4354YDNOy1BzUIf:xs7bahN+JSjEU7bS0kBZ70ZB91lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692664942, "uuid": "b69d3675-014b-4ce9-a168-b7e22492cac1", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692664942, "uuid": "72fc5d85-2af2-41ca-8efa-720df967aa2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664942, "uuid": "705cadae-cebc-4684-bd9d-26b231145026", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44766c58-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690502, "uuid": "6bdf79ae-6d6e-4ac0-91ea-c6a5936d1729", "comment": "Malware payload", "value": "bd6aeace5493d11ff8089de4de8d8dbd", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690502, "uuid": "0378168a-dee9-4fe8-8198-aae3797762c8", "comment": "Malware payload", "value": "dc6e227e1d32bef271dad2c2fc442868c1ac7df3b7999f7ab935702bd30694a2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690502, "uuid": "0f8c63a9-45b4-4f6d-a531-4cebac34bc01", "comment": "Malware payload", "value": "a764d1f4575f91c6b45fa075dc159e93789edb34", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690502, "uuid": "0268276b-a987-45f2-9c6a-91819f92463f", "comment": "Malware payload", "value": "184a1a929f19d586a871d20aa94361f888e404ffeac5f6d4e7f1107755c112746c16d2f0b1587f9e953a895bc2a66658", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690502, "uuid": "d68e0400-a608-43e4-873f-c0f36301ea5e", "value": "T1E0E4231ADE79D033CE99797A3CC164810EE903FD1CA97284397B8BCC1986D935A5EC38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690502, "uuid": "86b38827-7cd9-4379-a718-782d69602eef", "value": "12288:9VX4L2QJsoOzvWGIjeN4c2z1Q0g+UOZuxDWPuwuwkgCdbHSXo9hfPs5e:9NTvWzjnzzC0gXuugPzuwkoyhfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690502, "uuid": "3d8a6e3a-8da0-4e3a-9446-325bb1056488", "value": 676364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690502, "uuid": "2ca8d72c-7c7b-4201-a940-c9f2acfda835", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690502, "uuid": "25e536cd-c44e-4a94-a426-653fffe88787", "value": "August Quotation.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ade6d4ad-4100-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692718166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718166, "uuid": "ada9d0f5-0e46-42ed-beda-d49b5c9a57d0", "comment": "Malware payload", "value": "f4f56e0ba9d427cf15c143b100152942", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718166, "uuid": "f7838199-94a0-48db-aa40-b0aebec9af72", "comment": "Malware payload", "value": "dcc374e929e1c55580d8baf09dc63e1970714958b22e733d8faf2d11e4acdda7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718166, "uuid": "8b6a8572-dfc7-49a5-b62f-f532761bb93c", "comment": "Malware payload", "value": "2bf4e76d2f39db26673c1622dac3a6018866cc0c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718166, "uuid": "aacd8dc1-f564-4cb2-a065-53bce84a2d96", "comment": "Malware payload", "value": "4d3ec7f5c08e15b329780edbb4c1f8e712b97b9fad0d7f2c5155783766f885812483924bf1a8094f72525335b96d6e8c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718166, "uuid": "d3811ddd-a28e-4faf-9102-f3996035f229", "value": "T1A2737D45BAD2C871E67E09315460C6A16B3D79124EE19DAB3B8A063E4F313C1DF35E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718166, "uuid": "fb879141-fbe4-4b31-bd91-16019ebd5676", "value": "b0596f4feda9912f8fe8ebb458d34fbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718166, "uuid": "b7b47ee2-94b4-4017-8211-921fca48c0f9", "value": "1536:xNEi7fdKoQocShCBPFvh2X/ciZceSsWfcd5rP/FGc:3lQoQocNBPFvGek5r3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692718166, "uuid": "586ae0fc-8e07-4027-8ad7-428a669072d9", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692718166, "uuid": "2ba16007-92fd-4c3d-8afd-3599910b0200", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718166, "uuid": "5f7866d7-8f11-4ab5-b1ee-5c3c42b64532", "value": "SecuriteInfo.com.Trojan.Loader.1704.188.27527", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8324047b-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692689748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689748, "uuid": "47d96be2-d17c-4eaf-83c9-bdac16e9af4f", "comment": "Malware payload (SnakeKeylogger)", "value": "a650752ec819d569f830ee09a2228050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689748, "uuid": "2a12cb02-5ce1-407b-b356-12ecf28a5942", "comment": "Malware payload (SnakeKeylogger)", "value": "ddb04bbf4b3f176293c76cb3167c259c1a763eec1d2a41b6b8b07b3bedf1a93c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689748, "uuid": "5345274b-3cc2-479e-bfee-6286f2011e8a", "comment": "Malware payload (SnakeKeylogger)", "value": "b17876f80f57170e3000c06ce1f544a823ff4699", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689748, "uuid": "4e2101c8-2a78-4f17-994a-905dff358d33", "comment": "Malware payload (SnakeKeylogger)", "value": "7e5f46580f94c266ccbfcd49ec614da407da5f09014fc8b91286ad5e5e2db1279b4becaf25d57e5031a8a8757aeceaa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689748, "uuid": "014bfb38-0a52-478d-b454-12468e096369", "value": "T12F3471145744A831D7FE43BB40159764BAA3FBB13A0FA1362A75AFC42F2109CF93B985", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689748, "uuid": "cb3a6b7a-4e5d-4be3-897b-590de7b937e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689748, "uuid": "19d02e40-d9be-4927-bb9a-d72ee14520a1", "value": "3072:W7yRzAgENiQjYVZMpli/7z3sjSfZQ32W9JG13gc7Of9ItirAOgbYl:WO7s26T9JG13gh964Avbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689748, "uuid": "99e7f102-1568-42b7-b850-868a84faac1b", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689748, "uuid": "6e2ec564-557c-47bd-bd42-81f1ec053c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689748, "uuid": "7242e3d4-9c56-49cf-a908-367f56bd4aa7", "value": "a650752ec819d569f830ee09a2228050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bf253d-4106-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692720668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720668, "uuid": "51452a9c-92fe-492c-9077-f890e00d2480", "comment": "Malware payload (Mirai)", "value": "6e47e4342c77bc19df8a2b4823c1a889", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720668, "uuid": "5db9a3cd-50b2-4578-bfe9-46cddb0fc9a5", "comment": "Malware payload (Mirai)", "value": "de18849f540d305a6b3882e2e2187062e7ab13e9518dfc5a1dd546df909e1708", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720668, "uuid": "e82687fc-aa86-4528-ab0c-747185a473d6", "comment": "Malware payload (Mirai)", "value": "08a1630460cd74637222de2aea410dff19369aee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692720668, "uuid": "e182c8c8-55d6-4432-aae9-a5ef2d63f7f9", "comment": "Malware payload (Mirai)", "value": "bfb35f6e221c66eda42f6c6868335d4959a522dde315ac05e6b1f7f7c08a9a60f5fc2707b4e756cc989c4bacb89a828f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720668, "uuid": "5bfde8da-fe04-4ece-9431-cb4178fa4978", "value": "T199C31945F8414B23C6C212B7FB4E438D7B2A17A8D3EE32039D256F61379B95B0E3A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720668, "uuid": "123456e8-f1b7-4585-a251-0464840809f8", "value": "1536:NY5+1ohC/klFHAe1Y4VEOgsTgvEHVg+N2/rkdllui8mwywbFbYOoyDtlegKKOlB0:NYdWQFHM47LMvEHVkDkoTbi1LuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692720668, "uuid": "b5c6509c-a4fb-4a1e-ad01-8e52f1061f0d", "value": 125696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692720668, "uuid": "c37d92b8-149c-4ab8-8419-a3fba0e2ef3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692720668, "uuid": "32314ab3-0334-4891-aab3-f6405488dca1", "value": "concakhbtandhuy.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a9350c-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692689786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689786, "uuid": "c672d5b0-2bf3-42ac-a794-11181770ac1e", "comment": "Malware payload (Loki)", "value": "849d4d59ee65aeb49a97ca9ce7e37eeb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689786, "uuid": "3b6b4f87-0641-45ed-ad0a-6cbebc1e5337", "comment": "Malware payload (Loki)", "value": "de2ce07d93746c21c818d8b60753efa39043cfd1f372f46d5196fd37e46c9f56", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689786, "uuid": "6421460e-6e31-4a54-8598-8888e8fcb444", "comment": "Malware payload (Loki)", "value": "f566b1181e5175516a3d626d137a18aff2e1e64f", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689786, "uuid": "1c1292f5-9308-467c-9678-6e4e4eb747e3", "comment": "Malware payload (Loki)", "value": "a244d0c0b92268e59793458d4e7c6fb1e5ca194f844dfec9e3dc4baca91022a3a91ed5a139f29f7b814b2ca5f5b88643", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689786, "uuid": "d106ff56-9b0a-4377-a8da-9a7130c20864", "value": "T1D975F103A8009F87D41D87F8BE630DD54F1B7F18A995B9DB04623FAB3B717A2185A21D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689786, "uuid": "f383e0a6-c4c0-4f29-9eac-0db40ecac8bc", "value": "49152:Krev6VZjKjOz5S6VSjKjOzRdPF/31Ns+:KrAmZP4m0PRdt/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689786, "uuid": "fed773cc-192e-4712-93c6-6be57e5c9e9d", "value": 1580544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689786, "uuid": "3aa7136f-959e-4490-951e-45f50cfaeafd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689786, "uuid": "bbf00995-40fd-491a-bb38-3564aa9d339c", "value": "DRAFT SHIPPING DOC INV02523L1 PACKING LIST.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ef9684-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690588, "uuid": "7e3f7d2f-bb78-4c03-a29c-9d784e71a1fa", "comment": "Malware payload (AgentTesla)", "value": "c9ce827fa773913ce476d201b0df213e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690588, "uuid": "b6063165-c629-4e97-84a7-374efa07ae9c", "comment": "Malware payload (AgentTesla)", "value": "ded0180a3db43793152d92a0ca93fb091d8947eee3ae622902c599150e3aa5a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690588, "uuid": "a8fd9e10-a560-4f93-a557-050a0ce39595", "comment": "Malware payload (AgentTesla)", "value": "7b182eb830c07fbc893e0021174b407bfaca813d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690588, "uuid": "6724d1bb-e4dc-49b7-93e8-3e6789ca2fed", "comment": "Malware payload (AgentTesla)", "value": "6a7e057ca27001e9c701b149c78e82a3c2927e00ff77751f05babb47c8454c24af7b782e9dc825b2065a9fde279f2436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690588, "uuid": "a4c5da01-0e0c-47a3-87fd-19b7a761c124", "value": "T16CC4120DCF51C539C93A49F95F6D0BFA45752C9BA4E0E90DBC8932816F36E8996328B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690588, "uuid": "7a5d678b-f4dd-41ca-ad5a-42479fd6cca5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690588, "uuid": "97b8b959-b8f4-4be6-804c-426f32f6000a", "value": "12288:R1Wq86/ODNY8zwmqev+RvmbWpYB4FptQpUfFl+lk/K/jrKVtmr/T:R1Wq86WDDMmqev+lFSeFpaklQkCPKVtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690588, "uuid": "7cc70e99-ad33-4550-b520-6adeb4e61f68", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690588, "uuid": "233908e3-61c6-4144-bffd-8485d10f1003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690588, "uuid": "579ef9b3-f603-4af2-9702-bc6eca140f30", "value": "e-dekon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9548c88f-40f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714260, "uuid": "9a5abbac-3fa6-4808-b8af-08a133404989", "comment": "Malware payload", "value": "6fd4607edd317dc7f3c10f312527b6b5", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714260, "uuid": "79578744-49dd-40d2-bfe7-194281539286", "comment": "Malware payload", "value": "df1f6992c9549e950d0c1e2435c8fb7c353f4bd8d70f422bf2757e15fe23fce3", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714260, "uuid": "261297fb-c089-43fe-a680-418349f3122c", "comment": "Malware payload", "value": "c8c827105498fc62ffd212aef168d34d292eb985", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714260, "uuid": "47cfc9a8-1679-40f0-93d9-91eca38857bc", "comment": "Malware payload", "value": "0a13b006d87bc0f7439c3c779a0cddbd5684c11d9d5622843b6ed4e37f7bfa4b0a53814fed3608bb12bb891e1d93f577", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714260, "uuid": "d223f58e-11af-47cd-b3b7-1103d216e288", "value": "T1DFD5BE05E692CE27E3E45B7EA163502A9270D6233716BB8F0F7C95793C923B80D523D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714260, "uuid": "6e5ec578-3a83-47a5-9e8f-73984d16ebf4", "value": "49152:H/Jfx3Y5UFeKvNCJ9Uz0w1LYTa8P7Of82LUS+MX:39wKv0a1LmP7OU2sY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714260, "uuid": "d4aa1f8c-b8a4-468a-b81f-0d5eab276fba", "value": 2924544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714260, "uuid": "b52631ba-7ba9-49f8-924b-f6d8fda33bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714260, "uuid": "39186b34-a02e-4844-a9f9-042c8e0ddbf6", "value": "16927142429c73359da31d8bf8a42301b383eeb57d32525c8383d0e8663277dcd9172e7518841.