{ "Event": { "published": true, "date": "2024-01-27", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-27", "timestamp": 1706400181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "6b84dcc6-ee25-457f-80bf-b57452014856", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2b3367-bcbb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706322363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322363, "uuid": "dd6ca08a-5ff5-4168-94cf-f6115fb20db5", "comment": "Malware payload", "value": "29da6bb5ff8fa763e64573a15e2e9b7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322363, "uuid": "873acca5-c843-48c0-a45b-e49b5e47b11c", "comment": "Malware payload", "value": "00f1729cd2ce6804319ea13a336cb42098620e3c82e4e563ea1ce5c82bd232dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322363, "uuid": "1ebcb407-7cd2-4efa-9f18-0c0eee8cf000", "comment": "Malware payload", "value": "c720b9fb9924e8887ea9b1d7bac43ed3c5ec3839", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322363, "uuid": "1b26fbda-d615-427d-846b-5fb909f96e8c", "comment": "Malware payload", "value": "b17d69fb7a05f0fff173163292d8bd02273a652757061e5f524f5429c1c9db3d5dbea0b9ec310f513f9bb0586fc894d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322363, "uuid": "f36fcb3c-4c11-4a11-b8a7-4f93cec5769c", "value": "T1528633177354B13EC35AE4378D841A861BE36B238B0BB29B8A9F497CD89C093FDD1456", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322363, "uuid": "fc664826-b796-4c42-9471-62627ba40d31", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322363, "uuid": "b2976db7-07e2-40ca-982f-1999b4a7946f", "value": "196608:eU79G8rEna/a2AtKkixiYjhVcjYQ88PUxwrd5gPM:eUxGfMdAYk+zjh3Q8NKx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706322363, "uuid": "aaf9233d-f687-4f95-9976-2620f8692717", "value": 8395511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706322363, "uuid": "9431af59-4565-4a64-9249-5ac38c99c743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322363, "uuid": "6746e6ca-6957-4914-8620-08005c6c40ce", "value": "SecuriteInfo.com.BScope.Trojan.Downloader.12865.28993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1772e98c-bcf1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706345416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706345416, "uuid": "3c04d47c-001a-4a33-856a-e436f186ca19", "comment": "Malware payload (RedLineStealer)", "value": "c3db34b901165e95a64be484bdf661b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706345416, "uuid": "ac88f24e-53ba-4239-acbe-1a153a100917", "comment": "Malware payload (RedLineStealer)", "value": "040998a36c5e8f664236b62d9ef5135c612ec2d7502138dd03e6d376859c4417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706345416, "uuid": "9c03e778-b988-4583-8b40-94d89e78eb53", "comment": "Malware payload (RedLineStealer)", "value": "1eec550da173c8381a78b560dba40553858af657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706345416, "uuid": "8756546d-c8ac-4fec-8f0f-d386a8501a1d", "comment": "Malware payload (RedLineStealer)", "value": "fff8ed9bf755e4ee753c6a1d1343a5dc7f65b659cd935ac0c0d13546975607c46d6facca6821feaf98aaa804a7cb7292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706345416, "uuid": "ca000a3e-43dd-4515-9e4c-f513568879e0", "value": "T184C5121562A400F8E57BE1388D874585EA72BC154722EBDF03B8E26A7F336D14D3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706345416, "uuid": "9f4818bc-ce83-4477-987b-9e1933594562", "value": "0243e54a4700d655ac25e3602f0d4916", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706345416, "uuid": "f6f62197-a7b6-48fe-a05d-9439a621444d", "value": "49152:DBYW+uw6Il8tf7telO43G7VJIlDjR8xYh2UPkS6ZuXuLIx0h:uW+u/OUf7tEOVZJIlD9802UsXZbU0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706345416, "uuid": "878544ee-2ebd-4a33-b186-f72ed629a2a8", "value": 2590656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706345416, "uuid": "b8cc031d-218a-49bd-963d-2091ce7f5902", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706345416, "uuid": "d6efa779-6676-4790-bc7e-21ecb716e7ae", "value": "c3db34b901165e95a64be484bdf661b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec66f6c-bcb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706318558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318558, "uuid": "58df6a01-50ea-49d9-8d88-3935707bce02", "comment": "Malware payload", "value": "b346fe6b3d1da26a0d39bcb95c1dffa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318558, "uuid": "a12363d3-c86a-4173-b615-079e7103c64b", "comment": "Malware payload", "value": "04121c481ff182c37d7be69dde3fc98ac9df808545f46e71afb796491fd0a94b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318558, "uuid": "291c671c-0318-49c3-9cac-0807e01ae718", "comment": "Malware payload", "value": "90f84bc1f97b171bf1f54accd13a346ddc2a3735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318558, "uuid": "fe3ff9ad-ac4d-472f-9b0c-fbd0473b86e8", "comment": "Malware payload", "value": "8968ac965cd09b16b6101a7c892779fcac5070239d64f1bd283f71d871f76d2eb38da1f9dad25b8ee479f48062393874", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318558, "uuid": "3e5b595d-7cef-4353-b5ac-6e66c5f44bd8", "value": "T196151212F2C1D536DAD243B71C7BA7C85F6AFE91971562EB229C3AC60B302C41E27167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318558, "uuid": "99a4f903-26bf-4443-870d-2c2433b5dc53", "value": "22977549f5973f29d9952f5032e325b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318558, "uuid": "203a3821-c371-438f-80f8-870b17aff309", "value": "12288:hCscS1TLgLOEYczVPA5AREjlxXWijaeEFxIuLGOTNVlTsdNMdr8noVd/WViATSRk:tcSxYhDzJmjlxXW8aXIGro86oT7A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706318558, "uuid": "abd6190b-7670-43ce-9690-00dcd536e88d", "value": 933479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706318558, "uuid": "0c610a2f-d1e5-4c14-8382-0682afd1252b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318558, "uuid": "59e95920-b586-4bd8-bc54-095ea3987ce1", "value": "SecuriteInfo.com.Trojan.MulDrop6.20495.15510.1055", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcce770e-bcf3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706346606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346606, "uuid": "49695076-9563-4eb9-83b2-5f0efb4f49ac", "comment": "Malware payload (DCRat)", "value": "c439acfbc68357d11579d83c45919146", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346606, "uuid": "66405f9f-1dab-4218-89ad-a6d13a72da84", "comment": "Malware payload (DCRat)", "value": "0714c021b42433c9bfecd7e4c92cff30901e7bea72f0cb499e15b04dbbbf6423", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346606, "uuid": "2bde6a50-3613-4d6f-b099-550efdf067c7", "comment": "Malware payload (DCRat)", "value": "8fd41821e8e970d61a3c701498626b661cb9a439", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346606, "uuid": "ea431ffe-b17c-4673-a7af-8ac7edae1ee6", "comment": "Malware payload (DCRat)", "value": "363f5af6ab562c0728a00ddc750480f25c6ca2ccdda9c2e99976ea2ede868fa857010316c96c4973b22185d774ca3d1c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346606, "uuid": "8131126d-b6b3-4242-8bf9-1e68eda34ffc", "value": "T17AA5BE027E45CA11F0195233C2EF494847B09E5466B6E72B7DBA377E26623A37C0D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346606, "uuid": "6105e5fb-8338-4084-94dd-e2c27468ee73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346606, "uuid": "99892cc6-3545-4a00-86f2-24b1004f11f6", "value": "24576:VA9WcYe+oGCL+vBTgZeA26HSDz4nyTouez9kVfJdslp4SHvEMZyMApbABdW+Oocf:Vaz+tB3A2DzcyDYyMv4gZab0e3sM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706346606, "uuid": "bae24e68-4206-4de4-8b2a-5c201ccb8069", "value": 2108416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706346606, "uuid": "82720ad6-827b-42bc-8d6a-f4b78fb43ebf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346606, "uuid": "39b225de-4da1-4a31-abc8-abb70d317719", "value": "c439acfbc68357d11579d83c45919146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a391c41-bce1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706338522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338522, "uuid": "3b05c5b4-6ef6-4792-91e4-913798e88e00", "comment": "Malware payload (Gafgyt)", "value": "ebbd7398f0f8729f74a7cfbbf94802ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338522, "uuid": "9768bbfa-a319-4bb5-9cdd-e615b352d402", "comment": "Malware payload (Gafgyt)", "value": "083a0cb53fb349bc6873db4380226977a142b6a4fad1383527b3587da20fa326", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338522, "uuid": "5074e246-629e-4af0-8f3a-c1f0c336faa6", "comment": "Malware payload (Gafgyt)", "value": "e547f6627e0c5dffb5f7122a049cb68def6ad462", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338522, "uuid": "19458d6b-ce56-445e-819d-ee3241e11ee2", "comment": "Malware payload (Gafgyt)", "value": "c2f10f79ffdb7abbae68977ae7584ef13ce045c909b109100349c009a77d16eb570e2b29f1e357db7512636118b0dedd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338522, "uuid": "4b594566-4790-44bd-8981-d7a3be384b9d", "value": "T140832B43A9619FB7C1866AB125EB5D700B13E8A11F5F1A89313DAAF4074F4CDB80EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338522, "uuid": "5fba8e60-cecf-421e-90e6-3d87b20e4d68", "value": "1536:9n4KbzWhKfTT1Izp3rKr6Y+CtdfRbG/UmjBVqOLe8fz3Q:5xzTfmzput+2dJ1mjBVqOq8fz3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338522, "uuid": "fadeb732-68e9-49ef-b0bb-3964acbf2cd4", "value": 82063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338522, "uuid": "540f4693-2a90-4fd3-82c4-200d387b80be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338522, "uuid": "022c9f50-56fe-48de-9e86-5e4b9b445578", "value": "ebbd7398f0f8729f74a7cfbbf94802ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a47917-bce9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706342305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342305, "uuid": "ac8e6787-b1b4-459f-9ada-d4e5eb727605", "comment": "Malware payload", "value": "5df2833c17ea5bd842d3d6aeab36e860", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342305, "uuid": "8d978ffd-c8a6-4348-b84f-ae99b8964c08", "comment": "Malware payload", "value": "0c590174f9a182a4ef2d8f5ef1b066bb52c8f5a0f08c7982a1780a659e8ca2fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342305, "uuid": "59f4486a-ddf5-4459-8e1f-5dca7ffe922d", "comment": "Malware payload", "value": "bc1dd99264100d8ff890818fa86233826460c357", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342305, "uuid": "38391877-ed00-43ec-88b3-7e889bc0eb9e", "comment": "Malware payload", "value": "2fcc3ef4f71afb8d59b050a61aa84232171322abec8a21e6df014f5e30e60ec77a55a12ec0eebe34c7b0211379432a79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342305, "uuid": "b4bdfae9-6cdb-4192-ac4c-c8764f9baab2", "value": "T198159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342305, "uuid": "5a0848fc-a2ee-4e0a-bed8-a50b067d6445", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342305, "uuid": "8488dcef-1b39-4459-b1a5-4781fd4377a8", "value": "12288:GqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaNTj:GqDEvCTbMWu7rQYlBQcBiT6rprG8aJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706342305, "uuid": "7a7a2522-929a-4309-8727-7c320507d353", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706342305, "uuid": "dbfdfb17-6c97-4208-bd6c-94e2204cf3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342305, "uuid": "5aa7f042-b2ac-4428-9b4c-34f081f83895", "value": "5df2833c17ea5bd842d3d6aeab36e860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da71ce45-bd1e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706365070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365070, "uuid": "580ef6c6-a06b-45e8-a984-94a4621f1d06", "comment": "Malware payload (Formbook)", "value": "a1d8eceb8c701feb83b225d73fc237be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365070, "uuid": "2867e176-6581-4d52-bffe-5a438110e3ab", "comment": "Malware payload (Formbook)", "value": "0cc6d724ac017163b40866c820fd67df6ac89924a623490ec1de2ecacf1d0219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365070, "uuid": "c1dba6c3-f5e2-4807-8d29-82a340b8bb4d", "comment": "Malware payload (Formbook)", "value": "557a58b252d3d120fc462d87dc2bdcdd2f352547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365070, "uuid": "9db74231-aeaf-4c57-a923-e21405b3a2e2", "comment": "Malware payload (Formbook)", "value": "3aa022887d4bf25951619f39d873e95c07698292309ef7916ef2a30198a9dce3b4219fb8e417e87458c276f9c451c804", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365070, "uuid": "59b98919-2e12-4927-9594-f2c1e51b4289", "value": "T13574E0E1AAE65CC3DE5023B861D9D672223CF9C04A13475BA16023753B23FD47EDA6D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365070, "uuid": "d7aaa11a-2b24-4400-b5e6-a3b0e35449c9", "value": "b92e25fdf67d41fe9a0f94a46fd5528a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365070, "uuid": "13220f43-40b5-406a-be7e-4f5c81f474f9", "value": "6144:EAUe34ubfMsUxBO9vL78ejo+OFUDWLCjRt5pczKYwuKCmA0Fo:T3RbfMsaUxLS+NDQyZ6lweKFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706365070, "uuid": "473a4436-5b69-423c-92bf-caea757901a3", "value": 340331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706365070, "uuid": "755c1ecb-29d8-4684-8db1-5986c29be106", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365070, "uuid": "a78603b1-3a69-46f0-bd1f-ba7b15c8e2e2", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68507256-bcbb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706322359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322359, "uuid": "5180f0b4-95a0-44c0-ba21-cfd4682f1369", "comment": "Malware payload", "value": "f24d0fc0c8a3f44556380d7ed6de878a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322359, "uuid": "207f58f8-b2b9-47e8-9751-30000efb2f7b", "comment": "Malware payload", "value": "0e7a5cc6a93cf4da4e301728ff4494511640473724823bbd90de7dbbf467d1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322359, "uuid": "2aea9ee2-91d9-43eb-bc51-f727008a44f9", "comment": "Malware payload", "value": "3ce3194dc068eb33a08fdcad1342937a96727926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322359, "uuid": "fcb7d502-3f74-4100-afbc-5bc22845f7fb", "comment": "Malware payload", "value": "7a8f8f1b093252e28edb7a9ad69fd84ad94598dc33929f3a6a70c69f53e8379f022bb916e7304be964c708b79cbf7985", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322359, "uuid": "9be33ea7-0a3c-4bd7-93d8-546c48bc708c", "value": "T173B5337644D14D3AE9963530E404A9A32800228D6FD175918DAAECCEEFBDBC3D3D6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322359, "uuid": "b93134cb-7179-428f-8bc4-1708a81f7a31", "value": "d879a65e465b1c412670e44fbe2d8e6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322359, "uuid": "715455c0-3e8a-4e11-8d91-86f131353233", "value": "49152:1gnUP7Qkow0k74k6YaYZCPqo+l9kOPgKLEd+VfpUifD2gE4QztIAB:f7Qz7k74k6LsCio+l1g6e+VJfPEntIAB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706322359, "uuid": "f6fc2829-d2af-444c-a279-6dfe640f1fce", "value": 2380552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706322359, "uuid": "08fc8bb2-0934-4d62-9d1d-5b94bf9df31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322359, "uuid": "8e1cece7-05aa-43cb-a39c-1c98e83046f6", "value": "SecuriteInfo.com.Trojan.Siggen22.10132.16897.4133", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e8f05a-bd25-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1706368042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706368042, "uuid": "fd67475f-1158-4742-ad72-cd79a34ee6a3", "comment": "Malware payload (AsyncRAT)", "value": "e0de04866829f56dab5f34ae06d225f7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706368042, "uuid": "f267a92a-4b1b-42af-a8c9-009541702e7d", "comment": "Malware payload (AsyncRAT)", "value": "0e948e3d83e22df165afac4da052b45297f719a33f86c4c194958f59dad75a28", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706368042, "uuid": "e7195c7b-5087-41d5-bfb7-f0d6ef07468b", "comment": "Malware payload (AsyncRAT)", "value": "5003150c7d7fd5724bf4ee0d390c0d361776369e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706368042, "uuid": "e7e256cf-2667-4ba9-a240-62ff21f08681", "comment": "Malware payload (AsyncRAT)", "value": "9b5fa5ee3a7e4b5614ee8b46a5107e65e9d84072c1c17198adaa539744168859b69bb87e0d1f5e99e97ebce341a9459f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706368042, "uuid": "a96ad885-c188-48bf-a753-362b7573358d", "value": "T1DDD24C0877E58327C5EF2FF229B2910203759507D923DFAE5CD896A76F67B8146003E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706368042, "uuid": "5ba19a27-8a84-4200-8fd3-cb631644462b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706368042, "uuid": "49c81068-b24b-49af-ab24-e37b9737f8ea", "value": "384:4ieAwIGmefcZWGl3nxe0XLZJkpJqXlYECwaiwQsbRugtFuBLTIOZw/WVwvn9IkVq:BHZrtxekwo1YETDJsbBFR9RTmOqhDbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706368042, "uuid": "cb3a6eb4-debb-4263-b9e1-e3667c6a2d43", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706368042, "uuid": "298423f7-4c27-436f-b097-bfe78852878a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706368042, "uuid": "8c55ed3f-fce7-47fe-b96f-d59fcb3060ce", "value": "bTmo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90146cb6-bcb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706318560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318560, "uuid": "2e98bda2-791d-45e6-a1a0-41bc93e9fbee", "comment": "Malware