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca228ef6-40e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1692705329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705329, "uuid": "635a148d-1175-4024-b8e5-5efdfa7f5225", "comment": "Malware payload (Loki)", "value": "67429873c0f8b099f6406b18a549ec60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705329, "uuid": "59499028-b8da-4f25-98ce-6795c25cfa6c", "comment": "Malware payload (Loki)", "value": "df3a64b0be1c016685cf877796d7fbc72e70ff4e2f04949694ab4b3af1058c54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705329, "uuid": "30c09285-e50a-4bfb-967e-8f494cb8963c", "comment": "Malware payload (Loki)", "value": "b516696fec59df1ac288e59bab0a9b40bb863284", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705329, "uuid": "c195c05e-199d-46d5-95a1-1503c54a94f3", "comment": "Malware payload (Loki)", "value": "39994609dc40c33170ad7451f829d1052e95746847ff49f44f1b36c1f181b230d4a6b356efba0a1013565fdaf0d8d324", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705329, "uuid": "3995faf2-1f92-4298-a471-2d1d270e92df", "value": "T1B1D4AE11A3BB9B55D87E93F53F21160C0BBE655923FBD2257FC1A1DA2821B80491AF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705329, "uuid": "40706bcd-438e-46c9-87c2-ff6bb255b356", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705329, "uuid": "5d1ec27b-79a9-4f21-9804-3dcb6a82c30c", "value": "12288:A5CFEww2d1mbT02WZjF8kc7HzqRXEgWIoVX+jv+RHaC1xytPJEn8X:TFEw00pjF8kc7Ttg0OAHi9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692705329, "uuid": "15a218f7-731e-4ce7-ad0c-9d5e788d1e01", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692705329, "uuid": "ccde4d21-7dc6-4657-9694-efcd3cee2810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705329, "uuid": "c7421c92-2608-4722-b651-5c03802731b6", "value": "Request for offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa293ab0-40b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686082, "uuid": "1c0b9a05-ca20-4b3c-8bce-3d812db3fc15", "comment": "Malware payload (AgentTesla)", "value": "a000b8411c5db62862d2a6f98d3851f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686082, "uuid": "18272c98-fe2f-4e2c-9502-c523ff11cb27", "comment": "Malware payload (AgentTesla)", "value": "e01f586f773c36468995eabf2682dfc209824b06a8a784bfb34b7fad499bc22a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686082, "uuid": "221955db-5ad4-4104-8bc0-2c4884969907", "comment": "Malware payload (AgentTesla)", "value": "901d3c659e3d0369d19694bc98927936ac445386", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686082, "uuid": "ab70f3a5-0d97-4e53-a053-c79405342f54", "comment": "Malware payload (AgentTesla)", "value": "14f8247f9835b8c5c25b69c4fc149577445dca9466071787c891e383a0845f01b5b9cc5a3a1a666947410ebc7649a7ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686082, "uuid": "dd7f76e2-3bbc-413c-9477-328f6f410e01", "value": "T1FBF48CC1E2BADBD3D57A53F5246106000FB67ECAB579E2944DA630D935F4B402A83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686082, "uuid": "fbfa5343-b839-4ef7-97d0-70e087cee969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686082, "uuid": "0233bde1-6828-4ebd-9ac9-12accb0d4d81", "value": "12288:zTs02d1mbTdaWVBYPnoLDtBiJDqwJn0Pw9AHaEyNrzfqSmjv6wz6T:zTnd3jEnoNBiBqG0PWBNwv6M2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686082, "uuid": "f23becb5-5371-4e14-906f-3e9365271993", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686082, "uuid": "e3e39aed-c548-4a08-8948-1f58c2e552c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686082, "uuid": "5b2c89a2-59ea-4cf8-8381-270d14ba4b25", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fc8c89-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715959, "uuid": "078a79de-79ab-4f60-a010-0942fd981bed", "comment": "Malware payload", "value": "4d68c9b40f348262248e55ec972892ab", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715959, "uuid": "a6e3c29d-79c1-4167-9728-cc8043bb8e84", "comment": "Malware payload", "value": "e041f63cab919d1af8614fb83b362cbff733bd06bc89d30cd04dcea3fac8651f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715959, "uuid": "bb52f241-9e5b-4350-8396-0c6e98e4a029", "comment": "Malware payload", "value": "d9fd5b8bc91c27842731a8cb3ac43fd41502b32a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715959, "uuid": "fcff9bd5-126b-42b5-8869-49e25f192a52", "comment": "Malware payload", "value": "0216e5da0fc33d9b41f00ae6bd568e7b3fd972065ebbb6602a20443a3f9ca6c6938e8f4d6a808d86410c89f9fdbd9c0e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715959, "uuid": "025fe99b-1d1d-449a-a3fe-fe4adc5bce1d", "value": "T14AE37C1B72D160B3F0F34675E9B4AE11492F3D102B945EEB26E655ED5D220F0AD3AB03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715959, "uuid": "ba395a89-e99f-411c-95da-2adf76569e8e", "value": "7b6dd4245c054681d7b6b1f9b76fe984", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715959, "uuid": "30f99cd1-803f-46c3-9513-f6fc95763675", "value": "3072:m5tmM+mgqQHSUs4QL1nMqqDL2/OPvdlJ:m5t3Bj4QL1MqqDL6svdlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715959, "uuid": "ace52ba3-8b0d-409c-a716-7fe8c2092406", "value": 144384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715959, "uuid": "58c2d009-193f-4212-a114-08642551e3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715959, "uuid": "5b67adcb-7e06-40ce-a117-7f63082b89ba", "value": "2023-08-22_4d68c9b40f348262248e55ec972892ab_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff9a405-4122-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692732558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732558, "uuid": "41559c73-8599-4a97-882f-83f6c2792378", "comment": "Malware payload (AgentTesla)", "value": "e07356dd5dd5bf1e65ee4a8b4c3a66a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732558, "uuid": "568fcb99-a8c5-42c5-92e5-0c4a1f573df2", "comment": "Malware payload (AgentTesla)", "value": "e0e5ab43abc810a3fc2b792ef33534da19f6706cea475b148304f400755c74a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732558, "uuid": "d224b35d-a0c0-4801-a87c-8b21db482003", "comment": "Malware payload (AgentTesla)", "value": "a9a0cf562e6689121b568caff632a850c927b18f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732558, "uuid": "32328de3-5436-4b80-b0e3-3fda381c453a", "comment": "Malware payload (AgentTesla)", "value": "81089fb0d1d7c018eff775e16b74ede207f8ed3e1051323720dcca37c01c06d6cc3a7c35e44904c69db57d18f00bb127", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732558, "uuid": "4dd85005-7b01-472b-9949-0b5a5eed3abc", "value": "T180250A1C6D6FCDB1ABE352F9B11A63BA4212744F58CEA0C9633B7B40C4CAD164F52D92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732558, "uuid": "dd468676-5208-46eb-9774-a294ed71cef6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732558, "uuid": "6e3922eb-8c23-401d-a2bc-3fd05ff6227b", "value": "12288:8APKEaMOuL8reHujlQYVSWrpCGnINjwtwncUmx8deL+r8NB+yZ:666pQ6tc328deLXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692732558, "uuid": "fe160c8b-cd23-44e5-8f1e-0c332364e1df", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692732558, "uuid": "3f4eff32-cc9e-4aac-9663-900891cd9320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732558, "uuid": "3080645e-e741-4b0f-b331-07a3f309efaa", "value": "SecuriteInfo.com.Win32.PWSX-gen.24188.27556", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a3e046-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714450, "uuid": "f4eb0e91-e278-4eae-bd83-b7b2f5911b20", "comment": "Malware payload", "value": "928fa4f54f28c76a06ab1f0560455ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714450, "uuid": "781ad05e-b2b5-498b-89f3-65810f9daa9b", "comment": "Malware payload", "value": "e0fb9bb1f71bf2de2bec6ae6539fe563271b9fd5cf9ff2c21d37d17aaf5822cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714450, "uuid": "0792e3ea-8b60-4218-9162-0f264e2993b7", "comment": "Malware payload", "value": "83ed34b3961a56f94fdbd3d0a967c8e322abe553", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714450, "uuid": "c179b105-7849-4a57-98fd-b715d218f0d3", "comment": "Malware payload", "value": "52f679fcaba808a6e89c8e709a48f89329396d0df86c7ea639b06f764763d8ed27e81f3f51cd05a42c973aeb2cfa34f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714450, "uuid": "41890c5c-c161-42f6-ae3a-b4b96aff8dab", "value": "T14F950220F942C1A6C8F2017156FDEFB6297D9E318B6C04D363D06EBD5D304C2697AAA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714450, "uuid": "e10e822b-cda1-46f5-af28-0b2776e4f754", "value": "f67c2d48a0d9fae633478c7ae08a5655", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714450, "uuid": "8b3aee73-dd5c-4d3b-aed4-8f9a1b23a610", "value": "49152:T8ntDZAcCVT1Zg38S0lkEx6CtcX4EwgGW2:AZAcCKouX4EwNR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714450, "uuid": "01bf783b-86f8-42c3-a36a-3b7701890f13", "value": 1901222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714450, "uuid": "19b3e6d7-3fa5-424a-9cb1-5ee4298d30a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714450, "uuid": "6f854812-1791-43a5-9475-a9a337e37d0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a4ed9e-411d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Fabookie)", "timestamp": 1692730475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692730475, "uuid": "658b9dde-6b4d-48c6-b091-5cc5b380297b", "comment": "Malware payload (Fabookie)", "value": "afc2a16ccea74e30714916eb2f59a55e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692730475, "uuid": "a6c32092-88ad-493f-b1a3-f8890b9a4634", "comment": "Malware payload (Fabookie)", "value": "e41f5729a7ff7cc2b251abbd4de70d237239e4486c37bf47bc53ac3ed44f620d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692730475, "uuid": "4a568c66-d697-4820-ab80-91a827c1257f", "comment": "Malware payload (Fabookie)", "value": "cf089a102afae886064e8ebb2e48dd21a891413f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692730475, "uuid": "02354948-4da2-4160-815c-1edf263849d8", "comment": "Malware payload (Fabookie)", "value": "2073c2c6adbfcdc7e07b9f15d773b83db9aa2740f53fe8704c7ea481a4ba8f5976b45f8ed7ff61f1518ad86e4ef2a742", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692730475, "uuid": "efd444bd-26b6-4e91-904e-72172d96cf4b", "value": "T110D4D081B39095D9C4B88430C693CE71CA317C64DB28569BA6D4BB6F2F32AF1653731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692730475, "uuid": "22f550d6-2e36-4fc0-a354-821b768002eb", "value": "4673ad56625d375f2efee239af061364", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692730475, "uuid": "2ab2e30c-25b6-4d7d-a66a-6aa19fbf2f21", "value": "12288:772BPbzjv6I8XM3lRkRc4YFwjsWAfRgantPbcTTn7axerx7:HkbzrRWM3/kRc4lAgantPbcHn7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692730475, "uuid": "d6ee79b3-d654-489a-beff-3bb4dda55f41", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692730475, "uuid": "0c77777e-6194-4ec1-9ef0-2d68081ae46e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692730475, "uuid": "7c471b14-9473-4244-881c-9b42aa6085fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5160a8-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692689820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689820, "uuid": "26062996-ac00-4e9d-9714-cd4b878ceaa2", "comment": "Malware payload", "value": "0883e71d29dfd7dcada18f895701d261", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689820, "uuid": "e4fe95ef-1776-4e96-883b-e91886dc8be4", "comment": "Malware payload", "value": "e4e930c0a19f60376adfcb308625a50157f9960cd1331b2d4bea01bf3d2cd4f4", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689820, "uuid": "4249ec62-efb0-4082-9012-bb755577d857", "comment": "Malware payload", "value": "8a58459ac6ed115407f910a30047f38187e1ee68", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689820, "uuid": "33d5fe1f-6120-4dc8-9f97-e0e2ecfe6faf", "comment": "Malware payload", "value": "02b88e8ee79e5bab262ae1ae64e736957abe4e395c042e60cd26eb6e147d3cf38ec7ac0a6412fca8f4fe9f16b775fa89", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689820, "uuid": "d5d44036-0268-4782-b4a8-05a554169cc9", "value": "T15B152304A6D7C4F6D4E69A388CC9A4E7450CBC311B41C29375DABBEC0572FA7E3691CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689820, "uuid": "87aa926d-a0c7-489f-b347-0691ab35d0b3", "value": "24576:er/+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXXIVJRrkAXZSP4r/C3sxq7AI8gIIj:erG6bV7rzEQr/C6q7ZFKu2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689820, "uuid": "223a64d5-a063-42e7-a2f8-d4d5cf334371", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689820, "uuid": "df1dfa95-cf2e-4cb2-a6f5-7712db139ded", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689820, "uuid": "20745f76-1ae1-47f0-801b-14df0185522a", "value": "RFQ No. 8202023.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01af279-4108-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692721713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721713, "uuid": "d601f688-335e-4629-baf5-5af86c5dac6b", "comment": "Malware payload (Mirai)", "value": "cd1863cd426f4aabf213fdaefaee9a4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721713, "uuid": "9e6ccf08-9f00-43f1-afd9-7e01353b621a", "comment": "Malware payload (Mirai)", "value": "e4ea79a3db4f0fd9bccf7b5b80136c8b498420c0a2cc2fd16ddc09ee010e9fdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721713, "uuid": "adfe1fb2-caed-40e3-8382-b7647c39385a", "comment": "Malware payload (Mirai)", "value": "37071e59a34847898600e6853fb6319008ff1cb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721713, "uuid": "2b12b4a6-60eb-419a-86a0-17e3b51f9358", "comment": "Malware payload (Mirai)", "value": "11f0c90772d275308eaecde84108f0881fce98b5cbd33aebdd6cadcb54723d815f81a822bfefe8e9245afdacd1e2449c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721713, "uuid": "dcde2fcd-4d4a-473e-8f63-7f5f3c4e642a", "value": "T136E319D7F800DEFAF80AE337485309067130BBE145925E373267757AED3A1991867E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721713, "uuid": "cc719716-e513-4168-badb-0ddc9ac663c3", "value": "3072:4ffNzGzBWX5DuOk3ACfohABVrjbibL6QRv1yEYAN1:ofzyOYAFhAAL6QvyE/N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692721713, "uuid": "cf466bd6-9fd8-4364-bf20-d1ef7263eddf", "value": 145312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692721713, "uuid": "59d30e29-c26d-4349-86c4-7a41cdb2dd39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721713, "uuid": "1ef09e9d-c4e8-4b3d-bfed-ce6ad1dc1418", "value": "cd1863cd426f4aabf213fdaefaee9a4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c581f28e-4119-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692728943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728943, "uuid": "4025e375-4fce-481c-b1af-7d76bc7458f3", "comment": "Malware payload", "value": "78562028493b76370d3be4b14980e76b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728943, "uuid": "da53fa0a-0210-4bab-9200-3ae95a5fac26", "comment": "Malware payload", "value": "e59ab89b00fdd780976c39874a1e778811130531a384630358c9a85cfe42fd47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728943, "uuid": "04b1d2dd-6739-4118-93c7-08f9df64ad4b", "comment": "Malware payload", "value": "ab72cd4f924e7f60fdce365ecf6a7998e4dc8c00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692728943, "uuid": "d1c3f18a-6c5a-4880-afac-3c6fa79a71c1", "comment": "Malware payload", "value": "171d14554f7306e8d9764dcc34cb8c1e0bb7c5fc3d00480d7120c94695591dcf8304dfdccb478c14ab55dec2c743fe9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728943, "uuid": "4caa95ff-6f3c-4b0a-afcc-abc35b1d1644", "value": "T1C7D1D856A3D89B36DD3B0F37EC63B3810776F740989ACB5E2C88010F5E6375A45A2B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728943, "uuid": "61c167a7-a962-4d02-ada3-64e4897824ea", "value": "96:zUG+e72KID6OjaduhNelcI5pLzUKFtaem7dYziSfaXVzNt:z6D66YlcI5lUKPm7dYziSfyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692728943, "uuid": "8066d961-3d94-4854-8a41-b07e604160b2", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692728943, "uuid": "5b9c2922-e869-4178-99be-6e61365a0c9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692728943, "uuid": "f1486849-e662-486a-8b34-5bf736349ec9", "value": "SecuriteInfo.com.Trojan-Downloader.MSIL.Agent.12288.13992", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53e3d286-4108-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692721451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721451, "uuid": "9a880f37-f833-47c6-a922-4ec9fa2c3bd3", "comment": "Malware payload (Mirai)", "value": "d7fdd37e5bdcccfe056f8f4244a1f6ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721451, "uuid": "423fdf72-c8b8-4179-8f5f-e7bd2616671c", "comment": "Malware payload (Mirai)", "value": "e63b6e4cb3b22eca4472a53cd07d77de6ba53ea878ef3ef9bf8a313151fc203a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721451, "uuid": "4ba1d961-062a-473e-b380-ec1761798096", "comment": "Malware payload (Mirai)", "value": "eeed1c09048069ce0a568936459b1eecc73a7e2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692721451, "uuid": "027004ee-1faf-44d2-bb80-fba170b36836", "comment": "Malware payload (Mirai)", "value": "f205abb07b3f26ef56aa04d6a3cc91ce093a2911b8b2faf2c20f90254e28dc303247b0a76cab694a514cc35c80c357d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721451, "uuid": "385aac5b-61a8-473f-a994-eaaf13b5b17e", "value": "T1CEB35B73CC166F28D615D4B0B0B48FB92B939A9091875FBE26B6C2744483D8EF9057BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721451, "uuid": "e6f339d2-ddde-4817-87eb-59d17668cfcd", "value": "1536:atxBAcfiaSGxqiECgKkb9tAkId1XcYW+XMg5gDfLo:aTJ6aOiE+khIdSYW6MgkfLo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692721451, "uuid": "223ad331-4a7e-4742-8a35-b550b8355de6", "value": 113472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692721451, "uuid": "9dcd03ad-7cc9-4aac-b425-452dc1df3aed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692721451, "uuid": "3fc3f89e-dbf5-457d-865d-2b3311999a69", "value": "d7fdd37e5bdcccfe056f8f4244a1f6ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cedd06-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738626, "uuid": "72d90eab-2f8f-4713-a787-82d8ea1ecc9d", "comment": "Malware payload (Mirai)", "value": "9dfe172805fa56458279246542460acb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738626, "uuid": "b704ce23-382b-4cd0-87d8-35fdc018ba93", "comment": "Malware payload (Mirai)", "value": "e6d8431f05c4dded2c9e77f6c07026ba5220a79d47b7258a9e562efe62cef653", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738626, "uuid": "1e91fd87-b58a-4c3e-99b9-16d8aef11a15", "comment": "Malware payload (Mirai)", "value": "d543d237c89b520480c67428a452581bc89dfcb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738626, "uuid": "367a6e56-37b0-4dfa-9f42-ce8b89cb8965", "comment": "Malware payload (Mirai)", "value": "0eaf00ef4175a0a04b33ec3b346f4a92b7d107655914a549f51e4b67f9c2768c3da1f6de70ad52dff3610fc0c536ed11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738626, "uuid": "2657a9af-fa22-456d-a75a-e079b7809202", "value": "T1A4B2D0CC61943484CA8D7C7C678D4A664F6CA1D0BAEDCB16E350CDD8B3BDA8B3459078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738626, "uuid": "530da103-6349-459b-ba05-fbb68d6cad7f", "value": "768:okrQlS07dEv0UXqUhvQE+CXQKMQKCXBp+LZqsWv4:ZQlS07FUXqIYSXQKqu+NqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738626, "uuid": "0517b552-1b70-4d73-a45a-ed1585a031f0", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738626, "uuid": "be5003d7-a5f8-40b0-8d9b-090efecddc25", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738626, "uuid": "db49b1e5-3d2e-473d-86c2-01beeb010fa0", "value": "9dfe172805fa56458279246542460acb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ed1d2a-40c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692693187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693187, "uuid": "0fbe9e66-03aa-4ad9-86e3-6a8201330a2c", "comment": "Malware payload", "value": "3a7511d27feaf68565dbb91bbad1d7c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693187, "uuid": "daa050a1-05c9-4aac-a15b-b37c699aa730", "comment": "Malware payload", "value": "e7a1aead68fde3d465a809556cd6f29b8f80c682537f2ac533c5520fbd990a98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693187, "uuid": "3932f00d-a4a0-44fa-a374-41e08187f76f", "comment": "Malware payload", "value": "28e5c8b8c9b1381527a33d33504e48e6cc9a32bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693187, "uuid": "7eda3567-7840-4260-95a0-756037c10b79", "comment": "Malware payload", "value": "d93a42e03935dc24cb4672edb998c1b411d560256126345d1fadc09244baed5baca60b99c1ebe19baff50ea42b945627", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693187, "uuid": "ee7e4ada-d832-4205-bc55-44e27da2a304", "value": "T1D841F01A1F901F33DDA6CC36455A2B512ACC842F616B23926374D960BD2E644E7D38AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693187, "uuid": "6839cecf-bb69-4a45-8019-357375edd656", "value": "48:0Q24nuDW3j6df9v+SMTLWPkeTwW7dph4FaXp:0QBnuqOf9GSoLW7TwaR35", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693187, "uuid": "b7666a87-ca9e-416d-bec5-d94104d5503e", "value": 2032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693187, "uuid": "ceeb1a59-aa74-483f-8e93-cfffd493e898", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693187, "uuid": "30440708-747d-4058-a7fd-33c879ac9fed", "value": "3a7511d27feaf68565dbb91bbad1d7c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d561a7f-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725333, "uuid": "ff3a626f-470c-4236-ade7-c3805c290d58", "comment": "Malware payload", "value": "7aec7d7292e2ca19b119a3ad8afc6fdf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725333, "uuid": "c7db694b-4aa0-46f8-a6a5-03b46cb0ea3d", "comment": "Malware payload", "value": "e8aca476bd43780f5c7a5818179536a0128b217f71be44893bac65c6ce186c75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725333, "uuid": "2f806d00-5d8c-44bf-a7dc-4a51ab4d8012", "comment": "Malware payload", "value": "949b77c7d43873420d6b9938ae7d701c51a1b267", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725333, "uuid": "29c09b72-6078-44ab-b178-017740e96d04", "comment": "Malware payload", "value": "e4501c4b52390b8258126fbe625672d7b4d8f9ccd77f066d82882fdc591b023a12f64ea9b8c60d6657ae15f84627bd86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725333, "uuid": "82abdf5f-1e73-4019-bf93-dcaa29a3801c", "value": "T12D433F2F3B010A6DE2D4D57C93EB581BF661FE8EBDE6705A1740EB5628C6F818B1120D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725333, "uuid": "717c559e-1a55-4803-9965-a2c6d48d8322", "value": "768:PWHZgPQOvKZkwOYwGRUwlo+bOhfPQSS40PS5Z++WT1hBfnMcVGTNtM/hDokScN2P:TSfDuTcNpEB5Fzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725333, "uuid": "394d8e35-24a4-4090-9719-dd5620ab71e9", "value": 55384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725333, "uuid": "7894caf0-67a2-4b3d-81a2-9b6722c5efa0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725333, "uuid": "3f71fe86-ff4f-4191-a804-71694aa9d6b6", "value": "SecuriteInfo.com.TrojanDropper.AndroidOS.FakeApp.QA.MTB.24829.26563", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36287857-412e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692737722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737722, "uuid": "fe1d52e1-d503-4905-bb6f-023f74872306", "comment": "Malware payload (Stealc)", "value": "24561e418f49cf2373c5714e22e7597e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737722, "uuid": "09c3322e-05ab-4732-9117-4bb446fa5207", "comment": "Malware payload (Stealc)", "value": "e978871a3a76c83f94e589fd22a91c7c1a58175ca5d2110b95d71b7805b25b8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737722, "uuid": "43e6c5f3-82cf-41db-9b03-3a5ea0469d75", "comment": "Malware payload (Stealc)", "value": "c7d26e048f27d9a29b4fbabba6608f91dabf61bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737722, "uuid": "f4042cba-d200-41b2-93e5-d867d801542f", "comment": "Malware payload (Stealc)", "value": "24163d7333fbf5b791760fc9756aa862a9fb4536a8dddaf30439bf5a5b2371f940700f8b19ee63a07be6234690ed1033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737722, "uuid": "1aa506d0-a83d-4295-b69e-fc31746b8555", "value": "T181A3E600DA40642EE1A540FFA5AE5BEBE41C7EB41304D0C3EBB16DBA35E51F164B58AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737722, "uuid": "2b187ba4-52d4-45f3-bfd9-102a635eca00", "value": "5b642aee16a1766b8e15415221aa1eda", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737722, "uuid": "55a95507-4d74-49d2-a567-8fbecef6a3da", "value": "1536:wdaSGIkfgaC1rrdYEZ7t+FaK9gXYJ+UcRt8VgRJdb4D4cqVeAfDRsEL/vEcB59pJ:2NGVCxrdXIFDooIRn4D4TvOEL/VW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737722, "uuid": "64476e87-08bb-4abb-ad95-46e7a0276531", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737722, "uuid": "c839d796-b8a7-4a31-bab3-bdcfbf04d556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737722, "uuid": "7e291bf6-2f67-49b5-8431-03b03b08e491", "value": "24561e418f49cf2373c5714e22e7597e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8e727a-4085-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1692665417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665417, "uuid": "720d6780-c925-4ba9-b49a-b1cae697ad21", "comment": "Malware payload (DCRat)", "value": "0af17cdec44c75ab12fbf5c42ee40e28", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665417, "uuid": "20a09229-24da-492f-8004-58a068e258a6", "comment": "Malware payload (DCRat)", "value": "ea14b5a974b3ac20ba93b083f922f413e09aa44bec0c39f6f7cb8edccacf5d67", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665417, "uuid": "d80fb821-9f14-4c56-945b-b3d8fbf013fc", "comment": "Malware payload (DCRat)", "value": "8b5eab09f58d76a1c763ccd94a1fbc2ca963b79a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692665417, "uuid": "280636de-4cc4-4b3d-9b09-fd916b9f3808", "comment": "Malware payload (DCRat)", "value": "ff8760ae26c442f4123d0265d7ebf347dcce32aff99315e3b6f84e299269593ffe93e11eab60873a73793d5aff817fee", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665417, "uuid": "f220a2fe-22fb-4fdf-8a95-6d4f4dae4575", "value": "T1C0C5D0027E44CA21F0095233C2FF494847B4AA5566F6E72B7DBA376D26623973C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665417, "uuid": "d8521533-4ea1-451f-a73f-2ac4320167d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665417, "uuid": "210c23e5-7a2d-4e28-b504-c81bf335aac7", "value": "49152:+86GItY8+bRQFcikHV2I22kTzO2juTK/3qORvWJTded68:d63tOw5Ip6zLRv1vWJ4M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692665417, "uuid": "b98c11a4-c324-4905-8ba6-59d364305c01", "value": 2690560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692665417, "uuid": "8a3f570a-0609-4f91-b40b-f60b7dd3f6f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692665417, "uuid": "103cf5f5-5cb8-49a0-b783-7ec16a5fc9df", "value": "0af17cdec44c75ab12fbf5c42ee40e28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc58ea0e-40b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692686086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686086, "uuid": "32aa73d6-a447-49af-a39f-d3e0dc3a92d6", "comment": "Malware payload (AgentTesla)", "value": "18e60c324c50511914e3790e39531d44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686086, "uuid": "ac3603da-6418-4ef1-a599-03ef70d69616", "comment": "Malware payload (AgentTesla)", "value": "ea1b6b61ba60482c15d2d75495b43e7fe5e68df187f4c99977cdc64f5ed42f35", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686086, "uuid": "4032b872-139a-4d4e-ae03-0d1fd7bcdab6", "comment": "Malware payload (AgentTesla)", "value": "df34725db0fd193e851e86cd1926c9329135a8d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686086, "uuid": "2bf23802-a704-45e0-b124-aabf03868474", "comment": "Malware payload (AgentTesla)", "value": "827f533ae46e1648590173dd86f97217aaa73c7a3f803216b16fb453c1200e0dbfc6142692b7b9dbf3681615c779075c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686086, "uuid": "512140bb-64a1-4b06-acca-3cff43865ea9", "value": "T1511533E5B01439AADE023B96BE907EF0627E4830FDB618224D3433A53D0A75B54F97E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686086, "uuid": "01b485dd-4250-42a5-9f95-7d2da8b6f4b7", "value": "24576:9TRQPlWb8OynVW79V/hrs5Saobg2KRcqUKihZD:9FQPG8O8+bO5Ubg2KRzUKeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686086, "uuid": "22a7d4fd-085e-4ed3-a708-51336315fa19", "value": 923382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686086, "uuid": "81d5df4b-e768-4b2c-ac6e-a8d8a8faedd0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686086, "uuid": "889112e3-9f73-4a4b-93f0-dc3e3adc48e0", "value": "Payment Confirmation Copy Euro 76,853.61.pdf_1.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81cfc408-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692690605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690605, "uuid": "1e3c5703-1fea-4c32-ba02-1d65c0bb71d6", "comment": "Malware payload (Mirai)", "value": "5e7573e597339dfea1d60d1576e9d6f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690605, "uuid": "7599808b-5a87-43fa-b003-4eb8025b0751", "comment": "Malware payload (Mirai)", "value": "ec1330bb7b26d691ac176f4c972ff86ba39fe9be28f9b1b5ef6302e106bc35a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690605, "uuid": "ccde28e2-7512-4ff7-8e70-f3cc465abafc", "comment": "Malware payload (Mirai)", "value": "56c9d224d225805622639639b20030e00afaaa22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690605, "uuid": "0ef0e8a7-7e47-435f-8c8c-97e128d1b0e0", "comment": "Malware payload (Mirai)", "value": "47408865b50efcacd0172b48e10f2ecc0e0e502edf7f38f6cb1d0672e54578c37994b675c2c17784f22a199cb2d376dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690605, "uuid": "f4a6977e-17c5-494d-b20a-b8f9ee7367c7", "value": "T128330273676D3AE261B05373BC32BC1A629C17F99C67309A2CF05A1977C48024EF2686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690605, "uuid": "dcff8a15-783e-4056-8c5a-4a142d11c6ba", "value": "1536:d9O/ZMAXIxNUk04P7LcPqF1aBexo4opKZbK:d9O/ZNKyEP7LGqFUF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690605, "uuid": "a9456066-57d9-4177-a3a2-36188b47128c", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690605, "uuid": "b1d5ced1-8249-416c-bbd7-73547ecb59f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690605, "uuid": "1679737a-58a4-4ba5-ba82-4433deab0018", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d79131-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692689732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689732, "uuid": "456fc332-465a-4fb0-9005-5f5fb8bd47e0", "comment": "Malware payload (SnakeKeylogger)", "value": "7d057094934f2b3c46027e9575fb9cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689732, "uuid": "c9f52157-caa8-4e1d-8dba-b63a55fa65cd", "comment": "Malware payload (SnakeKeylogger)", "value": "ec73a25504f897928b815fb34f9561f742482b3fe457d1bdaa3279dfe19c1eb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689732, "uuid": "e81e1b9f-e718-4558-b04b-733a0852eb10", "comment": "Malware payload (SnakeKeylogger)", "value": "d626ea3d2820e59aa85e26055beb8b1f74930da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689732, "uuid": "ea3a22b3-b6db-42f5-8660-98ac54849dbd", "comment": "Malware payload (SnakeKeylogger)", "value": "98658d7e220eaaed1cb35b8356a732bb81522c99262b4c57ac66631a0ba1c0432450b4d8c790262abe68faeb4c75feb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689732, "uuid": "52079f5f-fee1-4bc7-96bb-ee80330f9699", "value": "T1CE12F95677E8933AC8320B32DC639342177AFA11D4C2DB4F94D0251E3E62346DA93BB9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689732, "uuid": "fcffeb22-5e7c-42c7-8d60-337ff274b5a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689732, "uuid": "d277b38c-0329-41de-8165-c872a90a7b22", "value": "96:oduCvfyXNikKQ8ii3fD4L9iDq6W0kFiLH3B/T8c8YPqzNt:mzfyAkKQ8ii3b4L4DA0r/IG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689732, "uuid": "94d5c14d-b538-4bc6-b59a-8b994dedcbe9", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689732, "uuid": "ae7cb210-178a-4baa-8236-93364ab0fa69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689732, "uuid": "a4c36f21-9573-48c4-bdb9-9bb06ba86ba3", "value": "Zqlagegnqte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d9c4738-40af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692683323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683323, "uuid": "5e20052f-e9a5-472c-bf8f-5bff60243a7d", "comment": "Malware