payload", "value": "6471ca1fff20cba037debfb9a30c0cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318560, "uuid": "a9664408-99a9-429f-a0e0-cb677fc8389e", "comment": "Malware payload", "value": "109ca116c41d294401cc8e42762345e8142d507ddbd811f9964d4689654968e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318560, "uuid": "50054d93-3c18-45e6-a71e-2344bb039f59", "comment": "Malware payload", "value": "e6416093f18940d1851be733a86a8425a1e9219c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318560, "uuid": "bfd27232-9de6-437a-ab0f-0859de14647d", "comment": "Malware payload", "value": "affe2d4e845451bd348da18e3baee3d4c724e5677bee72e21ae389d7ef46b5226708b556e520a6fd66cfa1375debbc64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318560, "uuid": "a1c7c942-ae5d-478e-9d4c-57d87d5fbc42", "value": "T1D71512227290A17AD5D6467A8C7A87A66F79EE210718A38F77CC3ACB0F302C41D37557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318560, "uuid": "ec8c3e7d-0d72-400b-b7fd-361139c4b4aa", "value": "22977549f5973f29d9952f5032e325b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318560, "uuid": "e9e94d74-0c4f-4e6e-982c-b7d6b3ac1595", "value": "24576:tcSxLTUxroZyli6OHnVi235/wZRtTjqUibLSgT2Hd:2eErvTAnwE/wf5qUiXSgT2Hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706318560, "uuid": "e90cc282-2268-4f0e-8e9a-d562c7ce3a29", "value": 940929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706318560, "uuid": "5c33a068-d7ea-4a05-9ed3-253ab1f72978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318560, "uuid": "2d6b1d15-7eb7-4d45-96b2-ce509d751486", "value": "SecuriteInfo.com.Trojan.MulDrop6.20495.25795.10208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ec4ff4-bcc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706326051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326051, "uuid": "43756927-e8cd-4c3f-a0d2-37166b492369", "comment": "Malware payload", "value": "fb7119b4758570d17662f85e5c9791d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326051, "uuid": "ccd6947c-5ad0-4a56-93b0-c46ac17de0c4", "comment": "Malware payload", "value": "13750ad1ccc1386345c69fc8dc59855665e9fdb846b2965f69b3ca78cb1d85c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326051, "uuid": "a890fb2c-da8d-4a66-a014-6d8cf93f81ff", "comment": "Malware payload", "value": "ba0e3a83f28dbe065039deddedb229a9a7987144", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326051, "uuid": "87bacbab-69b5-47dc-aa1a-7525c8de9ab1", "comment": "Malware payload", "value": "ca40ee1f154818b556fc3a78bf10fdc0c6bead2a7e0547175c65fe6cf316b4c055a11677e042904f7befb63b3f50906e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326051, "uuid": "c306b386-6bc8-464a-b34a-0a4325ce3f3c", "value": "T106835A63B2E484B1E0715EB8EC0AD669853FFD622D29505F7AA45F0E8E6C6C09C1D7C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326051, "uuid": "24c8f394-dd47-424f-abe4-f318b0e0f6a7", "value": "8cdda08b705365bf0c0beb29731465bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326051, "uuid": "3d905239-ab8f-4d75-8f93-9fd264e92aca", "value": "768:h9Ag4Y/ija+1Ivypuvw2SzK1R3Pr5QUM72s9kCMCeKnt85qOVjgBDe9MkAcmfrPO:TAgmMnPr/M8PC1tiWDe9nGP3RlDJ69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706326051, "uuid": "79eb5d36-ce32-4c74-ae1b-eb7eb24ff0a1", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706326051, "uuid": "b80a2f0e-d8b4-4365-99b0-84657b1333b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326051, "uuid": "4d297ec3-adb0-4bf7-8d22-2c059b10065f", "value": "SecuriteInfo.com.Variant.Tedy.109128.31477.3779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2280e7-bd08-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706355683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355683, "uuid": "95353f66-3757-45d9-adb4-e1e882dc0e38", "comment": "Malware payload", "value": "3ed32014c215b711e2160ae116a01813", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355683, "uuid": "6994106c-be1d-473c-b61a-9de7fee9f678", "comment": "Malware payload", "value": "1a12747174afe3de20b46d616dc9663b7b89d8e00655cb44cc6211cefcda2323", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355683, "uuid": "25c4eb38-2ef8-492a-9abb-f8111241ac0c", "comment": "Malware payload", "value": "c2bd7327a465f365f654da4008e2f3eb89d09e26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355683, "uuid": "319a0fec-a114-4dc6-8e91-4495d91c9d65", "comment": "Malware payload", "value": "259ac80696e0037566dddb8293cc12ad90e108e4f24c79c7cfd7aa447e5f83db0d9d2c90f2486fe0113f33eafd83c483", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355683, "uuid": "956b2194-250c-46b2-bb7d-ef594f65a7d8", "value": "T1CE16C06477E45F09F2BE677198F24465D3B7FCA227B2E30F668256AD0802B06ED02357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355683, "uuid": "7421d735-95b0-49c0-8985-c6ccba516d80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355683, "uuid": "8906ffa4-362e-45eb-85dc-321dbaa27d83", "value": "98304:46LSRmKSoL02Y5zKtl9a6rtBkUWvXB60KGJ0Rxyzs8TW:7LSRmKSoI2Y5GtlRBRViKryzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706355683, "uuid": "79f3d48b-89fb-4f49-9e00-0c67c227f737", "value": 4329984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706355683, "uuid": "96cfc013-cc64-48bd-ae97-5067912b5eca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355683, "uuid": "e25bc2a9-407a-44d3-8a75-f81c843e598d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de4d0e4-bd23-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706366901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366901, "uuid": "58c51e11-dc9f-4235-b425-8bb359d28911", "comment": "Malware payload", "value": "73a521f60e08a43342f1cb6ed90515ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366901, "uuid": "89e8c011-9992-46cc-939b-16c8205605e5", "comment": "Malware payload", "value": "1af78a8afda354f74becdca699672cbd17259fa925e8ce0f3d62c198374872a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366901, "uuid": "efa24c3a-2600-481b-bc76-d8086160cfa4", "comment": "Malware payload", "value": "cff98c4375cdf29ff444300624b006df2f17054a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366901, "uuid": "76a27f20-35df-4804-8066-92cd25b8ae37", "comment": "Malware payload", "value": "09f77499266c8518efe8ead59d2d7971d33bfa765b1d4ed35c807009b969ebb4ab234c7a3ee6bfa3e717a728f1766f5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366901, "uuid": "c6fee7de-e755-44c1-96a9-c5b7c0efd0bc", "value": "T15C083391EF10D04FFAC591BE52B4472CC8EBADC86841CAB2477531588F377E1797AAA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366901, "uuid": "0d087ffd-9646-4715-9dcb-20f3fe470617", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366901, "uuid": "26e61bc3-b819-473b-9712-3dd5082312a3", "value": "1572864:YtxyVQSAAUhqJLb7ZA1smA9U2IucZ5jZY9j+w89TWJ5zkMyuMmN8WJ:7/LHZA1tAKR9Y9j+w8FA5w68y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706366901, "uuid": "e1f73349-3114-4a28-9de7-275974d75c57", "value": 80413538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706366901, "uuid": "95c14585-b308-4276-a152-3454013404fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366901, "uuid": "3ece157a-4f58-463b-a3aa-a4e533200a8b", "value": "VoiceAI-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b615f502-bd43-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1706380901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706380901, "uuid": "5f2d9418-d99f-42a0-b831-af10282a3ef7", "comment": "Malware payload (Arechclient2)", "value": "6981e1fe652aea8534bc86365b2c1eea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706380901, "uuid": "8f628307-41c3-4f0d-b5ec-b396c576a813", "comment": "Malware payload (Arechclient2)", "value": "1f8dec69b76f70a555ed82874354b58e662a6fc382b45784e2cae8ae2978398c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706380901, "uuid": "db0ede2c-6d44-460a-ab98-3218596f009e", "comment": "Malware payload (Arechclient2)", "value": "4df342b95bff205f57bcf1b1740f26eaee1eac75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706380901, "uuid": "9aea5f84-724d-49a1-90cf-dff149722d62", "comment": "Malware payload (Arechclient2)", "value": "9c2b1bb3046a2be2dfcf3142101976edfdfecb9985fe0a49d5690eebaea4fda97481cab6e0fb577d03bef7254008228c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706380901, "uuid": "223591b0-4b33-478d-a5b2-86e6172796d4", "value": "T11216CF5137D88A98F2BFA778D4628910D3F2BC96A7F3E35E9F40A65D0851B00FE59342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706380901, "uuid": "2dd0162d-74cf-4f3d-a1e8-c76508971fe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706380901, "uuid": "142a966f-3fcc-409a-9a11-0a92c539baae", "value": "98304:mkvX9nnZHBwv59qYyHGqG1A6yPLD2LpvmB2jHNlRN+yFPEJbq:mkvX9nZHBwv59qOKD2dOcjHNlRau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706380901, "uuid": "01e75bee-b791-4d4f-a60e-a98c5b3d2e0a", "value": 4080832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706380901, "uuid": "f3b97590-67a8-499e-8292-c5063d09656f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706380901, "uuid": "a0c2d969-c396-4236-94e4-548d81aa4e31", "value": "6981e1fe652aea8534bc86365b2c1eea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9105f937-bcff-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706351633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351633, "uuid": "e9ea682b-8c34-471a-b3d6-aebbcc3106e0", "comment": "Malware payload (RiseProStealer)", "value": "6b0ef2bdfa959434c836105b4ac06368", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351633, "uuid": "983427c0-7ba6-46e3-bbb2-6b180b2952cc", "comment": "Malware payload (RiseProStealer)", "value": "20d9eff547ada1f06155614d11baf68c2ce73a13626ae6ca2feeb9129e75de97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351633, "uuid": "e5f26014-c54b-48c0-ad51-0f31c98c3b15", "comment": "Malware payload (RiseProStealer)", "value": "31b0472834fd2f006334c524fe72369e7a76ef28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351633, "uuid": "ab1dd296-4ae4-4e0e-8b4e-136f1a929062", "comment": "Malware payload (RiseProStealer)", "value": "df0531851f5bb072c6ff4aa0ba44083ab5ac4c624332697a2442b3db4fd807a9a32612a0ada7721814f2a5824ed5c262", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351633, "uuid": "7101d2d1-8741-4440-a310-d68c1812e090", "value": "T1425633016DC568E9C8A95AB48643FD1CB1B63E745060ED49B0983EFAC9F3A72CD77702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351633, "uuid": "f55ddd9b-4dfa-40a5-a916-10641662bb00", "value": "ba3f0285d69796596b811640139d3299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351633, "uuid": "6e8ff8bf-b663-4981-bf1e-01dbc0a884d4", "value": "98304:PsTQEzARqrOsPlODy8CniQRcALb2+NREq2uVZesk0HRL6/vl+rLJIhahLv2Bj:PxzUO8cy8/gcALizqb7esk0xG/0rLJwN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706351633, "uuid": "23d4c38d-1d65-4ce1-8212-b956f278d552", "value": 6145624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706351633, "uuid": "89c41cff-9330-45d0-8368-86899418d0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351633, "uuid": "e958b032-b7fc-47af-8a0e-b2aca27d13af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d26b4d-bd4a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706383876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706383876, "uuid": "b18e575e-b9a7-466d-9d6c-d5098e22f0c2", "comment": "Malware payload (RedLineStealer)", "value": "e102fe84451fa18c107fcada5c6baa92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706383876, "uuid": "d62e4a77-a6b4-4b03-8dc2-fb4d9d9bc794", "comment": "Malware payload (RedLineStealer)", "value": "28a3a0f8cc6cb42927aa1aa81a077020748a734acfe46412f06153deb23fa1de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706383876, "uuid": "553d2bee-5f96-440d-96d0-0e43de5a559f", "comment": "Malware payload (RedLineStealer)", "value": "f5add1918b1d81e044dccf9cdbd92ff9aa78a620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706383876, "uuid": "a89547b6-feb1-4ffd-a3a1-24c7225983e9", "comment": "Malware payload (RedLineStealer)", "value": "1874beadbbf1944c8ae7e0ca2163904438ad5b8e59593ad13484eed7b5b7bd5d5896c2a84f2acc084c652f5bfd865ce4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706383876, "uuid": "ee21a665-fdf8-47e2-8dbe-d9ceef9cfeeb", "value": "T17CB53320B091D272D4B704B146E48E5E997E34620BACE2E773E61BD91F713D2A7361CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706383876, "uuid": "b7bf9f97-bb66-4acc-95aa-224a8ca46b8d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706383876, "uuid": "e8b8d97c-43af-44d7-b8c8-5955a9970668", "value": "49152:qkQTAnh26CWxHi+q69KIuPtu8oc8xLpENEVABEZDaaDPV4E2rfV8bwVZzuuPB:qanh2WHtq69nR8oZLqbGXPKE2rswVou5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706383876, "uuid": "427fdd3a-238a-4fa0-8bd3-c93a7026c419", "value": 2409984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706383876, "uuid": "57ff34b0-d041-41c7-844d-6bd2ee04ed62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706383876, "uuid": "0309b60b-700e-4ce1-abcc-7639823d15d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f99329-bcbb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706322360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322360, "uuid": "3cc70eee-a5fe-41fd-a9d0-e9adc7835e91", "comment": "Malware payload", "value": "477eb13c7553467d21b7a504efd50c08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322360, "uuid": "5f678574-2b23-4a42-9d5b-7dd2b095cb22", "comment": "Malware payload", "value": "290a168b13753896da9f5aae39b224e4cc99d647e1f32465ff496659add55b8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322360, "uuid": "80aec5b8-3e0f-4ddf-8847-885d49462be4", "comment": "Malware payload", "value": "8c251509e717bdfb88670b93e8ba89d6b5c64afd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322360, "uuid": "fd5b528f-095a-4323-86e0-3df2a866cfdf", "comment": "Malware payload", "value": "774fe6ddade22c7e6f6a476a676e8a99080e9d262c1631f0815f2956ea48838b5d0d43189d9a00e5b14dd4e279729d0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322360, "uuid": "7aa5aea4-d533-4216-8d5e-ac4a2e68b269", "value": "T148141A5122A64CF5F0524A31D461C1B88372FC99E971E78E6FD0BE4B3DB37806D19B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322360, "uuid": "79fd7aa1-b59c-4dbe-ac6c-7c7df34974fe", "value": "ac841093869946745d711279d578cd22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322360, "uuid": "16fa8703-9b2e-4c0b-9288-50a554a97fa4", "value": "3072:HZUlUJ7TQqb/JiK2rYdaNEma2JbiDt4IYYudw89iONWj3:TRT1rsKOYda1JbiDtib9iONa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706322360, "uuid": "05df7295-959e-4920-8e96-f96eff8503b6", "value": 206336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706322360, "uuid": "15338263-ba76-40b6-8500-5d4947bc0a64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322360, "uuid": "f7c521aa-8335-465c-b53c-0d2159b992e7", "value": "SecuriteInfo.com.HEUR.30129.26832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf316bc-bce0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Quakbot)", "timestamp": 1706338310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338310, "uuid": "d8d4c983-046d-43b3-b5ff-87df41480937", "comment": "Malware payload (Quakbot)", "value": "041f11543edf5591a8fb7b0037e3d115", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338310, "uuid": "17b25476-cc9e-4972-ad3a-c2158d0b9454", "comment": "Malware payload (Quakbot)", "value": "2fb3da959196da5f5972b40e0e7a57571a42f4972a57f586d43318caedcde56d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338310, "uuid": "ff93a4cf-05ee-4cac-a6f3-91828687edd8", "comment": "Malware payload (Quakbot)", "value": "ee5fb2448d4437c2eaefdfb7cac13a0a2162a775", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338310, "uuid": "22cdd603-2371-4b37-a64c-7fb87c961155", "comment": "Malware payload (Quakbot)", "value": "6025bb76a9519669383c2678632078ca4a67f30802133dfe7fc6ebeaf660e1360d69aed417f50009afdad7f43113f6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338310, "uuid": "6eab2cfd-af42-48a3-bd90-8606e982be06", "value": "T114556A0AFBB891E5D0B6D438C552921AF6B1BC62CB3193CB5B51A72E1F332D09D3A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338310, "uuid": "be6fe6ed-2a60-4e90-a242-605a0807a9db", "value": "a638f6b413d02de0f382750aa46eeb04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338310, "uuid": "5c3fbbe5-a391-4e9b-8e61-409cfb6c28b6", "value": "24576:6H4G8P8VYqjxxT6qZk1rFrXc0lLF5HskwGpLF2:1G8P8VcrlcwLXPpL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338310, "uuid": "0303720d-00bd-48db-92d8-feb7fa3bfb74", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338310, "uuid": "268e6ce5-6638-431a-aba7-4abd47e63490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338310, "uuid": "79f6e8f3-97b3-41ee-ab3c-5f697739f3b9", "value": "041f11543edf5591a8fb7b0037e3d115.