payload (AgentTesla)", "value": "61c51f2d006fee89f3710be7f2547958", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683323, "uuid": "0acf387e-94ab-476e-97d4-f6cf3d82ebd1", "comment": "Malware payload (AgentTesla)", "value": "ec868de79b6632d53b24fba0def032edd54081b95f78cb32f11b32f92a6fde7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683323, "uuid": "cbdc3ff0-57ad-4762-a03a-00c4c06a5bd9", "comment": "Malware payload (AgentTesla)", "value": "f265ad110f44040f50e0ba561512bd9049365d6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692683323, "uuid": "83eb2809-75cb-449f-acb7-72e54022f545", "comment": "Malware payload (AgentTesla)", "value": "bbb948b99498464487cddd276f5d5c781a5b877f80423260f9ef55b8fba0d1f395df5e3b07ee571f96b156cf08d51b5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683323, "uuid": "1d186d06-2698-4b0f-8d27-d2adc9cab330", "value": "T118C412189787FF69C47E4B7D8B22A45093F1F247E325EB8B6FC160D965A2B408B81533", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683323, "uuid": "53c55821-30e7-45df-b934-f49177700e49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683323, "uuid": "7579f18d-378a-46ea-849f-dcb0036603d8", "value": "12288:VadlVpobcP8hl98xvk9UPHEOlQzH5xqqf+xDdZiz5O5+70pKXQl2FN:VU6Qkhl98xvGUPO9f+Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692683323, "uuid": "6ff19a21-754d-4d84-ae6f-5756ef4aa369", "value": 566272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692683323, "uuid": "81b04e58-3108-44dd-a116-f025b796b76a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692683323, "uuid": "cbc95360-9a9b-4ce8-b71a-29c3f45978bf", "value": "N6k8HD7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3bb1c12-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690661, "uuid": "533f3e04-3b75-427b-a76d-f35040f1fd17", "comment": "Malware payload", "value": "dbec999d74f3404fc69b9ca7d0272a10", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690661, "uuid": "8ddc99c7-36b4-4354-be8f-b64988eeb8cf", "comment": "Malware payload", "value": "ed1fdc9d3716025445ea3f2ba6e7f223771c60333e77c7b04a7d2059bf045f53", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690661, "uuid": "0f95df53-de48-4da6-8335-e096c4b27f28", "comment": "Malware payload", "value": "8cd48144d864728b9ee382509e7eef245000e7ff", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690661, "uuid": "fb39b88f-db85-4a0e-99b6-1a56c434426b", "comment": "Malware payload", "value": "89466b8158d3d73c9fb919a407f9444053d1db2480e6856b5d83e533e3903031a8d24cc6938a70f8de29b71603d076ed", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690661, "uuid": "7a0eb8d9-8b78-40c4-98d5-7ba21b5a9785", "value": "T1A8A4126F3FCBD478DB076036900084A6971EB0A4B157116F5BEDAA9A0C70DDC1B99DCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690661, "uuid": "ff827991-39a6-4566-8ccd-9cca22221722", "value": "12288:98QlP+9NW32j29pBucycBSvwznel8YGbQnheHhHP:98YSjyFBSIztQnhkhHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690661, "uuid": "b0f02ce9-3817-4e7b-82a9-1ea9d185a258", "value": 456251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690661, "uuid": "a703662a-2c3b-4eaf-9ee4-007984248346", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690661, "uuid": "e3b27f85-249c-4cac-96f8-c01abf77d011", "value": "Invoice no17684.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226244d7-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690444, "uuid": "102daccf-1e8a-4559-8b75-cbbc273dbaff", "comment": "Malware payload (AgentTesla)", "value": "d0596e13e39e62d461da77d1c0b2be67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690444, "uuid": "0b1e56c4-5d84-4088-903b-6542aa704de4", "comment": "Malware payload (AgentTesla)", "value": "ed51a8f4dbf107d4fc9a3d91d8f5876a263fb70ee91d5acca02702de8aac01f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690444, "uuid": "ecbd3e16-dd18-4e78-9ea6-9cbc4c0d2507", "comment": "Malware payload (AgentTesla)", "value": "4de0a85dd5b3be04fc24274b35e15a64c83150da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690444, "uuid": "ffba465a-89a5-4b73-a3a9-7a29de545c9e", "comment": "Malware payload (AgentTesla)", "value": "5bd2cc979fbacf545fbe6c5cae1ddac8804df232d3dc42e169cdd45daf643176ad0d31cdc506662957338faf7a7c2b7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690444, "uuid": "711ec0c8-b25c-467f-a263-5bd0821de696", "value": "T1AEF4D01223B8871AE2BE47FAD5704CA487BEBD17E956E31E0C8038ED2572712DB0556F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690444, "uuid": "fe61ab7d-5ee5-4965-a9cc-f64a62b2765c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690444, "uuid": "d7f2c4e6-fe1e-4810-90ba-ec83e5b5f5b5", "value": "12288:LUVv25w+cR7AA5x2d1mbTV2t7Qb9hUM6We313lX0PZSBCITuscTlZth3mWES+GN:LdcFW7Qb/UM83XX0gBCITqzth3mI+GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690444, "uuid": "b2e1f92d-2888-4efe-af18-b29c9cc6a63b", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690444, "uuid": "ed8b581b-de91-4ab6-8883-26c1458d1381", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690444, "uuid": "483a3739-fb38-41f0-a1af-a22e45898d4b", "value": "DHL BL_4788200.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f1c281-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692715818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715818, "uuid": "61994ecc-4435-4bd3-878d-5f810f8dc08a", "comment": "Malware payload (AgentTesla)", "value": "fcf7e4a2c2e1487044dfbc692311dd35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715818, "uuid": "cbb0967a-12f1-4934-a589-07976b0356b4", "comment": "Malware payload (AgentTesla)", "value": "ed64e918ae9e3d4c498cb65c63d2e0d2164d6cbfe132d2143384c65c7252bfec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715818, "uuid": "b098d04e-37ad-4f9a-ae0d-e00230d68bb5", "comment": "Malware payload (AgentTesla)", "value": "f6162e802e5686f06c951029ea13b455f4c39d9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715818, "uuid": "4af5517f-77f4-4a53-8c3a-40575d492949", "comment": "Malware payload (AgentTesla)", "value": "6864a7c7bf8d62f129145f98c09118b97bb1833ce15a3c7a6525a4b41096934dd541d42d7267aa0225b0cbe791a5a893", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715818, "uuid": "8006d35b-73a7-4a5c-b421-498477ab571e", "value": "T1C5B2E16C342E31A7C6B2994D0AEE1D316D4058BF9EF4FF582D31090FACED4968FA4418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715818, "uuid": "d3411024-7160-447d-818c-5ee6adc34338", "value": "384:JOIr0azRdS4j1NkL1knqpuB1QkKXSddG/Zker8VN208ywb8jscVj4r1+8fzAwWTD:J/wa+45NCp/ksSWrsrwb8BFt8fEXpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715818, "uuid": "c0f6aa61-fd77-464a-84a3-53087dc47fa3", "value": 24747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715818, "uuid": "7b3d8ff1-a606-45da-9049-810df6c22eca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715818, "uuid": "7a0ccab6-d80f-473d-bf2f-06f1cda486b9", "value": "nxB7PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434db854-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692715840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715840, "uuid": "d748d273-3680-4202-a211-cbfff998b087", "comment": "Malware payload (AgentTesla)", "value": "48763155ecb4bc6e86492a17ad92a798", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715840, "uuid": "de07b5f3-b228-4410-858e-2efc01c12a08", "comment": "Malware payload (AgentTesla)", "value": "edf6c2e805b1b232065ff74c1c2b8c8da24147c9ef17175547ec5fb905005cf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715840, "uuid": "436ccc1a-dcb3-4d8e-b3a2-974d1c71862f", "comment": "Malware payload (AgentTesla)", "value": "0e601363e00c8fd7a9fc7a93e689d36d3b5008fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715840, "uuid": "a2c0554e-39d1-48ec-a54f-e2cb064c65e4", "comment": "Malware payload (AgentTesla)", "value": "743697dc3661473abbfa8124f743020aef0c9c371498106cadb9cccba48d0ce336fe16182d5d8f818a2590dc0d499474", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715840, "uuid": "77051684-77e0-4869-bc30-6393157a1873", "value": "T111E4DF24A3BB4B55C87B93F53F51120C07BEA55A23FBD2647FC1A5DA5521B808A0AF33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715840, "uuid": "ea72bdf8-fdfb-4629-b414-452748889577", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715840, "uuid": "363930a0-1229-453f-bbe4-6ec0c8ac65f8", "value": "12288:c570Eww2d1mbT6o22B0vUYmXsfMG8tae766R3TnuG9tUiWjndZp:y0Ew0672m8bskGS773reTjnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715840, "uuid": "ecf09a30-687b-4c80-ac1d-e91f0fb9b026", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715840, "uuid": "ef489791-75eb-44d5-ae94-7554de4b725c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715840, "uuid": "74358d40-82eb-4651-91ff-353de3c96967", "value": "rNO10865687X54-Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67605ffe-410b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1692722772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722772, "uuid": "3c5765b2-d626-4165-9d0c-52d860d1b2dd", "comment": "Malware payload (Smoke Loader)", "value": "5c50433f2ad2596e8a22097210a8e2a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722772, "uuid": "ef8d0235-afc1-4adf-b5db-b08aac5ba907", "comment": "Malware payload (Smoke Loader)", "value": "ee63da071d702cc7795ae65b1305fdb53a772a8908ccb82bd7735358a23be5d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722772, "uuid": "38def6be-d838-4a41-a0eb-5948fdcd58ce", "comment": "Malware payload (Smoke Loader)", "value": "efad1a0268ddbb72645d6dd0ea2dd1c8d769bb41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692722772, "uuid": "ac6a7a68-7d27-44b1-b67d-bfce5c47e913", "comment": "Malware payload (Smoke Loader)", "value": "b0ea568e7b6f3ff45adbe861a8d05c0b22824576e91e489d09a67f109e34c7a2faefdc9389e7c5918230de214d1a97dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722772, "uuid": "e20f59a7-b138-48f7-bc24-090a7b176d2c", "value": "T11844BE22F395E432E5138A308E6AC6F56B2EB8714FA566CB23945B3F0E705E1CB35305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722772, "uuid": "967b0137-c0f4-480a-8951-847b66b78dd8", "value": "5e8c790316167009ad79ab4dba19f7fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722772, "uuid": "6a8f3950-bdef-4ad5-898a-90113b7074c6", "value": "3072:5aaHTwJsefYlzwq92t97b78P6goLvYUEP0J4+pnVnSlxrI0havJy1arY:5BkBfTqUPcP65kU2+93SlRI0havg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692722772, "uuid": "557e1783-fc2e-4ca8-b5fd-c9140e1e2568", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692722772, "uuid": "c8c35bb2-79b1-4821-bf0e-99b147a3ab03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692722772, "uuid": "d0b6c727-15a6-43a5-bdae-d293ef22e8de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce53365-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690543, "uuid": "3bdc1e09-687c-47fc-a8f1-ed7101b17781", "comment": "Malware payload (AgentTesla)", "value": "d918cf4a2872221c375bb01f80a085a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690543, "uuid": "e7a72840-b1b9-490c-8743-e62f62f114e4", "comment": "Malware payload (AgentTesla)", "value": "ee6bfabb37ffee5c31e1de467a9b816d5d079d3867c107c7f16753c61dfc86ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690543, "uuid": "bed358cf-c5e0-482d-9651-c0fb0b1d8bd2", "comment": "Malware payload (AgentTesla)", "value": "838ca5085e92f1ea882d8c46c69cf30e80f8d7de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690543, "uuid": "cc141abe-bc1f-40ba-b86c-96dab92acf04", "comment": "Malware payload (AgentTesla)", "value": "85afe8a93e9466b8e7f47e3929820cb92ca0dcd69550d1aa5d851390147037c3d5c3c07887611afe13cd7a2af0af3f66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Akbank", "colour": "#36752F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690543, "uuid": "0dac8f8d-1a07-4f75-8ae3-d3ff38ff665d", "value": "T1418423610BB1C95BC1D24A722DB69F378FBF9C0528E91B5727203D5B7C317C8930AAA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690543, "uuid": "3fd288bb-bb72-41c5-bce1-9131da8ad8cb", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690543, "uuid": "917dd86e-ff0d-4f2b-bfc0-31846ebfad75", "value": "6144:AQ606xib8OdFX5zwlZ5+iRYpKb7DiDFY7TEUg9EjAPablFLrnWUvimjsw2EMKedL:zb8Op05+iapg7gY77XrLrnPsAevx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690543, "uuid": "cfd9069e-b337-4fec-8129-12f7c81c24f6", "value": 375088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690543, "uuid": "34aef7f3-ba6e-4927-ad66-e56185c1d5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690543, "uuid": "16b20710-274b-4e36-bf75-29a83e83abd5", "value": "Akbank Hesap \u00d6zetiniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ea509b-4132-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692739754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739754, "uuid": "8e1cf1a0-7e20-4632-b19a-83ab78dff808", "comment": "Malware payload", "value": "5a54de0db43a7512621f0bf10f1c463a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739754, "uuid": "cba9f7f4-e105-44cb-9990-c2ae67bc8b05", "comment": "Malware payload", "value": "eef2be5347236331ecd365bdf33ef868b6518beb7ae94074be56f955d2a951d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739754, "uuid": "8e0257f9-bcf2-4150-8d25-0b88ca4288a6", "comment": "Malware payload", "value": "275e8cb6734e4cadafd6648188ef906e5a096940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739754, "uuid": "8ca7a5f5-ab64-4c6a-aa67-86df3251e207", "comment": "Malware payload", "value": "56edc3a941b3cb3476693513a752b6285adb53137d13ab287dcc59e59cefefa2802a27b19a328940843d27bd8fb2a540", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739754, "uuid": "3b2ccb1d-d4a3-43dd-a8a5-3afe14f7d702", "value": "T11BA49B3A15F44257F2C115B8BFF04B972E29F4228A917E9EC14442961E53FBCF96838B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739754, "uuid": "3aba82a0-d519-43be-8fbd-62e6d10268ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739754, "uuid": "47d2bd36-f7fb-41f4-8581-756023130fb6", "value": "12288:0kTSlFW78BJRhCiPVdBK7NAuFH4f5rF5H2:0PO8BLhdVdc7X2fd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692739754, "uuid": "adb06365-bf00-492c-9c1e-400f2f300e29", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692739754, "uuid": "dc4380f9-2315-49da-b365-4f4df4179c47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739754, "uuid": "6afa13a2-d5a3-4d30-bbae-6c49ac211563", "value": "SecuriteInfo.com.Trojan.MulDropNET.43.26325.8374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a8adf0-40df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692704066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704066, "uuid": "c19ebc15-6cbf-4e52-9bf6-ffaa5286b46a", "comment": "Malware payload (RedLineStealer)", "value": "6faf0efc2d1d833554058bfe16e534bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704066, "uuid": "14c06911-c632-4f0b-9480-2948b9831d62", "comment": "Malware payload (RedLineStealer)", "value": "ef18e6f222c2c09b7fe21e19ddf9533510deae77e51e63d3c24a9f46e8701c82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704066, "uuid": "cc74a056-3dbe-4e81-9b05-c724dad62fda", "comment": "Malware payload (RedLineStealer)", "value": "8efab38424c559f99b12e247b49beb312aaa15c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692704066, "uuid": "2da82fac-74c7-4dda-9fb5-079552f40a63", "comment": "Malware payload (RedLineStealer)", "value": "d80be29b706d2fa8d3f03de5a231019e6e15da5b6a8e4ef011acc071a3280def5c1d94b8a1fd67c1eefc7d3d7c97bb2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704066, "uuid": "ae9245af-bf0b-4085-97d6-b17a8d368930", "value": "T136857C2D7883B129EDE22CBF46EC7425765EA0A0071AC5CB37DC02EED6686D13BF5185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704066, "uuid": "a9809a35-8b31-4ab0-9ed9-9e1e3177e2a4", "value": "7ca28186d68c9a22a0e816e570aac96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704066, "uuid": "256bb592-2eac-4e6c-b3cd-fa8bc597339a", "value": "24576:0dwvYOaxjN9cDw1eOxrV/JGzl103IIbcQb:0dvxjN9cDceaJOl103vd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692704066, "uuid": "73f8c17f-fd3f-4dad-b005-aab55faec2dc", "value": 1711616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692704066, "uuid": "e2bd284f-ddef-41b2-8e9e-d7a422027def", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692704066, "uuid": "e3d13261-9d4a-45f3-be2d-4c70e30df8f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e5779f-412d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692737405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "32fc95d4-69d0-497b-a4a1-b44675a9c199", "comment": "Malware payload (Mirai)", "value": "73d0275a258a66989a8ad814182d25df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "5079bd49-186f-4cad-a328-31ebf7eff987", "comment": "Malware payload (Mirai)", "value": "ef4da0487969b7fdf6e95eb1a6ed858b9122669b38679e6bce4046fa94340e44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "2866e6f2-a7b8-43d8-99a0-cbeda3116bd4", "comment": "Malware payload (Mirai)", "value": "942c4c01592775fd57954b71f75c31c518e1d912", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692737405, "uuid": "8d2d926b-d3d7-4846-8dee-a1aebbe904b0", "comment": "Malware payload (Mirai)", "value": "06d9b694dc5c9b9d03b1f4d628ecf102c4bc82dd2af37de26077e479d0031df3acb37b9d14ecec15c9894192c5649809", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737405, "uuid": "8f4b6c0d-6437-4953-9753-bfd5bba6d197", "value": "T10333026267AD2DE291B09773FC32BC5AA69C16FC98A7309A2CF4691577C48014FF2781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737405, "uuid": "3893d590-41b7-4e21-ae42-c27643493ef6", "value": "1536:j9O/ZMAXIxNUk00epLcPqF1aBexo4opKZb2:j9O/ZNKyQepLGqFUFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692737405, "uuid": "e448eef5-8f9f-4189-ab68-cf2f1e2a9f93", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692737405, "uuid": "f008a1d9-bfe7-4c5a-83b6-9aa0de409011", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692737405, "uuid": "1b96d469-ce20-4af6-939f-544c561b1774", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efd5fc3-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1692689741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689741, "uuid": "e4901980-2cb3-4f41-bcd2-433806e981b6", "comment": "Malware payload (SnakeKeylogger)", "value": "9a9100bb44845bdca0f6f2c7fcd09c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689741, "uuid": "eb056cf9-ef13-4516-ae8d-c3282499a2a0", "comment": "Malware payload (SnakeKeylogger)", "value": "efae2917baa8189a375577739cd5d6bf9b759ff81fe27b779dfa6b0d53eecea3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689741, "uuid": "0b8cd174-a3b2-4173-a6ab-076fac59a773", "comment": "Malware payload (SnakeKeylogger)", "value": "da89801f49adaa1f864ba8ddb0c7526d1d5d81fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689741, "uuid": "71d080b8-e6f6-45a0-9f2a-2d69fef71478", "comment": "Malware payload (SnakeKeylogger)", "value": "d79e6b183ef2fad3a27eb2d257036c5c757d997c5556c1a715c1dbff12b03a7e1bcbbe0d1f9bfa725b7ed9a3e8e1516b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689741, "uuid": "2196119f-f790-4d1d-a0bf-c13bb8e834f6", "value": "T12F94DF7B77E89622D5B7A3F9E021624003B3E05A1831D7894D8EA4E11AF3BD6C7157C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689741, "uuid": "1327bb45-5847-439e-891d-f487577d7a46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689741, "uuid": "00649e2e-8631-4c04-a27d-b64e48a32b55", "value": "12288:VId24YQIrcxfY/5jfC4EONn0zFQUOrBN:VTYIwBY/5TNnWQUOrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689741, "uuid": "1c0dbd7e-6b42-4d60-9037-285f16d60ba4", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689741, "uuid": "a7299f1f-9e72-46fa-9bf6-e90a0a4b5715", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689741, "uuid": "e5ee9317-69b5-4667-9da9-271714170148", "value": "shk098654578.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9d8329-4121-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1692732316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732316, "uuid": "ecce112e-0eb7-4d43-9cc2-0562b79f161e", "comment": "Malware payload (Stealc)", "value": "39dbdf87df9585b78268ae1637fa971b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732316, "uuid": "6b979a0f-d9c4-45f8-bc2d-dfbe70588c2c", "comment": "Malware payload (Stealc)", "value": "efe76e209a9575bc73aa11a6c35be706087fdc696645821c5959a4f445540e3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732316, "uuid": "4c7a42e7-8921-4204-b25b-d1e7c62062f1", "comment": "Malware payload (Stealc)", "value": "257d1c8d30825243e592f6e7ac29f3c8d747562f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732316, "uuid": "6635f379-1aa2-4405-8786-8e67f1570957", "comment": "Malware payload (Stealc)", "value": "898e0d95e75df5908244fd9dfce37d195bd7e76a6a8074e5f7eda06411d3a9bc245d9387fce8acfd2671580e946a1283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732316, "uuid": "64e84d6c-bb4c-470d-95dc-e649c99f344c", "value": "T1B744BF22B3D4A472E51386718E66C7F46A6EF8614F95BADB23945B3F0EB01E2C731305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732316, "uuid": "405f575d-a815-49b1-a6e2-0e6b75bcb0f7", "value": "5e8c790316167009ad79ab4dba19f7fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732316, "uuid": "e17a2532-274c-421b-a4b4-95388681c4c1", "value": "6144:/NFs7qKiHnohI7aBtWpavmd1pGIQ/lfrW:/NGWFHnojjzve1pGIc1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692732316, "uuid": "aa26d987-d296-4c0d-b754-0960521185af", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692732316, "uuid": "4b898d17-c567-4fb5-a970-aee29f33a4dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732316, "uuid": "7c03062a-8df9-4b4a-9d1d-81a0c4dd9796", "value": "39dbdf87df9585b78268ae1637fa971b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbe68a0-4111-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692725332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725332, "uuid": "e5fe40fe-3f1b-4bfa-baa0-4523912882d0", "comment": "Malware payload", "value": "6e855eee419ccc1f8d29c6539f5e65e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725332, "uuid": "942ec284-6544-4615-b471-e679f8af5fbe", "comment": "Malware payload", "value": "f082626175dbaf779b1ccd5af8f95bc0b92661cebe329928340c22b60c855f07", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725332, "uuid": "65ec895e-45f7-415f-b83e-e2fc9784e86e", "comment": "Malware payload", "value": "f6cc3e98e581dde784b3aa5c44d394ba8e707ec5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692725332, "uuid": "b66eb88c-b62d-4400-b756-5fd37b5fc2be", "comment": "Malware payload", "value": "09ea7ed3cc3bb6ff95d96d95d3a5989648cbde9f7ab2d0e776958cdcd0fb063099b700e7f802f00f10107bd2f7ab1498", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725332, "uuid": "87b673fd-2caf-4ccc-9e38-83d8f3926222", "value": "T1B2066E23B785653FD16B1A3A5837A224993F7B723A1A8C17A7F00C5C8F395413E3A647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725332, "uuid": "5850ecbc-6480-44da-b0c1-9d91403d63fe", "value": "4c1c6850e14e1f8aaf17420d24b14304", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725332, "uuid": "dd7ca1b2-468a-47c6-9e05-99be29b30399", "value": "49152:j7ulvzUYldRFAp8/FUSUWVErm2ks97bOZqB:j7YpdbAiEpBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692725332, "uuid": "329e3b05-84a8-4464-9f32-c0f1762c5c07", "value": 3909120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692725332, "uuid": "c9349380-4060-44f8-b9e0-fe4beb73a15a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692725332, "uuid": "956fbf63-3538-4e91-991c-3f100685e13e", "value": "SecuriteInfo.com.Variant.Zusy.481137.18119.30324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b0fab8-4133-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692740191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740191, "uuid": "4fb9dedd-3d64-4144-b828-e0ae2e01dc6d", "comment": "Malware payload", "value": "4f6c4e195a6a221ec1f9a4d5a1c70c2c", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740191, "uuid": "a4b2733c-4166-491d-9cf3-21bbc8590114", "comment": "Malware payload", "value": "f0f4e02abd2588a34a14b26c678e099bf2fc19638124ea7508d093cda7b07bef", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740191, "uuid": "0c74b9bf-d1a1-4970-bcce-3ea61cb3b5aa", "comment": "Malware payload", "value": "6b45a075aaa97dcadf55229154a060e81fa285fc", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692740191, "uuid": "eb4ba2ef-1ec1-4926-b148-79b9fb144756", "comment": "Malware payload", "value": "dbe969ea869ddfa350115c21051e9729cf63d27471b82c9e6265cc461f72e0d3277948570d378431c7b36c8d5d479498", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692740191, "uuid": "5a18fb34-8098-424c-b8b4-6b354aa91dd0", "value": "T159F05C87EE439754C16B0168F8E5E08CE4CE5245B5C394EC76D6738D5201AC8198A561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692740191, "uuid": "e233e8a1-ed31-4c05-8d8c-f37566c095cc", "value": "12:/eCxyDBPEOtKumY2xekn/tSzjAOwdNwjAOwdpd3zb:WCxkBslup2xekMjrNjri3zb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692740191, "uuid": "42cf7a19-d4fd-4998-be65-9546782be247", "value": 444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692740191, "uuid": "99e82081-211a-4e88-8156-3c587793f682", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692740191, "uuid": "18bfbe9f-209b-4fab-8625-7a229c4bc91e", "value": "202340775751MessageGlobalfoundries_.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "568c2cf5-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738636, "uuid": "aef5845a-f44d-49ca-bd59-57cc7297d6d5", "comment": "Malware payload (Mirai)", "value": "8f2832375c1a577adac9440e295222ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738636, "uuid": "ddf171a0-6b1d-414d-ac33-b8a36637b091", "comment": "Malware payload (Mirai)", "value": "f101047ad37a873373200f4086a7d6f567685a773b060032b507d36135c590b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738636, "uuid": "dc1110e4-4e18-4274-bc9a-4434e2f0b1c6", "comment": "Malware payload (Mirai)", "value": "4e9b48ac01aa1dcf3ed6b815cf3a09efb2e34956", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738636, "uuid": "95e37458-01f8-49bb-92fd-0eaae74c424d", "comment": "Malware payload (Mirai)", "value": "b9047e986f15672efb8579129fec4d24622f5d93bcfcc1a41fd6ad917f901c4547a63ca6dcf210d0b451ac786616e180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738636, "uuid": "a20c4a68-9803-4872-be6b-43016626082c", "value": "T1FF330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2767BBFDA36C721945E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738636, "uuid": "ec622437-e79e-4457-91bf-d123060d0cda", "value": "768:gduPBFnHooqR8qOCKq2cH4Kg9e+TK806MMUVjzkfQXObHud2oGo:r/hqaJMDg9eqK806MHdkfQX6HuCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738636, "uuid": "97c36b49-f2da-493b-a57f-2cf0f03521e4", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738636, "uuid": "fe92452c-5f65-4f36-846b-028180af6ed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738636, "uuid": "4d4145de-44a4-43cc-b04a-837e3623c866", "value": "8f2832375c1a577adac9440e295222ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02a3345e-4084-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1692664621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664621, "uuid": "36138ddb-c580-4a21-bf59-04113635f177", "comment": "Malware payload (Amadey)", "value": "5272c348a3b101e11e893b524e030c9f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664621, "uuid": "4d59031f-2a46-4ae7-bba3-ea31499b8542", "comment": "Malware payload (Amadey)", "value": "f125060854dbd716450ed211f1bb04e10ffa8af98bc3e77d53ddae8a9999911c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664621, "uuid": "e1630cdd-42a2-483d-8c51-a22a85e8ba66", "comment": "Malware payload (Amadey)", "value": "62b9901f7b646b7f7e5df3d493b3f2a8ef00a622", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692664621, "uuid": "1cd2b4fe-bfda-4508-bcd8-91a5a3961b17", "comment": "Malware payload (Amadey)", "value": "94f8c997da82b0baee6746f5bc2c0c1be0cd2ba6ecb9fdcd969000572d2a3c647683bf354c627b168fe732d64fdd8577", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664621, "uuid": "2fc0a9a8-cd81-4fa9-aa2a-bc0b3961a496", "value": "T15F0523A66BD48822D8750BB84DFB02431E79FCA19978C7BB7BC568169CF2580943173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664621, "uuid": "a2f42707-e7ad-45df-84b0-ec34d0b503de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664621, "uuid": "2aa813dd-2d10-4754-af39-232b10432e7a", "value": "12288:qMray90HoWmiJk2UPv9xv2cBwb3uEmMld4d77btPC9E/KsftYhuJoeS2b9eVlt:sygBjEF4PeBMlynPC9E/KgLJoq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692664621, "uuid": "b8419835-e642-4757-ae37-a31949cb9a33", "value": 857600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692664621, "uuid": "dab5c841-d641-4dbe-88b5-238ecbdf24b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692664621, "uuid": "d7d8299d-3b47-48a2-8887-023b7e3318f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9f391e-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692690489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690489, "uuid": "8fecffaa-9419-495d-b615-4c0af8791f06", "comment": "Malware payload", "value": "51c1004c5ccd5fef11366a75bcd5abdb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690489, "uuid": "926f7110-35e5-4fe8-9829-a9c388cbdb8f", "comment": "Malware payload", "value": "f17d3309b0b8e90f4297a947f0f20ec337d19d2078ad3034ed31117cefd0473e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690489, "uuid": "f00dfa9e-9e95-47d9-9dd7-362828a2065b", "comment": "Malware payload", "value": "e6c3aa66452527fe23ca925d33117d96c4579af8", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690489, "uuid": "12420f60-3124-4c25-a0f1-14f92e7d8563", "comment": "Malware payload", "value": "c7225f6fcc7ce2c21a9b6beb167168777b5b449168b30186cea904a1d041b08b3cbd6e59fe980e4db2ddb7b0b1148a71", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690489, "uuid": "c2c1327d-1bb7-47f7-85ca-ede7c56d9afa", "value": "T1B1F423B56F6DE20EED73A9DBCF31146C4D2F7B28C5108F222BBD894446805994C4B8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690489, "uuid": "2f271ab9-b124-489d-a401-4e8b20c8f180", "value": "12288:bvQcQ18DcOF8zFnuUMVlIGwv6b/SCkF9zOr90LVteW+58/aU+Pvp1twNfkt400UJ:bvQbaDFF8A6GwZCkqOx4ltyyGkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690489, "uuid": "0f4707eb-a1ba-43ca-9d52-66732e556980", "value": 755901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690489, "uuid": "6d42f13d-a41a-4f8f-855a-8bb9b59e597e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690489, "uuid": "5c251074-fbe7-46b8-9ee9-3e77787d08d9", "value": "Purchase Order.