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3356b6f7-bd18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706362213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362213, "uuid": "8fc2508f-624c-49ac-ac07-64ea901fe135", "comment": "Malware payload (RedLineStealer)", "value": "cc01d46cdb44722824c54022605fd44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362213, "uuid": "fda200e4-b5b5-4334-8db6-600d4308b393", "comment": "Malware payload (RedLineStealer)", "value": "310cd7907252cf372d871027ecb3a3ba72aa24f23b78bc64e6c64cc5e8fff75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362213, "uuid": "76146645-f2b6-4bb2-accd-1aaa0aadb091", "comment": "Malware payload (RedLineStealer)", "value": "dab0fa8c842c30012248bfffc8a012b0de5468f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362213, "uuid": "df00dd50-d3ec-4dc8-81f4-4e2222000abd", "comment": "Malware payload (RedLineStealer)", "value": "1ad92ac37bd6153c520b62b1b90e1da3b1df74709ec38c372a5b857b1e13cdf568b7990873cd251f89eec2b2e7a81f3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362213, "uuid": "4958cdd3-0371-418a-9465-bca1b411b346", "value": "T10E945A9670B0825ED24D2E737E84D48CB94CBD8F54B72E63F453E0181E2A7A5A152FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362213, "uuid": "bcdd034a-cbc8-4335-bfa5-2e4305d1639c", "value": "06eb4d13e1bb2dcafbe526f4a64db1ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362213, "uuid": "ca5b43fc-341a-41e9-a0d9-e24824535a8f", "value": "6144:YfvWWw7mzrmTRSgDZIhww/3W3n3mhcMoVIokcsEifRBR565A4FKI:P75whDm33mhcrVbkzfRF65HFKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706362213, "uuid": "cfa3a940-46f5-4b94-a60f-dec2fe04cf86", "value": 444057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706362213, "uuid": "ad962a8f-0573-4b84-8004-be4c29750137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362213, "uuid": "fa170bb6-b39e-4b91-bcaa-5c7a9ce93e6a", "value": "cc01d46cdb44722824c54022605fd44a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e8a527-bcd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706332548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332548, "uuid": "74589f56-0573-4503-be00-6ac960bda970", "comment": "Malware payload", "value": "7a127bc7e8aca77a463ef7e77afef3aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332548, "uuid": "42748c89-277c-40bc-b5c9-998cdbfcfc5d", "comment": "Malware payload", "value": "37c861c6c37980c07f2072a7e997c79da250f1eb486a741b658205ea05f6aff8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332548, "uuid": "e365a63b-2b9d-4de1-9622-9b7eec27e829", "comment": "Malware payload", "value": "18eacb14deb4e76e06d1a335f5e9b66ef2f5fad8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332548, "uuid": "4c83a331-1c9d-4eb7-8450-dc22bccf4d55", "comment": "Malware payload", "value": "3fc56a4ea32811fbe2d1c4b5e5df5377ff94d25301af173739429e666629358815778112c23b24287287bd4ed52b2e87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332548, "uuid": "1f467892-3106-4a1e-867d-fde428875f78", "value": "T147159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332548, "uuid": "c4ac9c20-1b8e-4b81-b7f2-54950442f677", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332548, "uuid": "9c619132-d26a-4650-a66b-b6d965442aa8", "value": "12288:gqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaT8:gqDEvCTbMWu7rQYlBQcBiT6rprG8aq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706332548, "uuid": "305edd84-33ea-496d-a186-7ee1d282338a", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706332548, "uuid": "0db2d0ce-d3ad-4ca9-8930-5e343c12ac4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332548, "uuid": "be309be1-b600-4631-8da4-de44ab68670f", "value": "7a127bc7e8aca77a463ef7e77afef3aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fee4748-bce0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706338236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338236, "uuid": "84c21519-357c-4768-9703-65c315a2931a", "comment": "Malware payload (Gafgyt)", "value": "8a88342741b54b47aa5a59d4685bf021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338236, "uuid": "7cc792fd-9788-4d0a-b079-a0e02fc9d112", "comment": "Malware payload (Gafgyt)", "value": "3b3343086810e34fb7e8a8db499eb06e9a88d5e93cb8aa6e37f08b278a2d12a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338236, "uuid": "f68b33c6-f6ee-46d2-861a-e80449fbd823", "comment": "Malware payload (Gafgyt)", "value": "48a2cbb91a8ead9044d51ad416ae04883f65b89c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338236, "uuid": "16438cc9-ad57-4c3b-97b6-9fb630f65a52", "comment": "Malware payload (Gafgyt)", "value": "a89355428b265364287e6a0300238471e15b6697683ce304df4f9570206e4a85696a9f6ad266718b41bf5f184d814805", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338236, "uuid": "fe0422c7-722f-46a1-a446-c0f6dd6ae014", "value": "T14CB3B617BB618FB7C85FCE330A9A4901148DA19612D97B6FB2B4CA6CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338236, "uuid": "f5423acb-300c-462c-9dc2-4fc42bf7005e", "value": "3072:AQyObdjiB3YpISJj2eYUmkiCFx1DKxmgQ:AQpiBoaSJShUmkiCFx1DKxmgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338236, "uuid": "dc7f6388-ff60-4f3b-a4b2-31f871098bd6", "value": 117624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338236, "uuid": "3c916111-7f7d-45f0-abde-b1190371b70d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338236, "uuid": "516d5573-c520-4c21-b558-04f0feb811c3", "value": "8a88342741b54b47aa5a59d4685bf021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328c8f11-bd47-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706382398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706382398, "uuid": "efd8fc2a-6ad7-41f5-b3a4-df4339df1436", "comment": "Malware payload (RedLineStealer)", "value": "e8380bc9b2f40bd77f5c04bd813a0891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706382398, "uuid": "757e4161-0b70-42ff-8225-d4df7ca50319", "comment": "Malware payload (RedLineStealer)", "value": "3db1d34ce78087781d08707c1b574b584bb8cdb9ed1df94275b68fb3250c4918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706382398, "uuid": "6134b61a-964c-4840-91f8-0d29f59d394b", "comment": "Malware payload (RedLineStealer)", "value": "9b85d82536135788f1d0667d1244be56544997e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706382398, "uuid": "470fb35f-586b-42e2-80b8-c499ddf927e3", "comment": "Malware payload (RedLineStealer)", "value": "724791d2f3524f3534cdc863ee91d43f8a258ecee50871d0b3493a08f915a4c978eef82c6274ef02676d413a9f3be42d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706382398, "uuid": "1166a688-222f-4e17-b57e-51fe560c5d3f", "value": "T11F652350B4C1C2B1E4BA107404E5DB2D9A7770320BAA92FBFEDE26B5BE212D163751CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706382398, "uuid": "6992a302-47f3-4d70-a411-197162bfaa24", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706382398, "uuid": "761ff59c-5deb-47ef-84ea-905ac23d1c9a", "value": "24576:pk70TrcObVMrZOfl3xnUWoKGYQMEy/2GjmL/d5LphY6p39X1lB6Yp6E:pkQTAvrZOfl3xnUv1YQB/fd537p3NXBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706382398, "uuid": "8690a1b6-e91c-47e1-82bf-678f0b221b01", "value": 1471488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706382398, "uuid": "05b6aee5-e62f-43bd-916a-1c261ed7250a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706382398, "uuid": "95d4e1bb-a05b-424d-af9a-5428d9abea1b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343636f6-bd6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706397863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397863, "uuid": "474344b0-1e2c-4b87-bf9e-be93b0a1ed33", "comment": "Malware payload", "value": "16728116244bab4558d49b9c50b03ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397863, "uuid": "edce6858-a8b9-4bfe-9494-48d1d252a29c", "comment": "Malware payload", "value": "3e133d377e35c3e536326356919cc8c7fcd657ef904c55812af4afec4ce2108a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397863, "uuid": "5de30cd1-810d-4355-993d-318a2682aff1", "comment": "Malware payload", "value": "c53a949c2ca23ae30f7cb7d8cab9b18891a8f917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397863, "uuid": "4ee7dee9-b965-49ac-9f91-686fa456d786", "comment": "Malware payload", "value": "c6757c9a45526c408f55b50c988621fc272e1dc74c8384628a60e33cb348e2b2938045ac2441f70fd7cd514d6f0718b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397863, "uuid": "754b12d0-e697-45b2-a429-8a7d6df336d3", "value": "T10B4633A28B5858AFE2F242F01E8A574D8FE3BE3510BFA444710C9DBD2F63240D55E697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397863, "uuid": "6f504a82-7d60-422f-a136-9b654a23028e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397863, "uuid": "9cf3833e-49d8-4aab-a78b-744e54e25289", "value": "98304:yPcyXO0i3rZqHdFE938IYVJuWV5k0A6moeKwHDs6BAF8FzTM8eWkFdQXiqDO:VyXOp3rcHdCB8Nu0NmhKwIkAF8FcHdFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706397863, "uuid": "6d3a8430-96a0-4f05-976a-475458558fc4", "value": 5357472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706397863, "uuid": "befd9e0c-5767-452a-a1e3-e827436d1a9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397863, "uuid": "dafe26d8-4729-4388-b21d-9fddc4258353", "value": "SecuriteInfo.com.PUA.Ccproxy.10535.31162", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e4e31d-bcbb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1706322361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322361, "uuid": "95c99e23-715c-4094-85a8-945f93077486", "comment": "Malware payload (Adware.Generic)", "value": "e7f805e8d4189985a8b8fe7eb6465abb", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322361, "uuid": "615ecdd1-2b89-43f3-8030-46ffa70ad9d6", "comment": "Malware payload (Adware.Generic)", "value": "3e351c9539f378974d7ce22e8a898a1124fa8c2f85d75722ae9ab75c81ca2fa4", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322361, "uuid": "52d0f338-401b-4c70-92ea-626ac403155b", "comment": "Malware payload (Adware.Generic)", "value": "ccb738c40a560446b5be971fd781dc3c67aaa4d7", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322361, "uuid": "917aced8-fac1-4886-ad9f-3fbe8d0f13d8", "comment": "Malware payload (Adware.Generic)", "value": "3162ffca2b02534f59640bc39a1f3f6e4e8773e52043eba15c5d750f592bf10b0ea34fb0cac9c15adf5e2a849076bdee", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322361, "uuid": "950a4b23-6cb5-49d6-9b74-1f94cbc1bbb1", "value": "T1EAB5333D23C090F9CDE1963DFB17677C218D9F44E5F53AAB3A343948A9C3107AA09296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322361, "uuid": "c76ec0eb-9336-44bd-abe9-e08f12feb1c7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322361, "uuid": "04a93089-6a58-44f6-b710-5ff3239b7c7f", "value": "49152:Z1F9aOduy1MiMSU9iLgKgWMA3UK+qDn7veNw5:LFwbNZSAiLgKjkSn7v75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706322361, "uuid": "d63d8c16-24e3-4321-97d3-d35230416d25", "value": 2314565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706322361, "uuid": "2c09bf0d-bf49-4b7a-b046-8577d098fd9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322361, "uuid": "42d80d56-0240-4bc2-8a71-627f20ad75d6", "value": "SecuriteInfo.com.FileRepMetagen.19201.28751", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13d5ce98-bcf5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706347128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706347128, "uuid": "9dc147f6-bd6b-4fb2-a048-a217d7337039", "comment": "Malware payload", "value": "825624da2ba3d8fbff30c22c1300d8e9", "object_relation": "md5", "Tag": [ { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706347128, "uuid": "395abb5d-829d-476c-8ae2-bbb3bb6288ab", "comment": "Malware payload", "value": "3e82e5b8295da7738361b1002aa611b7e66e017a0bfbdc7bd8f7274d3d0766ba", "object_relation": "sha256", "Tag": [ { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706347128, "uuid": "98f8be80-d83b-44f7-9e45-e280060ba48f", "comment": "Malware payload", "value": "6833d7c18e5fef3a90ea8f979cf5591b3133e99a", "object_relation": "sha1", "Tag": [ { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706347128, "uuid": "0bd6a522-a628-4fd8-b935-d6f5b3a58b4c", "comment": "Malware payload", "value": "92ff4c72288122bce56549f26dac551fbaf5a2f1df91c722de0b35d4a344164912c438c3241cfde9c14e37b94f1d5e1a", "object_relation": "sha3-384", "Tag": [ { "name": "cheatlab.tech", "colour": "#B5EF2C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706347128, "uuid": "735f56d6-c128-48e1-8488-9251ac509440", "value": "T11DC5BE1A358AC637FB7E82316679D77A21BA7EE04BB200DB63C43A5A1E705C10275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706347128, "uuid": "3108afaa-7558-40be-9ca4-c2ff60cdcf70", "value": "49152:KOhedtZKumZraq4Fb6HXr1iWnYs4ntHurpllQ6aduxtZGoI2C3iq6zcX:sVKuFnWnwuxHImq64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706347128, "uuid": "f0e718a0-2d4b-47cc-adbe-fd2f3e82c574", "value": 2539520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706347128, "uuid": "ede0df92-cc52-42fe-ab26-503e53779bb0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706347128, "uuid": "c28d1b5b-c9aa-42a7-8673-0d0bb6983621", "value": "Cheat.Lab.2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130acfa6-bcee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706344120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344120, "uuid": "3dbebbf8-64f8-46ea-8295-dc6558da953b", "comment": "Malware payload", "value": "1e0455e563330712ba6a2d17ff104796", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344120, "uuid": "10dcd79c-d5d8-49c8-9826-e25d2808953f", "comment": "Malware payload", "value": "402063107f089f2002224e6ab857959937232dd782d74883ba3ebed94feb813b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344120, "uuid": "06fb3730-19a2-474e-b403-ad0fe53d8741", "comment": "Malware payload", "value": "e98bb7b728e007bc02ae758653ad6772890e99f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344120, "uuid": "615963ec-7479-4740-93e4-2555c88fd03f", "comment": "Malware payload", "value": "23c4eb5ed8ed365af38f4c151cd896d8190fd775e3b233152d99be223dcf0f5747f15575eb04b51d756a34e4de9a673c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344120, "uuid": "65860bd9-84ce-46a3-9e7b-9537d590d3ea", "value": "T17D35C09E73DE8BABD057877CDEA0F623A5F03D10266173CB7785541E2BA25C088E471A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344120, "uuid": "a3f91f88-2575-4424-a004-7db011d77948", "value": "6a3f9a33709b4615f31fbb85fb7b5286", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344120, "uuid": "4f5e2f63-6b36-4b89-b0a0-fd8b29f9040c", "value": "12288:1FLuW1ja2vHm0lCoz761AFTSpkP2cUxCj2AqeMQmT6TnSEl1yt6zzng0Lim6TnS3:zLH1G2v961AFTSpkPJuGKF0RiPR5nW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344120, "uuid": "52b288ca-f0ca-4bb4-aa9c-785e43e3fbe1", "value": 1079808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344120, "uuid": "bf11f7ba-03a7-4a78-b028-f09dc4149107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344120, "uuid": "35e7faea-9c30-4a03-97a7-1ad667146dd4", "value": "SecuriteInfo.com.Trojan.GenericKD.70862377.15664.8191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7ba1baa-bd61-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706393761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393761, "uuid": "ae2b2900-82c2-4f1d-99ef-1ec3147076ff", "comment": "Malware payload", "value": "8803d517ac24b157431d8a462302b400", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393761, "uuid": "4099d364-e7f4-403c-a49e-4e83fe25ee29", "comment": "Malware payload", "value": "418395efd269bc6534e02c92cb2c568631ada6e54bc55ade4e4a5986605ff786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393761, "uuid": "a3ac30b2-bc84-4158-9360-b372ca3a94ee", "comment": "Malware payload", "value": "b56afcad22e8cda4d0e2a98808b8e8c5a1059d4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393761, "uuid": "44f9277d-c517-4205-b778-e2fd97676e95", "comment": "Malware payload", "value": "c76d99cbb3a9da2a7e6909323ed25041fb5433de093f45f8fa9cee20f35836604a5ba058e764b8abdccb57c66bef1999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393761, "uuid": "0160d175-7a1f-43e9-93ab-126249009a50", "value": "T142145C99571213AFEE3434BF886523DC5A816F750F068542275A7E2313F62F4A2BC3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393761, "uuid": "8c15b2a7-4654-4f8f-b16f-b3fab780efbd", "value": "3072:slkfrcHVaq65Oe/ALwm19MYDzMLGquSOt+nSmgevSvoWAnvN0bfINcfln8rvK:Wkfrc0q47/UwQFSFnH9SArvakSflnCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706393761, "uuid": "73935922-4f3f-4cd4-8176-f72d249569c8", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706393761, "uuid": "b009835a-f537-474c-988c-ef48a82a6761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393761, "uuid": "5131b7e3-9ae3-466d-a2d9-813f6afbb28d", "value": "ViraLock.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a8d6c0-bd0d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706357660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706357660, "uuid": "170f856a-1a60-4423-b474-fd437c235cdd", "comment": "Malware payload", "value": "fa6e299d96a8fea5feae066ef519f949", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706357660, "uuid": "6d8ca02e-dfbd-4040-8544-b7818f2d2e7f", "comment": "Malware payload", "value": "42abf22fdacec112a1e430668011d008ae41f0265989c49e5ee9af43f4fbdd00", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706357660, "uuid": "928624c0-2478-4f9b-aab0-6bc4ebb5622f", "comment": "Malware payload", "value": "6858f3e740faa4db30bf3c3f1f9aadd4799f5cdd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706357660, "uuid": "47ed1fdf-71bf-4721-a242-2becea9c64e3", "comment": "Malware payload", "value": "10b1fbded307fdd02c68b8ecede30f0c0cb3ecffa920554aa8ce9670e583e157c7d7770591e4f8aef34b3748105f1f1b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706357660, "uuid": "2fbfb031-86b5-498b-a5fa-95bd2e9de8f2", "value": "T1DAE35C46EA418B13C4D62779BBDF42553323AB54D3EB23068528BFB43F8679B4E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706357660, "uuid": "0dd7d840-7819-48cf-b826-ca7cd03cf363", "value": "3072:9gWXEd44zmQr25WstO51s6S1vkR74Of9/T1sZM/9N0:xXEd4CtKO51s6SVkR7NfxT1+M/9N0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706357660, "uuid": "64812da2-b0c7-468d-8f20-02092bba3ac7", "value": 151758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706357660, "uuid": "8e0039dc-28d0-42a5-b7bb-1a018b035d29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706357660, "uuid": "29d49495-d151-40fa-b6df-46ede37ef48d", "value": "kfcarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03052c0-bcdf-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706337941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337941, "uuid": "81fb7113-0718-4311-8169-29df12807e83", "comment": "Malware payload", "value": "48214bd1045c0cd572c0de77d79c6642", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337941, "uuid": "f65bdef7-c524-4d5c-9f93-91ae9ccb7191", "comment": "Malware payload", "value": "433e61ffbe1e1d8a64097d0f063bfcb9c22f23626cdfcb8a679bae080c172aa8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337941, "uuid": "a9370480-4143-4f7e-abe3-fef8c4a41ab0", "comment": "Malware payload", "value": "63dcb0598064f860ad196bbefaba5c15c4a8b2cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337941, "uuid": "2533479f-21c2-4055-839c-b2991edac14f", "comment": "Malware payload", "value": "b17c7815c1833e49cb9f5fa583250c32795dbf3cb6cfc5aa86afd980398977114521e5d7af7c34f59c1fb2b597054f00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337941, "uuid": "4f48e0b3-2bfc-4bfe-923d-fe7e0ae6995b", "value": "T1C9533B09B3879330CAB54AB9C0F3C4611AF1978B6573D74A398052CA4E227E6DF4F74A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337941, "uuid": "dc673d25-3302-4362-8c21-613cde90358c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337941, "uuid": "4be97bd1-ea32-49a1-ba6e-11fe777bdc04", "value": "1536:T4dBK2bcukuCwgzqavWg0BLW8vPhfimq3LM:TyguAw8uA8vP1iY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706337941, "uuid": "a9e5e0e3-cb96-480f-8dd1-bdcb427bae5b", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706337941, "uuid": "9c79ea35-a04a-4309-a552-4536be69f033", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337941, "uuid": "2a0d168c-2967-4df1-ba37-2fb54aefa334", "value": "48214bd1045c0cd572c0de77d79c6642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e41581e-bccc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329563, "uuid": "67cdd1e2-3386-4c17-84ad-890fde74c461", "comment": "Malware payload", "value": "d59abf58f353b9cf0aad303a59433569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329563, "uuid": "66666bba-8990-44aa-9f8e-6882cd7c24ae", "comment": "Malware payload", "value": "45713edb584d9cac094ef01425dddcae633169d009faedc91dea1170d6574772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329563, "uuid": "b3d1f99d-65b5-4bda-8923-85a68da66a51", "comment": "Malware payload", "value": "b538ac83398df8758d95b6f4b1f950cf2df8f52a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329563, "uuid": "bd033cdb-ada4-465d-af7b-f7a6e6193ef8", "comment": "Malware payload", "value": "087ed0ff51273a77a00deeefdfc7a1647e12e4f2427080c12551ffdb45927a97adf0d90c9f9f7f0cb82a7be70aa2e7c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329563, "uuid": "53df67d8-aa80-450a-ab27-b7dfa0dd99a5", "value": "T1B1C523027AD29A73C53328336A56CF20997E7D705F3149CB23A0A96DDE621C1CA35F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329563, "uuid": "603d1cb8-5a2b-4790-bb8e-2eb801d0604f", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329563, "uuid": "87eda745-03b0-494c-a1ef-a0f3dab5a80e", "value": "49152:sILfRQmfU3w039un+lIyPYA3y0MGHqzIV3Zd2GS6eUGrEOUnkMqJ:suRQCONnKyPZi0M3zG3Lt/GrE12J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329563, "uuid": "6f4ae42c-655d-48dc-87da-7e43a94201ba", "value": 2648640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329563, "uuid": "e5f039ed-55b3-4fe6-bc1a-7a8ac347d2cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329563, "uuid": "ec069f37-c8ea-4961-a3b8-39a16b0bda8f", "value": "SecuriteInfo.com.Trojan.MulDrop24.49980.21384.9329", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed31792-bcc3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DanaBot)", "timestamp": 1706326047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326047, "uuid": "6639f128-e0a9-4847-aa31-ae021ffab503", "comment": "Malware payload (DanaBot)", "value": "1981d32f46e9459ba246a6bdb88b7f89", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326047, "uuid": "1c214baf-b70d-4e26-8286-e959fbddd67c", "comment": "Malware payload (DanaBot)", "value": "4c5153ad7f6ef0df76c5d38d7d4ec63be81f80d5382adef6be2feac0b4e94553", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326047, "uuid": "1c9b3cac-6636-4be0-b979-5b06a83190e8", "comment": "Malware payload (DanaBot)", "value": "51619bdc1748cdeb2c59db9dfe7c65c99902af21", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326047, "uuid": "c9cc1750-e23e-4b4b-a1fc-4916341617a7", "comment": "Malware payload (DanaBot)", "value": "560034ef9b92cd7fff8804631815cc22802961498e15e7366528a82db0dc1d5e28ab51594ee40a097079aa9f46fc75a9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326047, "uuid": "48582d2d-f170-4070-bb4d-b6a4e1de3be7", "value": "T160C633456690748AC92109F657C48A6CFBE48CD9278307373154FB6FFFFE1225B9A2A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326047, "uuid": "8a72c7d6-b2d5-443e-8e42-b6247dd247d1", "value": "042491f371a46ee8ab293842ff18379c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326047, "uuid": "4554cadc-3e23-44bb-81a8-0d75e60b5be3", "value": "196608:yLy4oyGnPOEPZ2Q0PSbrBmiAbwNQ/m7DCgxxwNUnml2jogb0GRPTQus:h4oyGnbPkLlioUC6xznmgjog4uTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706326047, "uuid": "89186d62-ff1a-4196-9fad-9318a6227bb9", "value": 12520616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706326047, "uuid": "418e3d7b-7bda-4d55-b4b3-098c8c25adfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326047, "uuid": "ace1eb68-16a2-49a6-9de8-d53321ee45d0", "value": "SecuriteInfo.com.Trojan.Siggen22.3888.7297.3339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131541b4-bcde-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1706337248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337248, "uuid": "b6d971b9-7356-444f-b6c9-e360bfb6437a", "comment": "Malware payload (RemcosRAT)", "value": "9567a898f2ecf952f8817787e6ef5701", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337248, "uuid": "044fd8a7-c7fc-4978-b6c3-99fcb1a439c9", "comment": "Malware payload (RemcosRAT)", "value": "4d63da19dcd26f061f8d68c63ac1f2bbda04042fd07424242d8813b1bf11abd4", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337248, "uuid": "054d54ef-5d38-4fa0-82fa-8d3bf578c1cb", "comment": "Malware payload (RemcosRAT)", "value": "c9f19d2f1a232fc716ccfeb136559151845f4921", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337248, "uuid": "9aa99325-13c2-46e7-8a7d-e3be490289e8", "comment": "Malware payload (RemcosRAT)", "value": "7a8d32b714d66feb03e61bc59d203f8ba9593342a27a9b5276954ebfd0e92f6efb0478c10913247213c648ac2b29fb6d", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337248, "uuid": "c2b1289c-f88c-464e-99a4-a43d0cf08abd", "value": "T114B49E01BAD1C072D57524300D36F776EAB8BD2028364A7BB3D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337248, "uuid": "ad9c158b-5ee6-4b34-8cee-5b9292887453", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337248, "uuid": "0821b5c4-a471-4a96-9724-4f307e34d656", "value": "6144:8XIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZsAX4cNsnQ5Gv:8X7tPMK8ctGe4Dzl4h2QnuPs/ZsHQcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706337248, "uuid": "126def07-2645-4af0-a53a-f67161eb1b5e", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706337248, "uuid": "6f5c38d4-cb94-4e82-b5b1-62737101025f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337248, "uuid": "5e65236c-acdd-46aa-bd20-6f4d87756983", "value": "1706337246e0bdc21402c6a619102441d22b88b5e575fec496e24e6103b62132e77ef31042946.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2caceb4-bcdf-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1706337945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337945, "uuid": "ec560158-9bbe-4de9-87d9-7e1d862d9e8e", "comment": "Malware payload (GCleaner)", "value": "5432cd10140f359f17394c8e2340299c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337945, "uuid": "7704fbcc-6237-43c8-b4ef-5384bf1337d6", "comment": "Malware payload (GCleaner)", "value": "4e3934e65b6c2ea6be580d375f4515edf20643d88b5f83db63d2c0ad70ba0398", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337945, "uuid": "7aff9350-2152-406a-9f01-f891b1d357d6", "comment": "Malware payload (GCleaner)", "value": "16ad79a097ff19b5089aff81b6bfa1a664affb18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337945, "uuid": "d07a416a-ebaa-46f2-aaf5-4f175588ae56", "comment": "Malware payload (GCleaner)", "value": "30f66f5f57adaffa9138688c100d8197bb55ab699f7793ae922cd846d0a63900486c66bc2fc986afd9de9698e32608d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337945, "uuid": "a666c9b6-c2fd-47c5-8d5c-74b85ba6859f", "value": "T18C16D06A7B50DF66CB9E623AD0824554CFE0D8BA0362F7475724B9BC084F311ED4E89E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337945, "uuid": "961d53cb-15ca-4aec-a59c-be1eff7ae44d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337945, "uuid": "a74d63ad-8b05-4665-8e41-3ea4b7f8c5b9", "value": "98304:7ScbaLQaS+m0bcbE+1AZ1bpVDHBz/waoVNVncpH/s6i47:mn50N1AZ1dVLZwaoHxcpfm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706337945, "uuid": "36f7bd89-1972-45dc-8a6f-46ad0b0ddbd2", "value": 4338920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706337945, "uuid": "15439665-ddde-4554-802f-8f3756b72893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337945, "uuid": "45204592-b999-45dd-a31f-0b29eb25242f", "value": "5432cd10140f359f17394c8e2340299c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fa88e0-bccc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329567, "uuid": "1c0fca14-4648-459f-a8d0-5bd28ede9fc2", "comment": "Malware payload", "value": "4d40a09834a1192aa356d5c6abd5779a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329567, "uuid": "36df1c07-d9af-4460-8470-1ed27f30984e", "comment": "Malware payload", "value": "5049183586d39ad3c3ccb62021ea8821ebb460822ae6f0ab7bdd35978b32a99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329567, "uuid": "d0b60d13-ecb5-42fa-ab58-0cac35c8ec02", "comment": "Malware payload", "value": "1b7fd3a3fcff7ab0a6b4991e9bc1aa2858490c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329567, "uuid": "6fabdc53-69f4-462d-9d4c-75250ff71c21", "comment": "Malware payload", "value": "6c221ea805a81771880859bb60e99413bf8a0c99567cf4400cfa310bfe0bea815ad60d72b1bb629586b4e6def4ba28b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329567, "uuid": "7c05094c-04df-4363-8be9-04e0f97cfeed", "value": "T17B073352F286D0B1DD7213F098994211ABFB3E604E7B9D2F9BD80E1D5D3B6A09F21352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329567, "uuid": "f3f7417a-729f-4fe4-80ea-2963e9b94bc6", "value": "49c6b21891d7c24dacee0ba3ca0f123e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329567, "uuid": "e681ea9d-ee3d-4e01-a668-351a167dabfc", "value": "393216:WBI0m4GBjl8cuN6/NpJDfvfFbHnpA49H2BITA6psXd23F:Wi4elBnlHWuHGufpr3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329567, "uuid": "107201d2-d3a2-4392-9c12-dbb70a7eb69b", "value": 16847288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329567, "uuid": "4c787922-1302-4980-815a-dd61daa382cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329567, "uuid": "db869272-b8e6-4311-8686-9a142ce0d1b4", "value": "SecuriteInfo.com.PUA.Smartspace.28218.17465", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1b1322-bccc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329564, "uuid": "bb73c627-a975-4b59-9a0c-46aa9fdec645", "comment": "Malware payload", "value": "fe14f93f5a312f5729a72530628e04dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329564, "uuid": "9743070d-78ec-48c8-9b1d-503ef578cd01", "comment": "Malware payload", "value": "53c649260e60adf10397b1616af5785771d161ee1978d59972aebcf786d85fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329564, "uuid": "49984c2e-2050-42c3-a8aa-e05775912bfb", "comment": "Malware payload", "value": "6c03dcd1193e92ce4f40c54be86fb862bafb5177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329564, "uuid": "f8cd8c8b-7c54-4bc2-a00d-fe0b39f33b7e", "comment": "Malware payload", "value": "745120fd43f018866d47678f4b3bc77b8c6c7321ea544738eb060aae9ca3d0503e53261d66faf6d8e5bb104ce6db8515", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329564, "uuid": "003fa2ac-a0af-498f-8f0c-86b20a7c54d8", "value": "T1DEE5D1B3F512C0B2E45349749CADAB654478AEB8432456D7E3D83F3D49312F2263A1BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329564, "uuid": "fc1c47eb-570b-46fc-a6fc-2dc917b9968e", "value": "e1a31a6a9fc27fd6027fcca01fd05fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329564, "uuid": "5b6b8e4b-eab3-45de-a980-172223c1c239", "value": "49152:vimEyC1+ZN3dIzcx2etTZf0JP3Jl7sYdXHuSmsgyFXTAHDiD28ce/b:qzyCwizcx2er0RQ9sHFADi6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329564, "uuid": "dfc6526c-de17-445e-8976-f490433c0de3", "value": 3054408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329564, "uuid": "98485de9-8370-4da0-b079-ec50ce340c74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329564, "uuid": "118ca3ee-ba63-44f9-a208-c4b7b2c32c0d", "value": "SecuriteInfo.com.FileRepPup.28602.10942", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2151d0-bced-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706343729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706343729, "uuid": "9b851643-a92b-4e43-89ab-c98d3fea7a63", "comment": "Malware payload", "value": "175d5203e4726fab41169d2cebe176a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706343729, "uuid": "436613c6-f1cf-41b7-ab51-7799d8e888c0", "comment": "Malware payload", "value": "556b43b3d14cfebee0942575df8a08059fb6c0ab4454654e22dae3f5fbbf45f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706343729, "uuid": "b638878e-ae72-436b-a1e4-ad066392d058", "comment": "Malware payload", "value": "f35554f71ed0f2f9c94ba20899c97ec98f2594de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706343729, "uuid": "01b587a8-c4e0-4ac2-9b5a-706fc0a83c44", "comment": "Malware payload", "value": "d2e38b68e89a380715a89ffabb85f02ddbf9b057f57f2899893e43daaacbdf07af7c691a36913ee313d3d3d5e57b8cc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706343729, "uuid": "ff9fd88b-42cc-4dd4-b0d8-e790989e42ad", "value": "T14C534B09B78BD730D6640EB890E3D42107F697876673D79E7EC412CA0E52BD19E43B8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706343729, "uuid": "b30c5bcd-6efa-4878-9c48-d29db718d8ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706343729, "uuid": "bd0746e3-e501-4553-8ab3-8a64e24dbab9", "value": "768:i7E8/1/F2cMtCj3tMZ0JjWPxM2kaJz1/Ykh5gRzXvDh1zVZAGN0a2ftS:iYK7LMtidJjWPx9/nYkPubpZru/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706343729, "uuid": "24953808-8f3c-4449-93d9-048649cafaa3", "value": 62976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706343729, "uuid": "3610b9da-69dd-4041-bcb1-7aee80b8c3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706343729, "uuid": "a46e37b0-2124-46cd-bc51-389b600c468a", "value": "175d5203e4726fab41169d2cebe176a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9a138f-bd34-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706374227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706374227, "uuid": "c5e825d2-8fbd-4fd1-b05a-2b9a2391d1b3", "comment": "Malware payload", "value": "3016285c9eb979ba1703d25012457567", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706374227, "uuid": "eb0a9f63-25ce-40b6-8ea3-65c1a191fb69", "comment": "Malware payload", "value": "5f064000c7676369171bbec324f5384d014f5f74c56d71f1329b4c6cc1a9724d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706374227, "uuid": "c529dd60-bb29-4b60-b6d9-5e66d36921c1", "comment": "Malware payload", "value": "61575b3ee417204cbb26c3f33daa88e9effb2fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706374227, "uuid": "2771050f-dbcc-4937-8693-0413811f3758", "comment": "Malware payload", "value": "fc6df07549573d43b7e2ca80d2777b338391d636e9bed9bf8356a126c5fb4d260cbe9534bcc77d56b722b9b37db227ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706374227, "uuid": "cb883279-6b96-445d-9898-53dcfe6b4a90", "value": "T1B965AF0ABBEA922ADA736574DF3582655E3BBD400711C7D7A2E03A094F34DD17D322A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706374227, "uuid": "b0cd4931-02d6-4a30-83a1-3bfa8d34192d", "value": "14c198737dea646ad253084b784990ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706374227, "uuid": "229e9375-154d-411f-a192-35854f84ee58", "value": "24576:PL/7n6lbcC8oblb1zj1SqdAGFQZIxHC45UJoePI:P6+C8o5ZzjYq+ZIdL5UJoeg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706374227, "uuid": "9cd619e9-878e-420d-b02d-379af2fb79f2", "value": 1488104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706374227, "uuid": "41f8248b-2fe4-49a9-b308-39e3bd329a33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706374227, "uuid": "a844fc2c-ce8e-4ece-a719-9742312de375", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210391ee-bd20-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706365618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365618, "uuid": "8e1cab0d-b150-4889-a643-d989e8c1c727", "comment": "Malware payload", "value": "000255007fd86a8177f0960870e5245e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365618, "uuid": "1e5cb32a-6818-493b-b8e6-e68afc053a9e", "comment": "Malware payload", "value": "5f0faa1e30e0a1e6d0edd916152ad7602a01fac5b61d16babb86f50b6f45bfd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365618, "uuid": "7462e1e2-8cb2-4eb2-a042-215637ff77b2", "comment": "Malware payload", "value": "49f9086e22bb0f5a3a41aab95d51fd47bcf58f0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365618, "uuid": "ce5f2738-70fc-40d9-bc8d-9e95ca866e3f", "comment": "Malware payload", "value": "5b46dc0096341784d787bbb46742776f079ea26bd35b84efadf2a11ef859709f724307717eadd4a946c3a70abba6ddfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365618, "uuid": "2fff17af-27e9-4b43-b18a-c6c77602ba8f", "value": "T13356232752261140D0E8CC3A8937BEE475FB2F6BDB80E475A8E5B9C237329D1DA17943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365618, "uuid": "7a5aee31-08bb-4865-a252-b9957ef331e9", "value": "a9f526617cf661431e6b5984b2cfe00c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365618, "uuid": "54330c63-cff5-43e2-8a18-44448d1d9efb", "value": "98304:fHoz60q4r1Vgvwdjo6ExOg9Yw9LqexRfzAh9mOjHkdmVFOheDJMmUn23HyL38bwT:wz60q4pSvwdjo8g9YwtxRfm9mOE0D+rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706365618, "uuid": "f46985d9-5bef-4385-841d-97fc25dce15e", "value": 6226944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706365618, "uuid": "1cdc5676-580e-4ef3-8189-ae6d490e6efe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365618, "uuid": "b72aae9e-5c9b-4ee7-918c-58c76f269623", "value": "SecuriteInfo.com.Win32.MalwareX-gen.15198.13018", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10122a8b-bcee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706344115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344115, "uuid": "cbd8e2a5-ece9-4b41-a170-0ef2dca10e9b", "comment": "Malware payload (AgentTesla)", "value": "d11336cb6dcf6b17f184e07d4349872c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344115, "uuid": "9170a9eb-286a-45d7-9d34-001c04d04dc2", "comment": "Malware payload (AgentTesla)", "value": "612d82ca739d3b1d4e76eed256652110ae019bf91776919edf9fff090c59fbe2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344115, "uuid": "c963c115-e5e6-4288-bfb0-50bd4f384e56", "comment": "Malware payload (AgentTesla)", "value": "8bebf5c9b56e6b9076eae90d20aaf34c03cb43cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344115, "uuid": "841d77a3-337d-4799-87ae-478d1d74b981", "comment": "Malware payload (AgentTesla)", "value": "46e8a470b1fdf3d00a70109b54cdd80a1b6fa184d3c519dbec944452a27f9212d7750bb6c145c762a63f3981038b5d73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344115, "uuid": "8357f4c0-4ec7-4cd2-b4cb-138075b7e5a3", "value": "T10C5512275B8479A7C91126BE10D6DA8507AEFFEFA3F2845C3DD6BE3C6B821744500790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344115, "uuid": "986dcfd0-8a6f-4e3a-a236-76e5826ab345", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344115, "uuid": "26a6246c-ea93-43ff-9ea9-c2522eaa7fb5", "value": "24576:g0lmdMITMvRFhRRbNWoCfkYSEH3OqtwIuXjxIPiPsgK:ZlmdMITYbNbNWo4kSH3OqtwIqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344115, "uuid": "e5af044c-2d08-4030-908c-06f12d6d9956", "value": 1373696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344115, "uuid": "f98e9f6c-e845-4d1c-af71-030cbf438859", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344115, "uuid": "541d2300-27a1-45da-ab94-9cadc32691a5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.31621.15967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a97031-bce0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706338212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338212, "uuid": "bd6b0800-1651-40df-81da-8afb7672e242", "comment": "Malware payload (Gafgyt)", "value": "4fee22711001d07c0e31ad1168f71270", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338212, "uuid": "b2ac9801-39fe-489e-afc2-6c499b56c979", "comment": "Malware payload (Gafgyt)", "value": "64e8579dff273c439873f0d3fcf151caa54f430c2e93f481442176b6ce608d08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338212, "uuid": "b9b0a94b-d6e0-422e-8ea9-e613c137c2c3", "comment": "Malware payload (Gafgyt)", "value": "709166b7a1b553c17710400c4a767dfd9a3a75b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338212, "uuid": "5258545d-38be-42c5-915b-426b425446db", "comment": "Malware payload (Gafgyt)", "value": "d6e13301d6b35c33104994c6758fd28285b6896e0c6e2d56f2b2b346c3496065c44a6d5c3702cdbc9b987ce939bfea55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338212, "uuid": "8307ab7e-a01f-4b1f-bc53-e834b08879ae", "value": "T1CD733B02FA43CAB3C4830BB6029FAB660D31F9AA1B2B9E45F31D7DF45B164C87116B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338212, "uuid": "650101a5-7e42-45ca-bc59-c8f06ed30770", "value": "1536:9JMgD+pOW+6miDIrUnf1gTqjx6d7k6J8jmLI6VOz+jXUfWQS:AgD+hb/IrUnNg29wYjmU6VOz+bUfWQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338212, "uuid": "48297afc-dca6-425a-a7e6-f304a59e3278", "value": 77785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338212, "uuid": "ec44072b-5ca1-4d80-81fb-db65eee02768", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338212, "uuid": "970351bb-e2ba-446b-9a13-27ea2d82743b", "value": "4fee22711001d07c0e31ad1168f71270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b8556a-bd11-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706359532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359532, "uuid": "4a26b6ef-a20d-48a3-bace-6738bc10361f", "comment": "Malware payload", "value": "8ed5316eb7ca91f469345f3b6c61df42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359532, "uuid": "6d923520-6f2e-4db4-9edb-82857216d1a6", "comment": "Malware payload", "value": "6627f392df5865c6768559cf16e532bbdfed6296884244e8055e92c6bc76fcd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359532, "uuid": "5f699ee6-68b7-46c4-aea1-ee89bd36ca22", "comment": "Malware payload", "value": "49a41c3a547296e597151aa56d65b4af27a93662", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359532, "uuid": "5ce4a808-ce20-4d26-ad41-0f96b69581fe", "comment": "Malware payload", "value": "e39066122197159b5ca8cebae1f0284da04ffe38354b232e7361962e03b958e24fcf721afe7896783d1757f02c0df16b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "svg", "colour": "#F96B4B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359532, "uuid": "fe778944-dcbe-410c-8a8f-1ca285c677b0", "value": "T178C022E98CA7CC09812088B0CA21B904F71782914A81C089C0C0483362047EB1F4678E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359532, "uuid": "aa9887d4-b428-4c04-91fd-0495e06b6ae6", "value": "3:vFWWMNHUmbBGKsqDmJS4RKb57v4MOAKeRhckAqRAdu6/GY7ov/YOkADFoHDvIMvu:TMVDBT9mc4sl7vhzAqJmO/OmmHDIMvVM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706359532, "uuid": "54c4d52a-416a-4ff2-b982-169386e58e56", "value": 192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706359532, "uuid": "18e970cb-0b14-40c9-b282-f804e6a427ce", "value": "image/svg+xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359532, "uuid": "e3382b00-1983-441f-86bf-8f9a1037e00e", "value": "Incoming_Payment.svg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf3ba15-bce6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706341049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341049, "uuid": "2e376e14-a58e-4ed1-81bf-77772a23916f", "comment": "Malware payload", "value": "32f373aa00460417f254f86f3751da56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341049, "uuid": "c01c9e41-7996-430c-a1f6-777732549d7f", "comment": "Malware payload", "value": "673d69cff3f0ba97083baab84b4124523c3ea65dd7ded8e30253da0b97e2be04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341049, "uuid": "21cc46c7-e2c7-41c6-937a-eebbba985e5d", "comment": "Malware payload", "value": "f1f99516cbc9687dacd6209997bea19902c6d9ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341049, "uuid": "4b143a11-1897-4dea-aea5-cfc0ebf4783d", "comment": "Malware payload", "value": "f9e98060169c8898c444d28fc5850a68659c40b81abe5385ae3e517fda4574cc2c72bac76696c80a873f641c01c96ea5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341049, "uuid": "a3318c3f-dbf0-4593-b68b-ed49473e5811", "value": "T1F5C56D22F282C837E1735E78DC5792D8593DBE642E38A85B3BD41F8C4B3574139252AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341049, "uuid": "88f5e1e1-c85d-4e40-b110-00fbaf6efbbf", "value": "2040831291403e6c6dba4980e3146506", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341049, "uuid": "0109cc6a-392d-4795-8df8-0a4b91adde81", "value": "24576:ssBc7xW5Ancxkc2dBWf1l+XgpVlrfNGW5QOyoWeITLPV0sNXNrR4wKc7I+im4Mye:LARfBWRZrb9ITzVJKeAG9saQjUEeAw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706341049, "uuid": "c57212a6-0c61-4118-bce7-1c5923396287", "value": 2650112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706341049, "uuid": "e75fa504-733d-4831-bcec-e7b3306d6503", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341049, "uuid": "9677baad-53a9-4fe4-a6d8-52ce68a7a560", "value": "SecuriteInfo.com.Trojan.Heur.KT.4.HIW@a4o7bfI.28402.31897", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09299964-bd4f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706385764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706385764, "uuid": "4efd4d95-3a3c-4e59-ac61-d1a772287fd7", "comment": "Malware payload (LummaStealer)", "value": "fb7ae8b63a92d1708720ead586676108", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706385764, "uuid": "cdaf2afa-978a-48e4-8c52-220206493ea6", "comment": "Malware payload (LummaStealer)", "value": "6af6349b90957868a81544b8934f8ed78c94a35c76a97ed245d7bee5df4a2e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706385764, "uuid": "5b2725a2-6614-4ebe-a0d9-f17391a0cf8a", "comment": "Malware payload (LummaStealer)", "value": "5580cf8e2752c9b560d86fc63737af31c7e988d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706385764, "uuid": "20ab97cb-e920-4886-9f6f-ae79831f7d26", "comment": "Malware payload (LummaStealer)", "value": "9f03b8fd4e830bed7649969410c1e92e4e7af7ea28a0c3004efd4e7c774bb7fd7a56be1d16de72509f39f6b767e11921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706385764, "uuid": "64a8fde8-69f3-4602-a609-0b5b9d1fc80a", "value": "T118C49E16F0A3D068C93B34BA6218B369EF3E5CC7135188F6A2908BE539329B55D35D37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706385764, "uuid": "e25b1bd4-34e7-4fb0-8215-f1ed21753414", "value": "31caab6c07bdd9ba8a35c1b9e5e79f14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706385764, "uuid": "5027576d-d86c-495c-be4e-b44bcdec51ef", "value": "12288:4s6Eu8eCt8G4ZhClzwhmAhoMxYzlSjrt4:i8bD4zQsWUSSjrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706385764, "uuid": "798ab1c7-314f-4d37-b541-67dd99e977ca", "value": 550912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706385764, "uuid": "227ea702-f865-459a-a7ff-45ee13fe43d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706385764, "uuid": "6fbd1960-61dd-49c3-92dd-c54caa636a2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "047ee1aa-bcf4-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706346672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346672, "uuid": "feada7b9-0abe-4518-a6b5-1991827d1a6e", "comment": "Malware payload", "value": "f96897f5fbb7c004c63085e12d1694e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346672, "uuid": "d75e51a7-697a-4742-8bcb-113314e61b77", "comment": "Malware payload", "value": "6bce2274166684bbb03f3711b5a80ccc4a24e36c336346848989c047206bed07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346672, "uuid": "fd7ea376-eb2a-4029-9976-8aa9f11b7b7c", "comment": "Malware payload", "value": "1e06ab3b928177db266bd0593c64d5a8166d0ba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706346672, "uuid": "c645ce4d-884c-4003-b852-add754fa01ef", "comment": "Malware payload", "value": "6a22abef109d55dddf97e426c5ccf779907be672f4950cbd22a428e636b02fc613510bb9b4d2a9dc6f57e306c72f68b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346672, "uuid": "9a82ae69-70ba-4173-857c-ce06d2431984", "value": "T14A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346672, "uuid": "31261db7-bdc3-4a66-9257-7fca08a437c1", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346672, "uuid": "09343dee-f380-4359-adee-b2d6912c1b4c", "value": "12288:pqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaQTi:pqDEvCTbMWu7rQYlBQcBiT6rprG8aoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706346672, "uuid": "f830df89-bf0b-49e5-95ff-ba4741d95e54", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706346672, "uuid": "52d3542c-a523-461d-96c1-9bef9ce45cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706346672, "uuid": "054d87e4-76e2-43de-af7d-362ac328dd27", "value": "f96897f5fbb7c004c63085e12d1694e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6433b134-bd11-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706359288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359288, "uuid": "964a24ed-eb79-45a8-835c-9d60789eb099", "comment": "Malware payload", "value": "2afbe86c3d12f195ba33d271bf5a8a42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359288, "uuid": "b6dbfa74-9259-4802-adec-e26768665401", "comment": "Malware payload", "value": "6debfb726a4c59128ebcb3b5e17a62c67e378d60e93c17491e420475b435d418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359288, "uuid": "680ab9b1-447c-4db3-8ed4-47708916db30", "comment": "Malware payload", "value": "85a931ee8d32eb1b2781bd604d3f87e32900f3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359288, "uuid": "f7aa92fb-bd70-4706-877b-28d21af0682b", "comment": "Malware payload", "value": "3a2ed2ca9b8aa99dc3e160d40f226fc51935e8dec1632b4e86ef51bdc535e0d6eaa2866aea50aa26b87b2ec57e2a9abf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359288, "uuid": "95810fe6-388a-497d-b7d6-27b4e8e06577", "value": "T1DE15E1413354C4D5FCBA4AF3585F8CB02A5579EF816AC4CE71E17B2E98FB7204227A4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359288, "uuid": "673eca51-2144-4d0d-962c-bf15e304bd9e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359288, "uuid": "72f57917-e61a-4f4e-85f0-68531b4c0f48", "value": "24576:QNmQAjuVDsj4v8WULqWaRnt/SoYFw1epYLO9:wXAjuVk40WULANNYFr9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706359288, "uuid": "01a76632-f5e7-4349-b49c-2168fc6a6db6", "value": 900291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706359288, "uuid": "ff16c5d5-c401-4fc8-9122-34647aa38911", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359288, "uuid": "a27015cb-d314-4421-b04c-daf9b49b21da", "value": "IMG 01262024 746726472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ac345e-bd16-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706361324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361324, "uuid": "9defb610-4a20-4403-bfc8-2079457502ea", "comment": "Malware payload (AgentTesla)", "value": "62d4a6a90855f121d8970bd8603577aa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361324, "uuid": "f7a81413-74d2-4e2b-bf94-5890b573e272", "comment": "Malware payload (AgentTesla)", "value": "6e7ae5b0051218bcf8da91747d6f0447c3cdd097c13376900df66dd71c989f07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361324, "uuid": "3fda6e6c-ffe5-4f26-9e6b-9cf0f3225f07", "comment": "Malware payload (AgentTesla)", "value": "debfa90d46ebbfae5cb7a5e616c40deec507c6b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361324, "uuid": "e62360f9-3a52-46d2-a010-043601f86a14", "comment": "Malware payload (AgentTesla)", "value": "6fc4656a1ba09e2b1371eeb21d23f2851b5621b7b2f8a944ce9bd2060ca6ab4d6a79396cee58dfa34ae77931a9293fb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361324, "uuid": "6a579694-da6c-4acb-82b2-2ffffdbd5499", "value": "T158D433EF6C797691691F2F436B2C3BC2062615FA0F95465E26EDEF94902CCB170ADC20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361324, "uuid": "753cb688-4e9d-4f35-a47f-151270785f65", "value": "12288:bitKwrp/2QQYnszw3z4ic+YWBNfHBR2QvoeLP5/ZXdyPRM:+tVl2QQXsy5wfhIZeLR/ZtsK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706361324, "uuid": "55fe1c59-30ab-47cf-82ab-bad08c1077e4", "value": 617379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706361324, "uuid": "2f3ee813-c82f-4a82-97fc-2b801d7f5d4b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361324, "uuid": "9afc3255-7a4a-44b6-a759-e1c9cb6f75c2", "value": "Comanda de achizi\u021bie OP nr. 1068 16-01-2024.PDF.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3f7f05-bd60-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706393229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393229, "uuid": "ed0af0f4-f9b0-4e48-b043-fb896be64c5c", "comment": "Malware payload (RiseProStealer)", "value": "50d2c23b2246cc8f3d2542e4fa8b2cf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393229, "uuid": "6548d49c-f0ac-4eee-badc-425a7ecc91e6", "comment": "Malware payload (RiseProStealer)", "value": "7401c5deec1c59c0555ae812902394c2f01e569f244c86d8cf9dc7036fa5855e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393229, "uuid": "99cf0e87-e565-4052-9cb7-f30dd5b4d157", "comment": "Malware payload (RiseProStealer)", "value": "9e751966acb23f5b4162a50ca9cc7840c6375364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706393229, "uuid": "20424a79-6d14-4187-9e14-dd0f793ba761", "comment": "Malware payload (RiseProStealer)", "value": "c1df2456adf7535c9bee0879fd9e68c4f01815198c3087acc53946dac22ddddf5659d2f2f91d2dd8432e45fff452f75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393229, "uuid": "204005b8-d1d8-48e6-9aab-2b6f1d454670", "value": "T1984533FDC5390511E1B476F09950E82E6FBBBA19E308AA46F77B418339D408C17EF949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393229, "uuid": "88e72636-9fda-477f-b3de-85260d866518", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393229, "uuid": "0f824f34-c022-4ece-a6f3-1370c6f962bf", "value": "24576:YAJhls+gRjQh0iyNWgDcYgcfwQXBaWnBCqwy8/kBjAnQ3v0lU0eu:YAR6+m9WoKQlXBaWntwyEkBjAQcU0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706393229, "uuid": "9f26cb1d-1b9c-4c39-b512-a6e281bbab6b", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706393229, "uuid": "084a99b3-2606-4ed4-a4f6-7b67c08ea2f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706393229, "uuid": "847f9850-0810-4f0f-83a4-2a041d097c92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9415700b-bd18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706362375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362375, "uuid": "b6498e58-4e61-4823-8556-2a1e085ee135", "comment": "Malware payload (AgentTesla)", "value": "3fa20497847094c3d4f2ddf3b1bb741a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362375, "uuid": "f5fc36f5-7ea1-4014-8afd-5320b572e1f8", "comment": "Malware payload (AgentTesla)", "value": "750f94ef716d9dd9d4742173c74c1cf6702904c0d2a18fad8ca74014ce95f668", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362375, "uuid": "d8d0b0fe-2372-4456-8b04-9f007f265cea", "comment": "Malware payload (AgentTesla)", "value": "363ed5c381aeef6fc09de4bd34589c7afe20c6e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362375, "uuid": "59b64d82-05ed-41fb-9a6d-2b9bb0d248b0", "comment": "Malware payload (AgentTesla)", "value": "26c2e2f8d9cff3e86bb215f034f14f1f92a35944346fc31592fd0f54c86905e467154f8055aefcdb1e0581005a0fa97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362375, "uuid": "b888e558-c330-4bfa-9743-bef1058775f2", "value": "T159459E022BD5DF32FE9689764A95B2015A792F7508339B2F52A87C7469F0063123FE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362375, "uuid": "ffcc8ed1-417a-41f4-912a-116e34ddc13f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362375, "uuid": "b9abb1a4-7dde-4af8-b5bd-c43ea3161c47", "value": "24576:PAHnh+eWsN3skA4RV1Hom2KXMmHahO+fgbLy4u8/T25:yh+ZkldoPK8YaMYgvIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706362375, "uuid": "37d2d6b5-fe0e-4a1e-9faf-b59f7fc29765", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706362375, "uuid": "5d6c50aa-fea6-4448-9f19-bd11eef61737", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362375, "uuid": "94f181af-f0d6-42b8-9bd1-db58f58312fd", "value": "Comanda de achizitie-4500628950.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90eb4e6a-bcb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706318561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318561, "uuid": "94de962a-0663-4f0f-ade8-95c3a1b0aa3b", "comment": "Malware payload", "value": "ddb310f6ad234272c5fc4680f5b7e3c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318561, "uuid": "3dec6c97-9159-4fe7-ac56-fe939928e3dd", "comment": "Malware payload", "value": "7c22a5eaeef9d5a32de471d78061c5d9ab2c1fc28399f3a019a5786be9d48ac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318561, "uuid": "3ca2654c-c3f8-4abf-9ce8-dcf1873a14fe", "comment": "Malware payload", "value": "19126add3204bcfdf93bd6f16bfca2540384656b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318561, "uuid": "51ad24dc-f039-4f4e-98c9-06c571de13a8", "comment": "Malware payload", "value": "ac02a0c3a5ba8a56fe57ce0bc8ccb6ef4fc979186b211b06dea4d7c7d962d145a92fea40a4879ce2af4faf84c36c8bb6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318561, "uuid": "c55b3a07-f259-4202-b750-1e4b80858a91", "value": "T1D6152212B790A036D6C746B79CB952E90F95EF6647A8628F278E3AD30F315C02D3705B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318561, "uuid": "629ca762-867b-4c48-a9b5-be8f5f248d04", "value": "22977549f5973f29d9952f5032e325b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318561, "uuid": "92967d49-751b-4d32-a895-f2a326428ea4", "value": "24576:tcSxVfBrwzEr7cp9FGCQ6QMjF0SKJr8Q0et6n:2GP7qGVtMRaJr4et6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706318561, "uuid": "34de10c9-c767-4d70-9881-04d825c16fd7", "value": 936795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706318561, "uuid": "68ea70b8-65ad-4d10-b52b-7e9a0a30d865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318561, "uuid": "c25b8273-8d18-42c3-8d4f-1951e87c1a0e", "value": "SecuriteInfo.com.Trojan.MulDrop6.20495.3244.19917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b655b96-bd3b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706377178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706377178, "uuid": "72526a72-e4a2-40fd-98f4-818c4e8bd779", "comment": "Malware payload (Stealc)", "value": "796f63c42ca69a07ce61a45fcbed1c8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706377178, "uuid": "d5e7d1cd-0ad0-4f75-9e85-b1c8a3025247", "comment": "Malware payload (Stealc)", "value": "7d6a7be45399fb81c56803b796547877518fc2a508107863ebfd8712d0788833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706377178, "uuid": "699c6c94-2832-40fc-a6f8-7e7ffde2458a", "comment": "Malware payload (Stealc)", "value": "1ac54fc0c1fb52c5a229cff8069bf1d36ffca5a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706377178, "uuid": "661bc05d-6591-4332-b541-f9e4e4638b1d", "comment": "Malware payload (Stealc)", "value": "d00c0d7e1d0fa2c305f343f1c46d1c8b2cc6f0ad0d142fab1e8a9670f6a51eb7a41aed1da9c315cc102a73e4d089fac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706377178, "uuid": "71ee5b38-3bdc-465b-b907-b90770402ba8", "value": "T12996224F535A9CB1B11446AA27A1F65EF29120AAC5805CF2FF3BAAC15D335C680C9CFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706377178, "uuid": "756754f0-0f77-4049-8c9f-f1fb69c490ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706377178, "uuid": "44713293-bbef-48d1-9427-d71a0a317fa2", "value": "196608:8nBA8A3KG/92qRhZMtOPKk0tgUq4DmfKNmId45ATifs2U:gZATT2tOiNFmigIdasH2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706377178, "uuid": "c527ff73-31cd-4d5f-a79d-46e0759e0603", "value": 9292800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706377178, "uuid": "77d69fad-8dd5-435f-9aa7-00b2bb294303", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706377178, "uuid": "e7ee3f07-7f56-4e85-a376-78e18310e972", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea87f28-bd16-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706361614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361614, "uuid": "1915830a-aadd-4af0-ad42-62d568ab2025", "comment": "Malware payload", "value": "36907dceb1c732eb2619850114cd0846", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361614, "uuid": "2e9fe662-6d7d-426c-9748-7fbe8acb2bcd", "comment": "Malware payload", "value": "7f0d9748690533cf72a201ae01c13e4257bef6e489bd0ba0815441e88c4345d0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361614, "uuid": "bfed5ada-824b-46a8-96fb-c65251e06f4a", "comment": "Malware payload", "value": "28d194073615e8782e8d9f17f12701fe6f349c00", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361614, "uuid": "5d0e11b0-9fc4-417d-beb5-3f781b7c8f06", "comment": "Malware payload", "value": "e57a7d32c6b920496bb829143b26c8698004fa971f643835adef9c64e81e9805481a7e80784c7fe42da048f7cc6f424e", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361614, "uuid": "fb829913-4c26-4e1c-96c9-ee4933671099", "value": "T14763132AA74E8965D765E5BB4249898E49FCF73D32C240D0F9FCA2343B3D50E4B611B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361614, "uuid": "a0c78dfa-131c-450f-8953-d1b0a056e967", "value": "1536:NsgB/YDfcItr/qqX2XE5P93iQoZwB1uik/rpDSZ+UE3xWxdjo6tB:dL4DqqXMEV2Q1uik/rU8B6djo6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706361614, "uuid": "6fb8520d-884c-4b26-a72d-cc500f1819e4", "value": 71927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706361614, "uuid": "19da68c4-ea9d-47e3-b4d8-db71c376b6ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361614, "uuid": "a12158e9-1761-42e2-a968-d1c4dd6c7df8", "value": "microindudtryunvweheelnewconcepttounderstandhowpowerfulthingswedoingforcreatenewthings.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269899b4-bcc5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706326543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326543, "uuid": "49022a3a-c8fd-4b43-ace0-61ee5aa7859c", "comment": "Malware payload", "value": "dd87a973e01c5d9f8e0fcc81a0af7c7a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326543, "uuid": "cdaefb5b-52b4-4152-adb7-b2429407a0b5", "comment": "Malware payload", "value": "7fb0f8d452fefaac789986b933df050f3d3e4feb8a8d9944ada995f572dcdca1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326543, "uuid": "cae738f8-5b05-4fc8-808c-c9a5df12f095", "comment": "Malware payload", "value": "c9206ced48d1e5bc648b1d0f54cccc18bf643a14", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326543, "uuid": "73aabeb8-adfe-4564-ae53-71ab21fc1187", "comment": "Malware payload", "value": "7ce6e9851169c6d1fe3edf0661da3a0e2c678fe5f95462c43ca752053cf214c42d15b6c5854007a689066bae47d90ed1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326543, "uuid": "013161cf-013a-4ed1-8898-9b8d05bbe2e1", "value": "T1C5425C1583618EF3F5961E3C00667E2F2B79BE3416F100A39FE34481A99A1CF99B5392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326543, "uuid": "9a0f75a1-cdfc-49bf-b301-2848ac96902b", "value": "240ca92ecc1c291801c451c447e16c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326543, "uuid": "6eff157a-a17d-45f8-a948-9b39fd239dbf", "value": "192:VFiQJ77pJp17C8F1A5xjGNxrgFOgb7lrT/993:97pJp48F2exrg5F/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706326543, "uuid": "d54b1752-ba4e-43e2-a9b7-a0015cec7c6f", "value": 12288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706326543, "uuid": "34c10740-1fb8-45be-af1b-ba9bf3d48932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326543, "uuid": "3711171a-89e4-41f6-b518-50509dd4d1c2", "value": "System.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9038e2ca-bd18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706362369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362369, "uuid": "29e50c3f-ab4c-4b6c-99f2-4032b8055342", "comment": "Malware payload (AgentTesla)", "value": "716155a7b708f1e34d964549646784c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362369, "uuid": "b626f638-dba2-4653-ae6a-c293630e7ebd", "comment": "Malware payload (AgentTesla)", "value": "81cf6d5cf367011c536188a07032592962f568ead79d8b959a9e42b5a892dfec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362369, "uuid": "a4e3adad-62a5-4528-995d-aeb305c8b47e", "comment": "Malware payload (AgentTesla)", "value": "50d57e180e42aac5ae430e2a0c0b47a4667ac875", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362369, "uuid": "09bae9a0-6c44-4f32-bb4f-1da229cd4523", "comment": "Malware payload (AgentTesla)", "value": "09a503f69c8cbeba77eb63445aa948d4b15b3966abc815ce891d47e92903f1cd2ca722a704fd950765ad1ebe13aa08bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362369, "uuid": "7aca7830-dea1-419c-a447-8aa543ea7711", "value": "T1DDD43364268ED24D671B16A78C50F7B54ABAE02C4DB228307F00DA31BDF2568FF854DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362369, "uuid": "52157052-0997-4f08-a81c-9d7feee2b1c1", "value": "12288:RpD3+aFnGim7o8JDzNYzPicdaWph7cENpP19IV4cdztvdBaVtKKc+KTIb:RIaFA7o8lROdamKdhvXyed8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706362369, "uuid": "9108c556-ce2d-48d4-bae7-4e3b4e6d0156", "value": 620168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706362369, "uuid": "a8ad9a1e-3a04-47cd-9559-16dd34f3679b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362369, "uuid": "3e5f53a2-7293-427a-980b-4345d5a65e5f", "value": "Comanda de achizitie-4500628950.pdf.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ef7a17-bd52-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706387361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706387361, "uuid": "963d71b3-d221-4d95-8be2-a3f9fb03fe86", "comment": "Malware payload", "value": "60e13c52b9273e62e7618e95bbc87015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706387361, "uuid": "01a0b554-f8fe-4070-84ed-2799d5b586ff", "comment": "Malware payload", "value": "85ef032f8480373e29d1d218dd2e78a227a947941d39aafe40531e461ced676f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706387361, "uuid": "d60095c8-f7fa-4539-a463-0960a5565486", "comment": "Malware payload", "value": "9dfbfaa95b24ade5815b3874582be53b992944f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706387361, "uuid": "e5ce7a41-e312-46f8-9fe3-f5ecb0d7e541", "comment": "Malware payload", "value": "586d22f8c3a8eb671f9f6092669b2a2c373157350ce6b19a1bbec9b015a249ce3b8d2982e5cc975feb1f5264561e12d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706387361, "uuid": "7cc42c75-ad95-4f0b-b8dc-a70ed7016fea", "value": "T1A196338974A12A31D4B7DD710AF3D231D47CBF412BA08E9B8150B625DEF3AC456A3B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706387361, "uuid": "d473560b-4686-48dc-9305-6fe927ed97d3", "value": "0f4742d118353293dc95de23c61419c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706387361, "uuid": "4e1c21d7-0722-423b-804f-b90a849bc576", "value": "196608:hdHZUaDetxqmR1ltj2G6WNZGoJLbc3I6fej7hJR36NpVk2w/X4lYSJrvC8jEI:hd29R1lt6WNct7feX96NLw/X4I8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706387361, "uuid": "16dc59fe-34f6-48a0-8515-af839862a874", "value": 8650328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706387361, "uuid": "61015794-a2ab-4902-b362-383adcef59b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706387361, "uuid": "4b04c722-9638-49f3-891c-cd8373b5649a", "value": "SecuriteInfo.com.Riskware.Qihoo360.23443.5069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35383452-bd6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706397864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397864, "uuid": "602ad923-f326-462d-9063-8806bc2bfa88", "comment": "Malware payload", "value": "ef30091a40abbd1ef6d1b453f7c5cf96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397864, "uuid": "7062e47b-aa8f-4cef-971e-9250e8cab7ca", "comment": "Malware payload", "value": "866be8e23513f0745d4b4695062741593530fad0a3a4668e64e9a48f6854d00e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397864, "uuid": "9f0b9b8c-b881-4f4a-a42d-2893cf866d83", "comment": "Malware payload", "value": "8e27a9dd980d653a8510321bc6993a64a2f0a365", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397864, "uuid": "aec46a29-bea0-4b71-89ba-ffcc775c9c5f", "comment": "Malware payload", "value": "332787bd3f06f94a82099aa93bbd6c9304d1acae8e43431d2202a90dd7f90198b0e10cc56f6174d8a9147eb6564af933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397864, "uuid": "0389d6a4-169f-42e2-bc1e-b80d59e02dfc", "value": "T1F936123FB268A53ED9AE4B3245739310597BBB61A81B8C1E07F0481CDF664701E3FA56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397864, "uuid": "1558aebf-51a1-4655-89f6-0c6eca0b3d32", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397864, "uuid": "9ce0dbf9-921c-47c2-9c60-299c7a7f0ac9", "value": "98304:JE8I366Y7x8ggcDVP/B/4PZib+a/dicUsvIhb3dpNXzYo8C4EsgI:bIV+8ggQ/Jb78chAlbRR8ztp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706397864, "uuid": "cf4f13ca-0819-485c-bb82-f39e26adb31a", "value": 5181181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706397864, "uuid": "792264b0-e82a-45ff-b172-9aa58244ee90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397864, "uuid": "5cbc7e39-a5d5-486e-9c74-7a4731b023fb", "value": "SecuriteInfo.com.Trojan.DownLoader44.26037.24009.23756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51e0c24-bd04-11ee-b7ea-42010a9c0006", "comment": "Malware payload (WhiteSnakeStealer)", "timestamp": 1706353814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706353814, "uuid": "dae337a8-928c-420d-8640-beab14cf7417", "comment": "Malware payload (WhiteSnakeStealer)", "value": "f1206cb5780b0a65ded0d86d3d0f8a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706353814, "uuid": "a005a11b-5fd5-4af2-b736-54042971426b", "comment": "Malware payload (WhiteSnakeStealer)", "value": "8a9ad8b99cbfeda472193ab63a8f5857fb2659ef08343187569ceb0e4b8dbc13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706353814, "uuid": "12b36f5e-a26b-4b3b-afaf-10790fc84d12", "comment": "Malware payload (WhiteSnakeStealer)", "value": "1850b718d597bb71f99eacf995df31aef4ee9471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706353814, "uuid": "bbaa74b0-bc3e-40db-9e51-826d5c8ffc0c", "comment": "Malware payload (WhiteSnakeStealer)", "value": "53995ad9053ae1e13f499b1c0689e36bd4e486b5a3c5fcf399a986ce448cb9208b2261ce7470677e7a88b15e36065ccb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WhiteSnakeStealer", "colour": "#B8CDAF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706353814, "uuid": "eb5c8c02-9507-45c9-be5a-a07cc6f0d861", "value": "T1DD34DF5373E001B6E4B653B099F702575A31BC919F3886EF2385998E1E33BD0A932757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706353814, "uuid": "ca87e064-16b7-42e8-976e-45c0b7050146", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706353814, "uuid": "6027f3bf-19af-465e-9f6d-b852f1e9e40d", "value": "3072:GvGyYiSDnt1F5GWp1icKAArDZz4N9GhbkrNEk1F2TffbFOHfr3U+4gyypHR8jQ4:64jp0yN90QEnTfTYrzZsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706353814, "uuid": "5dc3b735-3d6d-4003-b03b-d801512571c9", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706353814, "uuid": "6fbfd7b5-55a7-4987-acc4-5ca7bcfdeb4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706353814, "uuid": "7cdb94eb-6b48-4fdb-8d09-0e91f325a3b1", "value": "f1206cb5780b0a65ded0d86d3d0f8a3d.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7a70b1-bd12-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706359628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359628, "uuid": "fed95bd5-d1f3-42b3-947c-c2e9a7a8a977", "comment": "Malware payload", "value": "f50081a699960921c3ac494c49a5338e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359628, "uuid": "18082e3d-0349-4e6d-a01d-04f0ebd2ff6e", "comment": "Malware payload", "value": "8c0554af06496cbf019db3d07c1805c8dbf731b61a0c9e4c70b559459cff3506", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359628, "uuid": "de49861d-79ca-4616-9105-01d3fa1f6211", "comment": "Malware payload", "value": "9580b05d3297a1a9ed8633d979da292b1a35c604", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359628, "uuid": "5ccf7c58-4ba3-481d-a92d-9183b684adf2", "comment": "Malware payload", "value": "8aacddd6464aa0c3fa00551e65be2f68451c9d9523423e795496c5a2c5f563e363d674c01786ae8297ed7eced33a8d11", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "AMSIReaper", "colour": "#8F8C4F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359628, "uuid": "d397cc32-cd93-4b44-8a61-00c06d218546", "value": "T108E424ED222D171A34234A4CD8DDE288675C890275BD57A0E0F569F65F1F5B6F23220F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359628, "uuid": "661eedc0-ca1c-4248-a1ec-c155250c8814", "value": "192:+1Lj1hWOw3HHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHB:sjvWOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706359628, "uuid": "cc16f9d7-75df-4be6-9247-9dbd33ae2bf0", "value": 669753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706359628, "uuid": "62ae977b-b6c4-4355-bce0-ae9be0331c47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359628, "uuid": "12e823e8-f9a7-4b5f-b729-908bf982cd94", "value": "OutgoingHSBCTelegraphicTransfer.pdf\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7daaf08c-bce7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1706341292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341292, "uuid": "e3a770ec-9557-4713-b639-6affa1aab69d", "comment": "Malware payload (Rhadamanthys)", "value": "5f877af49365262c9c9d1fee9da3e2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341292, "uuid": "9cb78694-86b0-445c-a2e1-0bb98cf6ed95", "comment": "Malware payload (Rhadamanthys)", "value": "8e161b0013f7cf87c0ad0fbac24237ae64a495d558639d55f46f1ce79636c177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341292, "uuid": "a1414b5f-8914-40a6-819e-ed141e054688", "comment": "Malware payload (Rhadamanthys)", "value": "b72726eb2729d3264519be790fc56d3c3508549e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341292, "uuid": "e0dc3e3c-b8dc-4e4c-be29-1be5a262bd15", "comment": "Malware payload (Rhadamanthys)", "value": "d3cfb3a6b76dc75a2ce0d494d1c600c2db1cc3c1cea8beaac9300d80551c97f666ac7909e172be3425bc5d99475ca61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341292, "uuid": "984a2ccb-05da-4f2e-bc40-020ae1066929", "value": "T168D49B52DD8A8113E9F29FBE69B5EAFD052D6711EBC4CE4B17B8C9A047E030C7059D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341292, "uuid": "28ea0663-4b6d-4c9e-b9bb-4f8514dc2602", "value": "815a983dc2c1dcfdcf5ea58bd5240e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341292, "uuid": "dcfccd4b-ec47-4d43-9ee7-bcac33edc851", "value": "6144:18KmzMQxe3MjpwsOFbva3qXxNEcp0BNFG6aVOywHMhwXZ8KpxRQZFVi90hLuWPcd:CX/ecWFlEcuBNfMhW8CQjLQBkywh9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706341292, "uuid": "3cc32a21-e1d5-4ca4-8765-005b883678f3", "value": 623769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706341292, "uuid": "4b9e14eb-54ed-4098-8357-827e20f5e274", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341292, "uuid": "db67794d-b9df-4943-9e18-7adb93a8b1ce", "value": "5f877af49365262c9c9d1fee9da3e2a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283ba9f6-bcd3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706332559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332559, "uuid": "379caab4-2792-460b-bb0e-3980d5385c07", "comment": "Malware payload (RedLineStealer)", "value": "5b49aff6fd63d3b47a42af95b2ab6233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332559, "uuid": "24d35b90-324c-4080-8bcb-85ac82e8b52f", "comment": "Malware payload (RedLineStealer)", "value": "8f77873bce69f4dfa664af8aa6204f9b5a54bbedbb00665fc60e29791d4f3539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332559, "uuid": "9a244185-098d-4fc9-996d-9c0520237e78", "comment": "Malware payload (RedLineStealer)", "value": "7c8eb1f7cc5f7e4fa9bec036261ccdb04be3e34b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332559, "uuid": "07aaa1f5-8665-4f64-8f9c-9044f25ebd46", "comment": "Malware payload (RedLineStealer)", "value": "4d27d5a6f118b5403945515d36d6fe8c315381a46e311eae8fd35ad01c637a3b54d468642cc6f4f237fa9a10adc999d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332559, "uuid": "e1e75262-f3a7-4b10-83ee-4055183a2a91", "value": "T133F4F1A4C6ABD177EBED537A546456A2AB3C924D2C43F31E180834F0941A383F563A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332559, "uuid": "ec951b64-efe5-47af-8d9f-29ea23801eed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332559, "uuid": "6bf0ec70-17e5-4d9c-a85f-9f431a024e96", "value": "12288:s3QCUOkr6NDTpQ+pRyc/djugCbkNA7DKTO68jSgBCR0kFMh:jfwQQRHFjkINAEJ8WgBOFMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706332559, "uuid": "4af3ccdb-b999-4077-b47b-5912c0e81f2f", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706332559, "uuid": "04e26e3e-32d7-49d9-9902-f72d91fbbb6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332559, "uuid": "65e1368d-0e96-4955-a51a-da5963dcbb57", "value": "5b49aff6fd63d3b47a42af95b2ab6233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14392258-bcee-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1706344122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344122, "uuid": "d8a182c7-1404-4d44-9703-f99f1be7311a", "comment": "Malware payload (Cobalt Strike)", "value": "3d3752df74ed2643cb808cf3be8e22cc", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344122, "uuid": "dac9b7f1-436c-471c-9de3-0d0e33c5b2cf", "comment": "Malware payload (Cobalt Strike)", "value": "932c23bfa8b2e69183927111971b220056af4121b7845209a155b5d51a8c5f55", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344122, "uuid": "56f655cb-3f22-4700-ad3d-6bc553823c0f", "comment": "Malware payload (Cobalt Strike)", "value": "9774e8c00cfdecf0fffb5df731a6448d385830fe", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344122, "uuid": "da8b5038-93f8-4bb4-84b6-6326195e3642", "comment": "Malware payload (Cobalt Strike)", "value": "22a9bb5ac8f831ce7f885df4921a3b2545ea8e82f0c689f45fdd2b35c4308f37aa09d0d2efb17eceb9500c0c0561504b", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344122, "uuid": "d86fa328-190b-486c-bcfb-fd15375f60b4", "value": "T12D762324F6E15DBEDF277AFDA04E49EB9A4F89A307C9002317F046E6CA106D1841ED6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344122, "uuid": "9ac411b8-3a6e-4896-81bf-de0da54aab33", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344122, "uuid": "201fc60c-18aa-4dd2-870d-a6478f42690d", "value": "98304:8wImKmNpheXXaacfITNvqFq1ayr/nAevkZUp/MU8mAPRw6xEr+rbHP:8x2heXXLcQxSgMakUBzAC6xWwrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344122, "uuid": "c3f1c5cc-ae14-42fb-a728-024005747320", "value": 7236672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344122, "uuid": "555c0252-3627-4dc3-86fa-4383ffed917e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344122, "uuid": "235139ef-b171-489d-8fbc-18ff2223804b", "value": "SecuriteInfo.com.Trojan.Siggen21.29401.32195.4741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebe6159-bd14-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706360487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360487, "uuid": "3e3b89dc-b5a6-4ad8-bbfd-a999f838de91", "comment": "Malware payload (Formbook)", "value": "c5af1e2dcdfc7961d33c571e2b33e521", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360487, "uuid": "4a673da3-6ddf-426b-b509-d578ce3edab5", "comment": "Malware payload (Formbook)", "value": "938e74e2208f8d67dd6e3d8cabb73682e0d160f6270171fac3af80f7712304ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360487, "uuid": "616ba179-8fcb-4027-b143-21eae7d97c37", "comment": "Malware payload (Formbook)", "value": "71e5df4e47b523c37feffc3a5a31df4c0141946b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360487, "uuid": "5f70496d-a940-4c44-b565-eece1aef15e8", "comment": "Malware payload (Formbook)", "value": "554b2ccc3a28c34815382b6a34c68db4f410de30a63a3e5dec05ab35a8d9b43eba32ed77e97928ed83a64098b6d33690", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360487, "uuid": "94fa967b-fd28-48c4-b89a-d96d5ad9aca7", "value": "T160E402142BE10430EFFF8BB9B8764518E770B60A3A57E32E359464EE44B3F54A610B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360487, "uuid": "89a4fd26-d2c6-4873-ad0d-a2aa3d18d2e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360487, "uuid": "c3e1d965-385e-423a-b6b8-a71493d0c81f", "value": "12288:CCRLt/baZFy4u6j9yh2N0h6KvyvP5xjlUPS307Ri0C0eUnN:CCba3NwS6PsBNlUPSk40r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706360487, "uuid": "9fa3c526-a732-4404-9925-567531d7faf3", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706360487, "uuid": "5c7a6466-5a08-4d6f-a44b-4a9911c12557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360487, "uuid": "3f1a8021-a5fd-47e6-a4a5-a4c20826ee71", "value": "Solicitud de precio_ORDEN DE COMPRA A4 - 000004019_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228bc4a7-bcdc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706336415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706336415, "uuid": "a092cc82-7944-4e36-9560-e5915ba180aa", "comment": "Malware payload (DCRat)", "value": "c124f00908309cd17feca68030e5d58e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706336415, "uuid": "443cc0f1-e975-4ffd-aafd-37cf52401754", "comment": "Malware payload (DCRat)", "value": "975033d24044a83505ee98f9f3b857e114ccb5f6179db6dce90804af911eea8f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706336415, "uuid": "14abae73-8b37-4757-9ec7-a64c36efb015", "comment": "Malware payload (DCRat)", "value": "7b3b43803a22887c780e545d1b480d56c573819d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706336415, "uuid": "fd30b349-eabe-42bd-8471-45f572ad9c69", "comment": "Malware payload (DCRat)", "value": "1176973f0f865b9cab4977a35c01b7ececd6dac30c2ddbf31df77c3adeb5ce2b862674a75743cab7feec8c24c24b3eab", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706336415, "uuid": "e7f1bde8-43a7-471b-be48-07f213187b7f", "value": "T12F06F106A5624E33C2F53F31E4EB412D42A9EB927512EF0F3B1F5291E9463B18F521B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706336415, "uuid": "1f1cf38e-9c8d-4c94-98b4-bd4a3aec5d53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706336415, "uuid": "6e1fa1d3-1504-4d37-9a4f-1136efed9739", "value": "98304:CQAY9x3ZQXzWyzoYqxL24dUVOOFHxKf0/0sa:CQAYvpQXr8Yqx3dunqcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706336415, "uuid": "9f546ee3-044d-49c4-a57d-9b015aeb36f1", "value": 3741696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706336415, "uuid": "6f880def-90ba-4e55-890f-421f70849327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706336415, "uuid": "6215f85a-6fa0-4342-857a-13f4948ef3b1", "value": "c124f00908309cd17feca68030e5d58e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df995a9-bd12-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706359788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359788, "uuid": "8a3af583-6b4c-40c6-912c-defd0806f32b", "comment": "Malware payload", "value": "cdfc9543cad1e63fc16d366433de83e2", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359788, "uuid": "76992690-f0cd-43c7-8c3e-cef9c493261a", "comment": "Malware payload", "value": "97d853d47baa7c9adbe2cc6d0a9b28fd07481b21e3505c06b27ac8cab3927cc4", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359788, "uuid": "03683a14-8809-4717-9533-52451c4edc5a", "comment": "Malware payload", "value": "16d4b846156891d51f0967b3d19bad5baef6a53d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359788, "uuid": "c11890ef-d067-483c-993d-e147489ae875", "comment": "Malware payload", "value": "b1e25ca871839ded88395816ea03f348a0c5b5787362e57cade12a83a7bfc1035495b5a3cd0845abdf14073a7eaadbcf", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359788, "uuid": "283bf510-a86c-4c82-a407-b8c342fc3778", "value": "T13F16ABDBBAC43E7D70CEB16450217BE9F2EC68A788DEC268871870818D6FFDD5825446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359788, "uuid": "07f9da00-3867-4bec-baa1-e0139c083657", "value": "3072:6cqJS3oczTJprA9HerK88t2VRsl4NgRPtrwMIfQ8XKB2US1nkvaeyEKGRRjvnfyr:XuK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706359788, "uuid": "aa6b14fe-ecf6-4ad4-97b1-2fdb173c054b", "value": 4115134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706359788, "uuid": "60e6b02a-e2c1-4028-a287-3b917f6aae09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359788, "uuid": "d33589be-204d-488f-9d4d-fc4f3cef8098", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f799645-bd22-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706366662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366662, "uuid": "6e916e1a-8703-4a7f-af2f-a77c2e7a6742", "comment": "Malware payload", "value": "0e846fabc2b553c5100563231d1c8394", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366662, "uuid": "b54a4fc7-a909-434c-b4a9-967036265090", "comment": "Malware payload", "value": "9d58e2f3f23cbb218374ca503fe1fc90f2bf1aff97c026c9ac7b09337294c43e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366662, "uuid": "4f40f1a5-d0a4-4697-a97e-baa5ba96f171", "comment": "Malware payload", "value": "40cc84cb9c1a9cef84b71bf1ba6aca80d4c80078", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706366662, "uuid": "400fa01f-df61-4ed6-a984-eb24eef018ec", "comment": "Malware payload", "value": "88385135a0443460dc3ec146616ffcdae01e24e226be4edf18e8a4aeb9a88526b5bec78d6e55b2116d553b50d5dbcfd7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366662, "uuid": "fe305863-ddca-4bb6-8d13-434aa2778d0a", "value": "T1A0E57C86BF64AE36C0774033479A56393679CD649A82C687790C739D28B79FC0B85BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366662, "uuid": "08ef01b8-48be-447f-b840-fb87151ecce8", "value": "49152:y9EceWXuHuaVSyM+46eBaTPnKQ50amM/NE1rMel2lke03i:WXX+46eoTKQ0M1ALlNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706366662, "uuid": "e8a4b9d7-1f52-404b-871b-3f34fb0ad54d", "value": 3272331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706366662, "uuid": "6a363b7f-2d97-491c-ab9b-91b98db971b8", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706366662, "uuid": "389311cb-9d96-45ee-af50-489453e38a3e", "value": "base_50.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758d8df1-bcf7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706348151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348151, "uuid": "2ebc0205-25dd-4554-994f-7dcd19f43766", "comment": "Malware payload", "value": "457d52f29464fa21fdd030ffd75d21c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348151, "uuid": "750e82e0-5458-4dd2-ae52-8f4e0d60fa38", "comment": "Malware payload", "value": "9e3ca6e06b2daf3d424ac72569e9d5ab445576d88ad2c2b259aa8c35b7cbd5fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348151, "uuid": "fad055be-03ee-4a39-bc1e-25916d92d9bb", "comment": "Malware payload", "value": "d561a0ed7fedb40868935302e9097ee533ed3041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348151, "uuid": "e5f0a6a9-a9be-4450-89e2-5100c266efcf", "comment": "Malware payload", "value": "fba00cec1b2f87d1f52f02f1c045eb54099eb9f76b7c5e4488e94570ed9641e431164a2ddd7aeda3bb5059a51d584e00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348151, "uuid": "4374b0a8-89f0-4588-9648-56a7ad80965a", "value": "T18B34D7823145DCDAE04329F258AFD56060787D9E8165C60E3783BF2BA5E7343349BB9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348151, "uuid": "c4cbf68e-c58f-444c-acaf-29ccca1fe735", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348151, "uuid": "f73292b6-a243-4c89-bc99-3aad63043bcf", "value": "3072:2sBgsEWm7o8HHNnCDDRvLGbrOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/oPYm21X:2sBgam7o8HJstvLGyELbMUTKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706348151, "uuid": "ed1f9765-15e5-4713-9325-a799da0748f4", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706348151, "uuid": "8dbf4b03-8f95-410c-bfad-4856dbf10867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348151, "uuid": "aa3e05c2-9101-45a4-855c-d4e2809436ca", "value": "SecuriteInfo.com.Win32.PWSX-gen.19143.26592", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da103ad-bcb2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706318556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318556, "uuid": "dc3196a7-79db-426c-83ed-2921a77065b8", "comment": "Malware payload", "value": "31fdd740cf46bcad67c968957aa58bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318556, "uuid": "18bbc138-71e1-4fca-8253-4cdf621a06bf", "comment": "Malware payload", "value": "9f23b50ab732184d892f5176df06b775d06a316ac7699fce0f40821f48e059a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318556, "uuid": "35365cd3-3747-44c9-9e3d-7a59a6f3b967", "comment": "Malware payload", "value": "07953e216195d9787c7481b6740dea1d2399ca6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706318556, "uuid": "4a0df77c-5ab3-47e1-a826-97e379a4a74d", "comment": "Malware payload", "value": "8ad60aea011967f136c9cdc87a8d46ff5979d6c9980084979bcd3046c5c4f791520a9f4eb821ef0ac72d986ea2421895", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318556, "uuid": "8f71fb30-0ca5-4c94-9f6c-7ea955565701", "value": "T182D57C12A38241E0C496D53C5A3B5E3AFBF175294BB1BBCF22D006680E6E7E25F7D611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318556, "uuid": "29d480b7-c1e4-47e9-a43f-dc040a51f2b8", "value": "593468fae5f154c7d287a75735273c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318556, "uuid": "4a75f904-fd5b-43ec-95dd-75072769bd36", "value": "49152:UhQJgRtALf6pW6QSUERryU8clIKn33Ly4Tz9DMbJcioxcKK2SewFiYCJc7vfmI:Us+NSIBlnys9DMbJcioxcKK2SewFiYCS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706318556, "uuid": "3762f2fb-ca04-41a4-9843-9847ca4ab017", "value": 2892800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706318556, "uuid": "564d179d-4ceb-42bf-8143-c50048ccf742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706318556, "uuid": "d5a9471e-0433-49cf-938c-a9d1fb617cce", "value": "SecuriteInfo.com.Variant.Tedy.524944.19511.26459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c96f2333-bd1b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706363753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706363753, "uuid": "79ea35ab-6640-450e-b0ab-9e372306c0e9", "comment": "Malware payload (Socks5Systemz)", "value": "c2cf733b46e917a11e80c81ded333339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706363753, "uuid": "fd86f092-1aee-4f9d-8e21-8552345dab5c", "comment": "Malware payload (Socks5Systemz)", "value": "9fb58240b767ec4ca77fd4bc96131597e90c80ffdb638a02502c875fdc1fe209", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706363753, "uuid": "5349f03b-ac43-4ccb-93d4-008dc9eba749", "comment": "Malware payload (Socks5Systemz)", "value": "59130f5b773fc115755cd81e4ebea83f15e13019", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706363753, "uuid": "9e6b953d-cd8d-4d13-b644-070a5bc27548", "comment": "Malware payload (Socks5Systemz)", "value": "6fa62fd869473b8ca232131dae6beb714a7753e4e13ec8a6cbda564ba37cfe2b81830557b868dff8cbc97aa7e513f8cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706363753, "uuid": "007b831f-b48f-480b-90d1-cbc97be5a60e", "value": "T128663342E60D4470E3E182B94B7B5B28A617D45FF126D5FC37ACBE8C1C0FB206956B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706363753, "uuid": "5d79a2e4-d995-4a0b-b91b-225ae0a8534b", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706363753, "uuid": "9eb16cae-f412-42f5-9b30-cc49b6a08edb", "value": "196608:XgKh2FGRgHENrW34XN6hdp4sroQnClThBzO3PyLelhwIl:XP2F1wWo9Wp/2rO3GKhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706363753, "uuid": "7c63f935-a598-437d-baa2-7fabbad99f67", "value": 6534691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706363753, "uuid": "05522950-8908-416c-822e-fb32ac125462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706363753, "uuid": "15fd90f6-cb04-4cdc-84cb-0c7f3e77e2a6", "value": "c2cf733b46e917a11e80c81ded333339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "401f0ae7-bcfb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706349779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349779, "uuid": "c7bcbf33-ca26-4a02-aeb2-9e5bb9b3b3f8", "comment": "Malware payload", "value": "ab2ed8e9502f63755cb6abde302a8f6e", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349779, "uuid": "90402bca-1434-498e-9035-2e134e798459", "comment": "Malware payload", "value": "a2316445075f782b0aa040e688b79cbdb2ed60485dee376fb528fe0ab7e892dc", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349779, "uuid": "811c051e-72e8-4595-a356-8bde9d79169d", "comment": "Malware payload", "value": "484fc5c19ddcc7445d40d968ceae9e32c1d9ec2d", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349779, "uuid": "32cecef8-82ae-4ebe-9cb2-2be1dcaf776e", "comment": "Malware payload", "value": "0de1ab85522553ea25dedb50daacc3f54a31aa2dde90b268a5f4d8ecb77858014c0d47cdc85b36965c607af77622a424", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349779, "uuid": "e556e390-dfcf-4008-88cd-a89d74bdac41", "value": "T195F44AE43D1A95EB5D364F1AFC800CC7ADD61CBBE32B08A51079D7420427ABCD61FA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349779, "uuid": "7fb79533-1bb2-4aa1-a9ab-00102f2f312e", "value": "6144:LM6K9m9BdHsix8W4X4ixqpqq9n2oC9ONLKAunPwirlaoapzRde+Je+ascy:tWnzEr9nNC9OUAe6sscy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706349779, "uuid": "855fb8c9-9ad7-4d79-9e6d-854848dc5878", "value": 726479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706349779, "uuid": "1f065a7d-b877-4211-8091-4d08f420abda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349779, "uuid": "28adbfa0-d4eb-44c4-933d-b3f99ab0f24a", "value": "l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c85d53-bcee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706344116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344116, "uuid": "5c860c03-b4aa-4534-9830-1b4a01d03ddc", "comment": "Malware payload", "value": "9df315a2ac7faf134977442a948ca29d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344116, "uuid": "cace72d4-0b74-4319-ba3b-b613ca68f696", "comment": "Malware payload", "value": "a41e9c06f786f5ec2596cdfc6b6f15f481ab66e92c2ee1b1cae9ecc0da98b538", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344116, "uuid": "916a9792-da98-443b-addb-3e27ce145483", "comment": "Malware payload", "value": "efb361a06a89d0826735b5eb4b75b9b36b7da840", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344116, "uuid": "6ead6616-c298-408a-b695-7ef257f4b77f", "comment": "Malware payload", "value": "0ce819738063e223fa07b9b8b74cb428c03f972bf6d2ec69d9808a6b93c339d4f95bfe1be96e15825b63065864af5d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344116, "uuid": "87d47cf4-dce8-4cb3-9cd7-d5d8fc0a7394", "value": "T1B5552301339E9423E57A8AF54920188943777E523A37D3DE2C8735DEAAE2B744714FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344116, "uuid": "33790dc7-cb42-40ee-bc64-e983fd78d855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344116, "uuid": "dde3b89d-438b-4682-b29f-54462aa8fe73", "value": "24576:ArYJpk9ChHLU122H/VA9Ax4bdHu1W0ZGkDtsMIN45grtdX8M9JzvNFAKq+dRKo6q:Vk9ChrY2ae9AG5EW0b5grrX/JrNFPqIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344116, "uuid": "938a1139-30e7-4300-8140-da85c4b3d9d1", "value": 1330176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344116, "uuid": "02426b98-624a-4d8a-9669-1e87686568b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344116, "uuid": "d2fd7adc-0f01-4fa6-bf8e-e8c6fc8fbb07", "value": "SecuriteInfo.com.FileRepMalware.27803.30976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b43e0af-bd28-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1706369125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369125, "uuid": "4ae98048-0c07-43bc-a624-02f4f19f989d", "comment": "Malware payload (LummaStealer)", "value": "97f85a987f636f8124f2b36fa018fe7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369125, "uuid": "5beefdba-2db3-41af-aa96-4eb4a1fee34c", "comment": "Malware payload (LummaStealer)", "value": "a47b28ad6e7da22cc757ae05c695bb430e9f6893dd4adba32e1d114ac5208111", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369125, "uuid": "6988bacb-e976-4e9c-9ae9-16bea0e941a3", "comment": "Malware payload (LummaStealer)", "value": "db84e5266e422f6484c23115911c588252991bca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369125, "uuid": "fa04a14c-5d8d-46d6-b9ca-d6e0da63631c", "comment": "Malware payload (LummaStealer)", "value": "d60ff76917095301e367635526e91083cd31a4c5b3c6eabecac0a2391fd7ae7ac53ba5004378beb92912ea288e56958f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369125, "uuid": "6529d7d1-fd41-4b65-83ef-6d455c5bfce6", "value": "T11E6633B752A90441D1E1C93C9233BD91F1F6439FCA41E47DACDFDAC22A21AE6C653A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369125, "uuid": "10ad5215-39e2-4bc8-acf6-44ae8c302809", "value": "92c793d8cb6b7282468d96be14a44ca3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369125, "uuid": "a0e08dca-3132-49e2-84ee-d8ee6ee4f0d3", "value": "196608:U9tNpXZNOUdvv127bgotFadmuj4Kbsj3lRMn6nbL:U9t7pNO+92Zg9bsj1RMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706369125, "uuid": "e3c8c88d-f573-4ba0-8dae-eeac423cd074", "value": 7106560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706369125, "uuid": "a88db48d-c8e7-477f-ba70-dec91a8244b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369125, "uuid": "10914826-14bf-44ca-b83a-4069e2ce4db9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e45e7d5-bce1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706338528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338528, "uuid": "64da1caa-ed9d-401d-8e03-1b3fcea3a1a0", "comment": "Malware payload (Gafgyt)", "value": "4e9c8df678265c8cf35bec5b78d1465a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338528, "uuid": "619a8b78-faad-45ef-8eb3-4b89b42b62a8", "comment": "Malware payload (Gafgyt)", "value": "a4d61c991ba5cc36c39056ebf16847c4328c992234c770c9e230904e4cac8e45", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338528, "uuid": "4c9aa391-00d7-4846-8bdd-c0c72f144585", "comment": "Malware payload (Gafgyt)", "value": "151c7b0a8fb9b46d4f7178ae816b6fa8900f3cfb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338528, "uuid": "ccb4a4c5-5497-4ddb-93e3-afb3bbf7acd4", "comment": "Malware payload (Gafgyt)", "value": "f8c8a728d3ca6ce685acb657d3a2619000cb41ce245bcf0780ff54fb89292dbb0b9c07ca1398718c7e52b2c46574379f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338528, "uuid": "ea3ad55c-67bb-4996-8f8d-86ca43f85bf0", "value": "T186935B23B552C67BC0C756B91BCB9E618823B8BD0B33320A73D87DE42F169D92D59B01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338528, "uuid": "f836bd9d-b02e-4e15-be80-0f4d2a8ef147", "value": "1536:/7yWSCATAXfoGcHOtP4dBMO6juUcuO3rhptmoIcuOXFje+ZY6Q:jnATAXfo2tPoMaUcuyrhmrcuOXFy+ZYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338528, "uuid": "63ce0657-1cc9-4911-b261-f487a9ca23a9", "value": 89625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338528, "uuid": "69000f89-c531-4772-afeb-575520b20401", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338528, "uuid": "687a1592-818d-4ad6-af3f-7a7f5cd509b0", "value": "4e9c8df678265c8cf35bec5b78d1465a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bef55b4-bce7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1706341289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341289, "uuid": "6944d5b4-91d1-4d5e-a078-ba29caeaccd2", "comment": "Malware payload (Rhadamanthys)", "value": "3096f3cc9e7f93907da727ec134f14e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341289, "uuid": "522f3f67-5fa1-405e-9e01-317e96ab771a", "comment": "Malware payload (Rhadamanthys)", "value": "a86e787247976260e2fe93a539c35ae91b2b47a23f2c570d75f870c603a4fe88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341289, "uuid": "c722bd89-acaa-4dd1-84fa-fceb0da09ad7", "comment": "Malware payload (Rhadamanthys)", "value": "1f05e3b760a04d4e368dbcd6de2824ade2627b5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706341289, "uuid": "83364a73-1775-4427-9637-1647dba72edd", "comment": "Malware payload (Rhadamanthys)", "value": "f24aa1977f15a75bd03981e4e7fc74794a64c7da68119e8e24f73d1741096008a8fe83dee4afe43d9ef6884e264708a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341289, "uuid": "557e9d69-1630-46ab-97b8-f2d565aeaa64", "value": "T167D48B62ED868113E9F19FBE69B5EAFD112DA711EBC4CD4B17B8C9A047E130C7049D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341289, "uuid": "6c40df89-a0fb-44f5-a290-e91eedc7da73", "value": "815a983dc2c1dcfdcf5ea58bd5240e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341289, "uuid": "717be967-3c0e-4d87-8869-f933a23b61b4", "value": "12288:pIkecWFlEcuBNfMhW8CQjLQBkyf6Z7rDFiE:ikecWFucuBNfg5jLQBNf6ZPQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706341289, "uuid": "35b45671-0624-4942-80ba-6062aa7b6e55", "value": 623769, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706341289, "uuid": "1b8ab73b-2186-44ca-b0c1-0f5d637b3f0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706341289, "uuid": "8dd48860-993f-4148-956a-27b7feb734a1", "value": "3096f3cc9e7f93907da727ec134f14e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82fe59c-bd24-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1706367617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706367617, "uuid": "d5664444-2b02-4e45-977c-27032748a44a", "comment": "Malware payload (DCRat)", "value": "e38a38f51af221c3ea27313d6daccced", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706367617, "uuid": "6c24341a-2015-42f7-841a-119b67f112fa", "comment": "Malware payload (DCRat)", "value": "ab78533880c4f50761ea518991429261cbb921ccc4c870b542075e15acb6d988