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47251578-40ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (STRRAT)", "timestamp": 1692681916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681916, "uuid": "2196faf2-25d3-47ce-96d7-08fbdd6c1450", "comment": "Malware payload (STRRAT)", "value": "1284310f32406ae896b2c0069ef9f15d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681916, "uuid": "9337039c-e619-4b03-92f0-4968abe20d0e", "comment": "Malware payload (STRRAT)", "value": "f1b6311148d4e7ece3cb5462957893270ff76878c2b1ab0fd56974f221faad09", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681916, "uuid": "349fe7f4-38b0-4586-aff2-1bb64eb515e0", "comment": "Malware payload (STRRAT)", "value": "02e04b8f8df6311fc93163b76f34baeeeaaee6f3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692681916, "uuid": "21ab5d91-16e5-4e71-ad4e-3ec15e6570d2", "comment": "Malware payload (STRRAT)", "value": "36d5d488092b2697123397cba7cb586acd2e1622f2d4b7d8618352b40ef8730339355c416988e4305da4581a66bd3a4f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681916, "uuid": "dc22cf5f-3de3-44ff-94c5-b4f1e6d28b5d", "value": "T16763F1F13BF6A3A5F117C4F4ED007E26B08941EB968FD59290BE008C291495E5F1BCEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681916, "uuid": "133515b2-59db-43dc-b8ff-6707b39d3c92", "value": "1536:EL2KKRyjeXlwtYKjlyRSTu0mBlBu9yUFey3VMxTU1ZVJ1:pKKEj8w+KjlWGhpTFeWKxTULV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692681916, "uuid": "1e8d1819-6996-426e-a4ed-bf78dd5d8d69", "value": 69680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692681916, "uuid": "39089631-4c37-4a72-8a60-50be1cca33dc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692681916, "uuid": "ccc77f59-bbd3-4311-8aa6-2d8686ce7bf0", "value": "SOA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594d75a6-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692714588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714588, "uuid": "6ce40863-1323-4fa3-bb0c-a672ca4f260e", "comment": "Malware payload (AgentTesla)", "value": "3232348d8f9aa98c80011580ae8d7c43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714588, "uuid": "d27d2747-0e51-48e2-9584-3161c5614599", "comment": "Malware payload (AgentTesla)", "value": "f2ae9306a48f1b446ce9467300267b864e8efe3f9e3b3d01da8bb89133140613", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714588, "uuid": "dc611918-76f3-4c85-8ca7-1306fe0e814a", "comment": "Malware payload (AgentTesla)", "value": "f7887c6ea74e9d435ea8a7764fca67cf388e7477", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714588, "uuid": "ad5e3a84-7b35-476e-a413-2541443635c4", "comment": "Malware payload (AgentTesla)", "value": "257cf819e3894c8e8dec015789410d3af81240a20bcd614b6fee5ce829a37e8d18dcc883d1af2faf289698a0dc46793d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714588, "uuid": "6ff6f99c-907e-4d53-a38e-a65312661c8f", "value": "T12015E021A3B75B44C97E93F53F51220C0BBE655927FFD2207EC5A0DA6971B804A1AE33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714588, "uuid": "ffab93b8-ef20-4244-a9c8-1f27927a3fd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714588, "uuid": "d8e06402-62c0-4f3a-a23e-e1b76d61a4c6", "value": "12288:H51qEww2d1mbTi5f6iB1YaZGMLxyAdLdE57Ry8iHs+t8PgaDZsoEJh3Y1EmXxDPJ:jqEw0CCiBDd6zBO8omiDotP1oMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714588, "uuid": "721c450b-1446-45d7-a965-c960fc6230cd", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714588, "uuid": "01cde692-70ab-4107-a1ca-5e0014daa0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714588, "uuid": "e324667b-fc58-4772-8fb3-5483bdd16d03", "value": "SecuriteInfo.com.Trojan.PackedNET.2293.5759.25234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25c3e9b-4122-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692732777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732777, "uuid": "29a0ea23-7f3a-49a4-9fbf-fa0bb67d6128", "comment": "Malware payload", "value": "dbcfb0b2f162ef601e1b63a7c1679aa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732777, "uuid": "295d3e0a-3ee3-4461-ab3c-f9f299067ce6", "comment": "Malware payload", "value": "f469e6fb7a1d2dcb9762cd7d734b28f0c2fb73f22475977daa748290d9475700", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732777, "uuid": "69c14a2a-025f-49ec-8af2-926b6e1925b9", "comment": "Malware payload", "value": "2039bde04fbb32e9a1d96e222f02f924cf9cf9dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692732777, "uuid": "ec70d091-39ed-460f-aa20-3672cd31724c", "comment": "Malware payload", "value": "c2ced464a0d90b64f84eea08654401ca3fec870646ec31ea394c2b472e2ed6c344fff8192bc5351e097caa3ea227b8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732777, "uuid": "b4bde195-0cd8-4878-b048-08ea5b1239ae", "value": "T1BC25F70473F8411BE6FF9E7CADB1522456B2B9576901F75D188AF89C29323C28A44FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732777, "uuid": "eb353bc2-fb55-49bc-b961-ce505c542b84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732777, "uuid": "3d605b9c-dc95-4045-a874-a6b5f3a5cfdd", "value": "768:Xkh9iSxxPJqs7evJF6Nu02dYGHnd8G1FZ0CLrLH8NKoThWA5k/Dhmx/znE60:XHSxx4sKvJF6ZEv9Rb02QW+kbCnE60", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692732777, "uuid": "905823a1-761e-40b9-b612-f84e12f63c88", "value": 1000456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692732777, "uuid": "94e341ad-6a4d-4f6b-9a10-baf3b690521f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692732777, "uuid": "0cfc6543-8c36-4d99-aad0-5c59450849a0", "value": "abbf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8054c123-40c7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (TeamBot)", "timestamp": 1692693609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693609, "uuid": "7f61b96a-2704-4c46-9987-b97c467de890", "comment": "Malware payload (TeamBot)", "value": "5415b736f57475379713bcbe719b569c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693609, "uuid": "a8858d2c-2d59-42c6-9777-6420ee5afe4d", "comment": "Malware payload (TeamBot)", "value": "f4a3a4834d6fe97a416df052d5169abce0259eec39bdc411580d38fd154d89e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693609, "uuid": "bf001b46-dde4-4fe1-b22c-b19993afac42", "comment": "Malware payload (TeamBot)", "value": "8479f395b586d2c2c4129b590e83c40ed5c5773d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692693609, "uuid": "48d95555-fa8b-4a97-ae96-1897701decf9", "comment": "Malware payload (TeamBot)", "value": "75a829100600ee8b87be5fe3bf649ccd2f8de4efd24eb37cbdea1ea318e2ce9cfb122b9df335a3be4e35260f7bcfeea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693609, "uuid": "44481f07-f659-4a53-8e8c-b5917d8ed966", "value": "T13844BF12A7D49432F12386318F69C3B4572FF8716FA5AADB27845A3F4D712E2CAB5301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693609, "uuid": "787405b6-1505-4dff-b85a-f412838b612a", "value": "e2432ef21843616ddefcfdd02654b31e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693609, "uuid": "b4ab34b0-e57a-4bf6-9af6-89c1f03cbba1", "value": "6144:8lfEAiMKO2U2S08y6ZF8qX9kk6pqvybg:8lcA/HfL0dTqekM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692693609, "uuid": "f6a4eac2-c0dc-489b-afb9-85e3b408dd39", "value": 260608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692693609, "uuid": "26d2f56c-45aa-4f63-87a4-b1ce15b0b037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692693609, "uuid": "a3a478d4-faf9-478a-be75-9ad8cf22dc9e", "value": "5415b736f57475379713bcbe719b569c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d34ae46c-4115-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692727249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727249, "uuid": "0a03e570-eba0-4538-a81f-9ad9ec57d45d", "comment": "Malware payload (Mirai)", "value": "6d84830b393806fc450b53c56ab46ef6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727249, "uuid": "05460d4b-8409-48bf-9317-0192c7eed3f1", "comment": "Malware payload (Mirai)", "value": "f4e92ed8063ca5d44bbe0f809ad58fdfc26eb8316aeabc1e590af024e0736ca1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727249, "uuid": "517c97ff-7217-4210-9926-a5ee24d46e7d", "comment": "Malware payload (Mirai)", "value": "a96b98c25fcf8b916ba450d61bc78258a82df335", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692727249, "uuid": "c0360d7f-9e63-450d-ba4b-684b51516134", "comment": "Malware payload (Mirai)", "value": "399189dc2ffa4cdc3896364491f1a5fd39bdf035599b7b39c8cf42700f92b29275ff622f48c30908ec2750de2e2093b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727249, "uuid": "8c5e48cb-6f16-43ee-9096-41b5c5c99121", "value": "T108E2F1A7D3729052DE786AF1F9AD85CE6ABD0B6CD53730A31A1156243D490039E3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727249, "uuid": "4a0ec1f4-820a-433d-9b5c-d131818cf90a", "value": "768:koiWiO031vpAPbrVWZK3XVGxm9XBLuOS9q3UEL5I6:korm1vpALgUJB5HLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692727249, "uuid": "b3177c45-1573-4c7e-bc82-e6d6c37f0fda", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692727249, "uuid": "203896d3-d56b-4045-a2ef-2ba7bc374c7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692727249, "uuid": "c5fceaac-21dc-491f-815b-c1474bb81079", "value": "6d84830b393806fc450b53c56ab46ef6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c964263f-40c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692692872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692872, "uuid": "d9fac6fa-801f-43f5-91d0-afafae1f4775", "comment": "Malware payload", "value": "9870bf0016b1f67e7cf57a221131a80d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692872, "uuid": "8d88bbbb-fb3f-40d6-8d30-ee29cc3ba6fc", "comment": "Malware payload", "value": "f69fd03b940dbebd0d98a1c77fc689337b5f0355d29e86abb4dbb99ea5334891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692872, "uuid": "be6ca853-72bb-4f9b-9a3c-c1d896c010e3", "comment": "Malware payload", "value": "4ce23d3b04ad47c34514bdeef8bfd9d529ef2c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692692872, "uuid": "168b69ac-57cb-4189-a3b2-91f68e0a6917", "comment": "Malware payload", "value": "f3a2c2953eb8268c551f2576e646747b9479f4e4bb721082a36757133ddeaf9c590226a17f6099b94bb51ab88f923a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692872, "uuid": "42788022-6558-45ad-855c-4c9aca46a659", "value": "T16356339AC876073289664DBDB7A09E449B947868C9FC7D252783D9FD1D334C0EC3AE48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692872, "uuid": "6d1eeaf1-8bf9-4189-80f2-1d9dcb850bba", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692872, "uuid": "f2af0729-a884-4a05-b259-25fe7c6d8c62", "value": "98304:vmAo6Ex9Q83tZtpKpzYvnwMHfDUJV+GCKMAp+tr1DgXzqRyCYSbe7Izr7:/BgZ2pzYo+L6UdtxDvyCoY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692692872, "uuid": "aee109a3-4765-4913-a3c0-56609272fe3f", "value": 5911040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692692872, "uuid": "363e8472-16b7-4207-ad27-bfe35bc0c64d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692692872, "uuid": "74460521-580b-4f6a-bdff-56fbed42fd76", "value": "services.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17867d7b-413a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692742825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742825, "uuid": "49963d55-5ad8-4151-a400-b4941a946dc0", "comment": "Malware payload", "value": "69cc906e2a34643aadea76ae784a56bd", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742825, "uuid": "645de64c-5e71-4b02-9571-38f639d770d8", "comment": "Malware payload", "value": "f8409bd149ce4cce24496b99d5c171a28a993478ce74d671711e564a6cf4de72", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742825, "uuid": "25f37bd6-510e-424d-8119-d538cbeb77dd", "comment": "Malware payload", "value": "b02f894013f5d40007f1b9aff3920606b9331c85", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692742825, "uuid": "70a1b752-8e8e-4a52-8de3-7f804d7f7447", "comment": "Malware payload", "value": "284905461a6b9dd8a07b1b6b65c3b8e23910a55604edc042ae8847d76ffec1155fd0f5b3c99b538aa02c709bdc85212a", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742825, "uuid": "ac87b7fd-bebc-48fd-99a5-359b24c463b4", "value": "T1FA3184B56E036C2F079314C834F04BCD909BC38AEA5748AC36BE73E556CAC914CF5645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742825, "uuid": "53f4bbb1-d612-4da4-ada1-f5cd36229b32", "value": "48:B/QB9zNNVGMpU7IWV4mUqddEgGE33TeKGJ7sZUQ:B/Y3G/UW8qddEgGV9sZUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692742825, "uuid": "1dbcc172-5860-4b2a-8ab6-89d67bacb92b", "value": 1667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692742825, "uuid": "d96a4a79-56f1-4ae6-bc6d-fbef7c4528bf", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692742825, "uuid": "51597758-bb84-4cce-9cea-7273edd6fab0", "value": "-CREDIT 3363560720231526172-.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4470ad-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692715855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715855, "uuid": "2b16be5e-6870-4a3d-9d00-212ee13ad745", "comment": "Malware payload (AgentTesla)", "value": "d23927f84d0a3d696fdbff26a2759ce3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715855, "uuid": "2e47774b-a8bd-4fb2-909d-1dc953148900", "comment": "Malware payload (AgentTesla)", "value": "f8fdd68447ae1ddd8b6648a1f7c35677769ebc6e626d20b1361f68ee4f1b6897", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715855, "uuid": "768c863a-e80b-4d79-8fca-72cb74763c2d", "comment": "Malware payload (AgentTesla)", "value": "7f5a96fbba9189822e9267c5e1886883ae95bf4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715855, "uuid": "b30e552b-8696-48ea-bc88-86671c4bb80b", "comment": "Malware payload (AgentTesla)", "value": "beec39fc4325d65917ab3b1fd40f426d5cd0b3f99edb09ba5ef10625ae2d1fae9b7bce983780000adfccf18931c804a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715855, "uuid": "d70bb95d-b3d7-4b03-b58c-8a4800de26dc", "value": "T127641215B2E49CEBE5A14730AEF653529BF49D3A15BC930F1F803E08BA7A751981A331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715855, "uuid": "ff8b1a88-b268-423b-83fd-0d8b54f6f1d3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715855, "uuid": "27d3bbf0-e416-4848-8dea-cf6e3cafc96d", "value": "6144:vYa6xybqpinmJA/XwZcejYXyLsg/8leg9H02kPAGqhFaN0UT:vYrSqpoe0dHXyLsg/8gv2h60UT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715855, "uuid": "326b5140-e959-4d5b-9805-2ec9e6f8f57f", "value": 323586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715855, "uuid": "5c8dbb3b-b7e9-459d-b01f-7f71533f8920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715855, "uuid": "ca41dd8a-f2b3-4253-a000-d7313ca6d9f8", "value": "rcoo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe683bc3-40b5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1692686089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686089, "uuid": "70ebda94-0558-4d32-931e-8ba2c5df8aae", "comment": "Malware payload (AsyncRAT)", "value": "9eb8e2cdbf7fd8532315cfb0f9163d77", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686089, "uuid": "8db8d9ef-e2a7-4326-9233-5f31952b363e", "comment": "Malware payload (AsyncRAT)", "value": "f94b1ce80a72cb88c6565ad901fd7caca54a00d0cb20dc36326904f2ca2504db", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686089, "uuid": "ce980a23-0e47-4fe2-923e-5653b09dcdf1", "comment": "Malware payload (AsyncRAT)", "value": "122a1ce7ddf6adaf31138c845c7533367b324bb7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692686089, "uuid": "d3cc68f1-419e-442e-a872-14a07d68741d", "comment": "Malware payload (AsyncRAT)", "value": "4823cd7da0f53d0ae7c5f8e5411de9ccfa4d9311dea909f1fa27ed1676a416b936f6ac936cf92bbb4f3f80a202728f7f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686089, "uuid": "81ed4b23-93b8-4f09-8510-9488bb166eda", "value": "T1FD34AD53B2919DC2D60C83F56E9786EE2F22BF16DE46AFCB3150BB4EBB701524C06215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686089, "uuid": "885ed5d5-3597-48bd-a240-356497addce4", "value": "6144:mxEtjPOtioVjDGUU1qfDlavx+W2QnAmrQsHBGilkW8a+TJJp/vCNzoVmzV4ZeTYB:JkckWOlCWImZYMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692686089, "uuid": "0953a6dc-23b2-4700-903f-832030ac160e", "value": 252416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692686089, "uuid": "8b44d9c7-40f8-4662-84d7-4af57b130321", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692686089, "uuid": "299a736a-0a01-4035-abe5-cfc548257d1c", "value": "Receipt.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89293a83-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692715957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715957, "uuid": "fd60a60b-9d9e-4ce0-94a5-818ede93eaeb", "comment": "Malware payload", "value": "2e0d33ba5dbfa8eccdcbddc0bc3b3390", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715957, "uuid": "d3889427-daa5-406c-a608-bdd87bc8fc15", "comment": "Malware payload", "value": "f955035242ffa9bde3904e1c51b491ba81b76e16e912c5ed292efcaf55b04c1b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715957, "uuid": "584f9343-a9bb-4863-8b60-b09f5f07e922", "comment": "Malware payload", "value": "f9becff777f42eb77db9cf3f5f77f1be7e3fa880", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715957, "uuid": "97234855-fd69-4deb-b59e-050099ef53e3", "comment": "Malware payload", "value": "096932abe4c91081e7b87263556cee1c8b4d9b6721c67e718c35763588dce0a87dc6fc2c6576e6ade65b7c08c485861e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715957, "uuid": "7757fbad-ad02-404b-b22b-aaa14b623783", "value": "T1BBF38C1971D1A0B2E4F30976D5B8AF12446DFC111BB07CDB72E61A9E19320E3AE39B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715957, "uuid": "b5c841d7-78f7-4edd-ae69-05ee1a3548ae", "value": "7848011b763d00cd02658995847dd30b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715957, "uuid": "d7c31e53-572c-490d-9c06-58fd4532eb52", "value": "3072:l5K/B0toLQSNJ3lZHQsozTS+SMqqDL2/TrKYyG:lcytwt91yTS+xqqDL6HKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715957, "uuid": "056f25c2-b98e-4034-bacc-42c70b87491a", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715957, "uuid": "9f6c1651-081c-4c74-a396-42cab3185e45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715957, "uuid": "d57a0704-2267-4f9c-a222-0454985e87f0", "value": "2023-08-22_2e0d33ba5dbfa8eccdcbddc0bc3b3390_gandcrab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ba4e5d-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692690584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690584, "uuid": "dd47ef31-af7c-4a75-a5d1-60211a4de8ab", "comment": "Malware payload (Formbook)", "value": "6c8e6bc7c96c1e340c637b2de5828f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690584, "uuid": "e9aabdca-2a32-4b73-87fa-bceaa5ed1891", "comment": "Malware payload (Formbook)", "value": "f9c4add410b55fb7a5b176a3f71761bbdc6b138f6e7a2f1e39f8ee094dd3b992", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690584, "uuid": "dbdf83ee-ac08-4d84-a355-03d1d4dc3d1b", "comment": "Malware payload (Formbook)", "value": "db569b4a8392fe1354dafa0a8b188f2f52538f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690584, "uuid": "cc07fc41-6e4d-4db7-91ff-319c556dc795", "comment": "Malware payload (Formbook)", "value": "c2ee45536a811778cd578c0557310908eeac69904d8e7bc6b701290a4c40a21917319500c29e35cef4b4af289e31bc1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690584, "uuid": "1f3a5091-94cd-4161-95f1-53e9ee909a2a", "value": "T1C6058BC0E2BADBD3D5BA53F5245106000F767ECAB569E2544EA270E935F5B402B83A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690584, "uuid": "8750fa0d-7e39-459a-8018-b21816a757d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690584, "uuid": "ef901bc1-943a-4b59-b910-3f97f417eb29", "value": "24576:4T6d2Rx/J3wTjTVb/dLJCpcFOyapE8Zor:K6dyhJ3Q3VbLEN12GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690584, "uuid": "eea20f03-3934-4556-8091-d5cfab290150", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690584, "uuid": "1bcd4f86-2ffe-4842-985f-f6f0a1e81bf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690584, "uuid": "0a65c568-7ccb-4f37-9661-e9ed2de8f554", "value": "22082023_dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668981f0-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738662, "uuid": "40102524-56d5-4096-8f76-dc01ddb1423b", "comment": "Malware payload (Mirai)", "value": "2e7be53e5f88336d5003de40b1f824d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738662, "uuid": "6f1ffec0-3ecd-4805-ba58-59d4871615eb", "comment": "Malware payload (Mirai)", "value": "fb2d580dbdc61c00c40b18304998c37d05786207b2c2057ff0f50ee43184bd73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738662, "uuid": "4dc3036a-33ad-40bf-99d8-a8eb7eff8c19", "comment": "Malware payload (Mirai)", "value": "fcdbe59bce45a207256df86c6b24f92d1f973476", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738662, "uuid": "6b3834b2-6634-4dde-8e12-514b09bdbedc", "comment": "Malware payload (Mirai)", "value": "57c42aa396a0588ef4fd3523e3eefe6c5e881249308b1d5a311a6c3da66e9a0f31275ba7085dae235d4199163fdad46d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738662, "uuid": "f14af29a-cab9-4936-b5fa-03996de80084", "value": "T1DDB2D1A487A1E607C2B0F475A27C8FA25B3715E4C6F63927172092BCD98589633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738662, "uuid": "8a4911bd-64ca-4fd7-a456-8a38b4daa013", "value": "384:4GaKXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BPQZ8MhymdGUop5hu7f:4GaKQFH0rs3zWoDDRsjt7LB9U+BOs3Ur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738662, "uuid": "e7934d2d-34aa-466f-9627-58bf8fafe3c2", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738662, "uuid": "a8dea95a-0d50-448c-98f3-aa5e26fb8ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738662, "uuid": "040f9756-4221-414a-ae5b-2b5b416e7db2", "value": "2e7be53e5f88336d5003de40b1f824d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e922fd-40c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692690511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690511, "uuid": "311b326c-41b0-47df-aaba-88061866ca42", "comment": "Malware payload (AgentTesla)", "value": "53adcea044425d162fc340a4d2c7b868", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690511, "uuid": "95c16bf8-fdd6-4c8c-9983-1f9d9465643a", "comment": "Malware payload (AgentTesla)", "value": "fb906bfeac0591b9fe15b3d1f3e27da1f8a800ed55b068a9fdc86764257d0a96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690511, "uuid": "1555d314-c28b-48b1-a72f-10a6b3d62f50", "comment": "Malware payload (AgentTesla)", "value": "e6e1ef665f3df5cfa2ad04b6400fcfd8cc5072b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692690511, "uuid": "2ff0b2a7-09b5-44c9-9d6b-90721acb4fb2", "comment": "Malware payload (AgentTesla)", "value": "9773e94ca32eec7ea9091135b1a848f03a4aeb0a1e7b60a967d84d18d93d5022e1121299292ffd412e113b498ca73264", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690511, "uuid": "27224ff7-f045-487b-87e9-1684ce0fc971", "value": "T1BEF4332C5289EE5CE03D0D57CDCF25B4FB80E8F992E16E1BFA0AB05528D9D915A1C6CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690511, "uuid": "a7b9b584-deb5-4805-81b6-5354cc423867", "value": "12288:t3nWkh7/5MXVe8J3XPFFTPP/+ApnBcgB8s1OKSuo816uLG6uiQ85xejzz7C9RzcS:Bh5H8hXPTT9nuzsRvoQ5LSiv5xsz7C9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692690511, "uuid": "48231b9f-7018-4a90-90f9-52f14e711b23", "value": 746193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692690511, "uuid": "9a7244e5-54b9-4b70-8843-3ea6fee1fee5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692690511, "uuid": "63cbe886-fbf8-483f-a9d9-f6668c2df579", "value": "100%deposit-WrDpvqC5f.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5187c2c0-40fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692715864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715864, "uuid": "114a4c2f-41a1-495e-9af3-4c49771bd14d", "comment": "Malware payload (AgentTesla)", "value": "655c20604e9d077b1bd99343627fd188", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715864, "uuid": "cb0ff7ba-cf96-4529-9ecd-aca604d12a53", "comment": "Malware payload (AgentTesla)", "value": "fc2808e2a3ae5ba3c66317f9701b1992d6c7bbe2ef4eaf715b797e81459a44fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715864, "uuid": "14393af9-5618-4b07-a875-e2452fd6a42b", "comment": "Malware payload (AgentTesla)", "value": "3d883b6355e36caca1a89cb1de98fd96b195ec1a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692715864, "uuid": "a615bf33-1859-4888-9d6a-82e9d9e50448", "comment": "Malware payload (AgentTesla)", "value": "05d1cf9414c176f61fce7cbc04dca3506a38d2270a8155134df3311827f7e084eff89e0033c6ba2579342278e3ae8330", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715864, "uuid": "67d98c98-d2d2-4e37-86e5-b7cbbfe7b175", "value": "T1CD05E11127A8D71AD6BE43F9D5610CA18BFEAD17E956E71E0D8038ED2832702CB415BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715864, "uuid": "389f6701-45bb-4a2f-8c66-cab160432b71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715864, "uuid": "dd54b596-386a-41be-860e-2118195c6706", "value": "12288:MUVv25w+zB5tY2d1mbTuJEFjpI4cMHGOayaFVd4WzTcumVuhp+KGKBEIQVwefnYF:MdzBH8uJEppdatZzI8p+3XvY0JhTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692715864, "uuid": "18461c4b-c2e6-4955-9507-c69b5d98455c", "value": 870912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692715864, "uuid": "db0ebd98-d4ac-4f80-a9cb-5a165478f225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692715864, "uuid": "fa75ab70-8c8e-4258-91d9-b3c45549ad5c", "value": "z746Subv1rR0IoBvIY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bce49a-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1692689759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689759, "uuid": "ac124e73-2073-41e3-ab34-dee0deb44d6b", "comment": "Malware payload (Formbook)", "value": "efa256b14c2fb7b7eb9a63986269f7d6", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689759, "uuid": "0dbee678-bbaa-43a1-a5fc-49ae8f81d5f8", "comment": "Malware payload (Formbook)", "value": "fc88bd2fcdf6c916d4c7e0ecdd3b75bcdae0ea8f950b1aa300df01ab801e0863", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689759, "uuid": "57b850c9-cd0c-4dbd-b84d-a95831157d91", "comment": "Malware payload (Formbook)", "value": "09ec52d50e86e4d43adca60aadb8e1439041978e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689759, "uuid": "ff79666f-d158-4d20-9cda-ec68888d1c60", "comment": "Malware payload (Formbook)", "value": "45ec0165e8d8d76a3b0bbc206cecf236919a29a41f656090243fbfa1f253295b6ec5ed7f9b5aca3f9785e84aca7b8b72", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689759, "uuid": "b9c67903-96ea-4d02-9d11-a7dd53e307c1", "value": "T15BB3786DC34E01A9CF525277AB2A5E4502FCB73EB34452B2346C437533EEC2D95262B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689759, "uuid": "52941d33-557c-4a4f-af96-7f5ff9d30074", "value": "384:CL0AbZSikcMX93wRWjEO7G67ofF+M5/urqffnw8AeBZf+aWbwqVviPkChDUUoKIO:CwAbZSibMX9gRWjXGIoN+DqJ/dWsNyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689759, "uuid": "683b3de7-7e8d-4b91-8ac9-64aa7b8681ad", "value": 111499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689759, "uuid": "33bdfb88-c23f-4571-a162-16d140254ba6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689759, "uuid": "94af6d71-8fd7-4b9a-998c-1f7fa4933520", "value": "ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fb50c6-4130-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692738631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738631, "uuid": "edf2846a-6406-46a8-98f4-5ba2e4f07c4a", "comment": "Malware payload (Mirai)", "value": "eeb9091cdb53bcea71263eb38197ea52", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738631, "uuid": "18afb4f4-0ee6-4b49-a50c-7da5b24c30c7", "comment": "Malware payload (Mirai)", "value": "fcb0cd1c6415bb7b77d8b38e7da19565c539631cf2cefc373a5b0083cfcc170a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738631, "uuid": "da00e2c7-4111-482b-bdc6-73e25d654f1c", "comment": "Malware payload (Mirai)", "value": "7fac9a110b070ae67cd11d28e3a56b5c9cdb1d59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692738631, "uuid": "88996725-be45-49e8-8149-c6423cee5b82", "comment": "Malware payload (Mirai)", "value": "aca54536c45de968fb74cf3f1d1c5cbfd881fb15322ee7a095b57246e0b431013ecc2ff97d8ccf3d2a023cafb38e9084", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738631, "uuid": "c54f2c67-222e-4cbe-873d-f0cd8c4d96fe", "value": "T107C2D084F0019E42DFEB29F43954DAD6BFE46F5EA9228E4025A113D16B4C3B74306EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738631, "uuid": "fa281d76-cdad-4040-aa42-617ea7ccb903", "value": "768:FVdafO76jpmNJJKehmA7trpfIX9KeA7P3D4uVcqgw09Z:tam+AnKehPRa9afD4u+qgw09Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692738631, "uuid": "6bf2cb33-c615-400b-b33e-ea36c20b6e8b", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692738631, "uuid": "e9f52240-73fd-4863-8da3-e1021be49edf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692738631, "uuid": "afa07d75-f613-4b12-8004-9e1cca9a0033", "value": "eeb9091cdb53bcea71263eb38197ea52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b58e88-40f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692714764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714764, "uuid": "86f6fa36-98ef-4ab4-a8a6-58c1aaa581c7", "comment": "Malware payload", "value": "c416a2e007d41237b1e53078f8ae966f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714764, "uuid": "268ec9b9-6ac6-4903-9359-2309a7bc08c8", "comment": "Malware payload", "value": "fd281432880cac89d59bf29c90dfa2e74096331759833262a8e15f8e36c89bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714764, "uuid": "71edee57-4266-4609-bc93-307a924df48e", "comment": "Malware payload", "value": "5e8c61241b38e1905db2a4cd56e36045ba2965e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692714764, "uuid": "498fcd95-1ec2-4660-9a29-f861c9f93cc9", "comment": "Malware payload", "value": "0d2d958d248128784a7efae3dd79418adf628a8df9f18fe770f343758de786248e3c93235ec63d985bede4d0c75f54eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714764, "uuid": "0daa8d03-b245-4d6f-a51b-31b4c545dd5f", "value": "T11563061A67D428B7F5A9837895E20263E672B8B10BC616FF12DC85B84E132D071F5B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714764, "uuid": "6bca733a-2b90-49e1-b781-e859697e6601", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714764, "uuid": "447e9805-1239-4f4e-8a75-7644fedbda89", "value": "1536:6rae78zjORCDGwfdCSog01313ss5gBzWO:SahKyd2n31l5gW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692714764, "uuid": "4229ac8d-43cb-4441-b158-0f38f4473c22", "value": 70656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692714764, "uuid": "f2c2b953-cb2a-4fd8-b580-d43e9ade281b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692714764, "uuid": "6d82ae4d-a6c9-41b6-9383-f5e58145fe38", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54fea5cc-4114-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692726607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "170fdf24-b258-4da6-a448-917b8ea776ca", "comment": "Malware payload", "value": "d32f2457f1455823df7cd7b647ffc7ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "2fbb2d23-26b0-43a7-8161-ca8fd3792d7f", "comment": "Malware payload", "value": "fd342a29799d509657237996760d831527ad3b14112f12fc3f554356f32e253c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "e7c8386c-fa0f-4e11-98a4-3d1955fc283e", "comment": "Malware payload", "value": "0b75918bb2a0846a66491c79b53f424b89a94e01", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692726607, "uuid": "cef57ccd-dca8-4f40-a74f-4c78a8aed624", "comment": "Malware payload", "value": "a3307349a356d67b8ad8999f6432b614c2f60793dec28c7c3adb347ac8db535d73c4bd02c9b2d95b27c3ab27f5623cd3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726607, "uuid": "5164f958-7a83-4ce4-9656-e26aac4515ba", "value": "T123630986B881A72AC3D153BBEB5F114D332567F8D2CE3213CC180BA5778A90E4E57B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726607, "uuid": "742d575e-38b6-4cd1-8c3b-b33511281fe2", "value": "1536:aHOLc9FQVkjpKg21w/cXWHIVdb6LmbuiE1PX51tcMKd3+3+:YOo9FQVkjpKg21chHIV+mbvkK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692726607, "uuid": "192c77f9-db59-4d3e-a631-d40bb11524e4", "value": 67812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692726607, "uuid": "af563375-a17d-4a74-b87a-a2866329be26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692726607, "uuid": "e9bf50e3-ace6-4032-ac00-96e198a0a87e", "value": "cutie.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e13dbc2-40be-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1692689659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689659, "uuid": "4aa5271f-edf5-4dcc-b723-f4d89de098fd", "comment": "Malware payload (RemcosRAT)", "value": "f585858ea2256db1886efa7e1a689866", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689659, "uuid": "02b27874-853c-4a17-811a-1da21a18f923", "comment": "Malware payload (RemcosRAT)", "value": "fd748d42b3ca9ddd3f2c3388d294b8d3ead4f7c422fddf49b1a437784c91ec6c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689659, "uuid": "00125cbf-6d5b-41bc-a69e-2c2e44609916", "comment": "Malware payload (RemcosRAT)", "value": "b19ae390eb188f546b03982b859224343fa125eb", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692689659, "uuid": "7b44899d-ed21-4b4b-9761-1632da999ee4", "comment": "Malware payload (RemcosRAT)", "value": "b7ad02bc93fcd154d479017f5d092614bb3ea8786f07f76c73d22a8d3b20be6bf2bb75adfd34dbb57cb2557899ad13a9", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689659, "uuid": "c0360d57-14b6-491f-b855-d99e7e0e576e", "value": "T124E41252BA00D4D2D85B5AB86C68C82D2A757D336CB4094F7710FBBDEBF32E1A904746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689659, "uuid": "ffa76ca9-6198-44c2-9a51-19df631e43ec", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689659, "uuid": "5d1494e5-21fd-444b-b731-bac66454b9d0", "value": "12288:HbVUC7KlQdwaTXocUUa4H5+M9+10+yrofXiJwvncC4z/NSW:HbVb7zTXocUR4H5v+10+rXFncnz/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692689659, "uuid": "c1b349ed-270c-49c6-9912-62123edec5b1", "value": 694624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692689659, "uuid": "c9a6551c-ef7a-4dca-9d73-9310753bd30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692689659, "uuid": "ab2383ff-3f24-48a3-8b53-fe72b76b30fb", "value": "DHL - OVERDUE ACCOUNT - 5300039772.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8327ec74-4132-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692739569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739569, "uuid": "d6e99802-47fe-42fb-a6e0-a5b748a808f0", "comment": "Malware payload", "value": "f54548be8fdd4e0632464213a88975eb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739569, "uuid": "e91f8fc4-6def-48f3-b3c2-42b4d9caa8f5", "comment": "Malware payload", "value": "fdc47e4b941e76d24e81652d97745c885ee7165d2d08d97b7b4098d1afa15485", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739569, "uuid": "9001495f-4abc-43e6-8225-f572b9bd5146", "comment": "Malware payload", "value": "cad255dd52ee72d0460c3cce8bf520bbc32616ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692739569, "uuid": "d63f3464-2f76-4a6a-acc8-0ce10a34808f", "comment": "Malware payload", "value": "aa745a48b8738554f5eacecd94f6d7e531806a4c22c5c5d9548f1d53ab532ca38e9f50bc7aa9faec49822f691ac26ec7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739569, "uuid": "3c8ad825-636c-4a27-94cb-2b1c8ed22e89", "value": "T19AF2A24673E5CE16F1624A314DE7C6DA7238BC1EAE46C20B33447F1EBDB15B08A22758", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739569, "uuid": "c0fd3bf5-bd73-4e0e-b86f-9146e0c07e23", "value": "192:fuEAV6/6r1Oq0rjtBIOIKAU2tt3rXGvEY/oyb63muKDA0jHbPpwgiUaGKy9yIs59:fIiSgq03gOIltBi9le5iA0jHbPgLZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692739569, "uuid": "ae7648d8-789d-4344-bbd5-fabcb075417c", "value": 34304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692739569, "uuid": "ec4681f8-3fa1-4d41-9996-5db33a6ab602", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692739569, "uuid": "258c668a-b235-473c-8d72-9c8444d8c21e", "value": "w1srg.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb30f18-4100-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1692718164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718164, "uuid": "91f90409-4037-46ec-a1ae-359fb22e7417", "comment": "Malware payload", "value": "c5b645a8741a955a6e15cdbb4e88563e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718164, "uuid": "b584b205-0897-4b53-906a-dd4f7358d26a", "comment": "Malware payload", "value": "fed214d557d9764f4a61ebaf74f0a018bd3124c98778d3c2373ebb99ae6e5ed2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718164, "uuid": "4051ba37-981e-41bc-91f4-649ca015b362", "comment": "Malware payload", "value": "e66f548c2adbce989aa77a9f4ee4cc47f11b643e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692718164, "uuid": "e428d714-4d28-4048-9f39-c7c5f3d1f8b7", "comment": "Malware payload", "value": "70b87971895fec8ab9fb39a2d68c7bf57d9f5ac3651cb91a2e86d4ea1605fb2569f365cb009aef8525bb2de752cfcbe0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718164, "uuid": "4f768ba1-a371-48d4-8cf5-c411f378544e", "value": "T11B738E467AD2C472E67E19315864C9B05F3DB8124EE49DAB3B86063E0F306C1EB35E79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718164, "uuid": "2275b071-b027-48fe-ad8c-2737ff90998b", "value": "1148116808daa700e5059fa51907e932", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718164, "uuid": "eaa75181-ac00-40f1-93c8-c5ad1b64ea3c", "value": "1536:plpGQIgcORfb7u/lGbfRcfZit1dsW3cdmNbpe1FTU+X3hzCT:n0ZOf2/lGbAU12mNdiuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692718164, "uuid": "7ddb69c9-a323-44b5-97d2-04b2b9b6c995", "value": 78336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692718164, "uuid": "c33ac9ee-7da7-4ceb-bd82-8ea3efe6bb05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692718164, "uuid": "0999d660-1584-4647-a45b-d22385b5d4cc", "value": "SecuriteInfo.com.Win32.PWSX-gen.30929.21063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bab1c0-40ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1692694804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694804, "uuid": "bc63c56c-9fa8-4ce0-87d1-03d6b9f183fc", "comment": "Malware payload (Mirai)", "value": "be13acfb700e1898bc5184675626c111", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694804, "uuid": "14dfe043-29ac-47f9-9dfe-9f7c1bf1f312", "comment": "Malware payload (Mirai)", "value": "ff5ccbd30f6a7cbb2c71a277aef05f6e20bdbf60325a08e3a6761ab2a2e0d4f9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694804, "uuid": "c78ffb30-fafc-4f5c-b76a-e3d44c5917cb", "comment": "Malware payload (Mirai)", "value": "4e98639ae98ec464f78b091478194eacca706fcc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692694804, "uuid": "4512ecc8-7c12-42e4-a775-d9546c745bc6", "comment": "Malware payload (Mirai)", "value": "c7a7dc8adb33bf55ae802881bdaa0c20169768c2473e40e6bed12e68d060e1bcd7a143ab938cf17ec1a6e512dae2a9cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694804, "uuid": "30eb05d1-3aaf-4062-a73d-2ab50092994a", "value": "T171C2E1A285FACA17CC634379153819B351581C55D34DEE3D172B9ACC52C84E32BBAC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694804, "uuid": "ed238389-0ca9-431e-8eec-6b7e6c479694", "value": "384:Ms59WXUx5+bkbRaliVErjrL9VD9jPwrSaf5bwIB5/8x2BYFydHY0sNDZvzbSNHcq:t5+Kcrb9VDJef5Q2PdHuzb8HoEPbMp4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692694804, "uuid": "3e31803b-2f66-4a81-9c86-97b4a845a6b1", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692694804, "uuid": "9c2f3dba-b8f7-4f9b-9c7e-b664760ccd43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692694804, "uuid": "d9ea8728-05fc-4cac-93b8-e93a7336a019", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d274e5c-40f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1692712367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692712367, "uuid": "a3726f31-4fec-4a2e-90e6-52746b7f0797", "comment": "Malware payload (AgentTesla)", "value": "ced6464e77276385e82f702d45467cce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692712367, "uuid": "80d6af0b-a88d-4129-882e-e74628fdd168", "comment": "Malware payload (AgentTesla)", "value": "ffa8e6e00d583ef5154e0e33f28d775858e9d71fd8e45247cec4e60e723f8f9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692712367, "uuid": "a55d2cb7-3be3-4ca2-b531-07b7760516b4", "comment": "Malware payload (AgentTesla)", "value": "9d759ac7a42159bdf450a7a47ef13cc167f2a263", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692712367, "uuid": "e47627d1-2765-4fc8-9aaa-6b73e57c4fcf", "comment": "Malware payload (AgentTesla)", "value": "6bafcf9ced72f9b0992af49cc08538c3c410837ad48cfacaa8832bafd28bcb3271cd4786877ce3a685b55d7431de53ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692712367, "uuid": "2ceb9a0e-a59b-499a-8a4b-e8e879e318d8", "value": "T125F4D010B2BB8B51C87B63F53F11120C0BBDA55A63FFD3257EC6A0DA5562B80495AE33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692712367, "uuid": "0bcf7b45-8520-4bae-b687-4e58728f146c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692712367, "uuid": "781731d5-d4b6-4bf7-87df-0bf20481d794", "value": "12288:15F9Eww2d1mbTq+nQGLUbT5agdidHhaCMGYQFjTamQ8zGsAWNI1L47:99Ew0vnQ+8TEdHiQFzBYRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692712367, "uuid": "a2c9588e-640b-42c8-b088-8ca1a3a867d8", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692712367, "uuid": "f0aa2692-8e3b-4255-89a9-72146f13c9a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692712367, "uuid": "2c952e49-ab55-4590-aeba-eed65c3d55fd", "value": "igfxEM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd466ef-40e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1692705979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705979, "uuid": "7891eb35-1f63-45c0-acb2-df8038e66e71", "comment": "Malware payload (RedLineStealer)", "value": "72af625932fb9400a6661a6bde830518", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705979, "uuid": "1d3f786e-1991-4820-9ae8-c2a2cb4205b1", "comment": "Malware payload (RedLineStealer)", "value": "ffec60c04fbfc5fc53b99a9133d7e4432125622f25605ec0d94a413548a48e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705979, "uuid": "45691e6d-cde2-4a7d-8b6b-ec4865eed8cd", "comment": "Malware payload (RedLineStealer)", "value": "5e8a5fa07bf51e226272e8fc6a209b870475f744", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1692705979, "uuid": "57be3bac-ebfe-41f8-b920-db5725988946", "comment": "Malware payload (RedLineStealer)", "value": "40a4358f3bf38204c18a571b6df6a9ca79e9216b8d01696dbd6c47c0059f28d0ba1c910b0f89a79aa5064d604e84c9fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705979, "uuid": "049c57f2-b8ca-48cb-bd42-789d4ffb398b", "value": "T156959E36BEC08035EDE214F646FDEB15567EE070871954CB23C882ED97209E17BF1AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705979, "uuid": "220ce381-437f-4286-b8f4-780834eed9c7", "value": "7ca28186d68c9a22a0e816e570aac96b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705979, "uuid": "6928d096-5587-48de-bd08-b9a0fdc3d2a7", "value": "24576:TdgvYOmxjN9cDk+OeOxrV/JHaX16tK95IBJd:TdrxjN9cDhOeaJHm1609m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1692705979, "uuid": "44edb08f-475c-438a-889b-807cd1c974ca", "value": 1917440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1692705979, "uuid": "847ad2f1-d7a9-40fa-a07b-6e7462e3b877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1692705979, "uuid": "8cba8dba-6144-45a8-b41c-efb4cb0b9820", "value": "72af625932fb9400a6661a6bde830518.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }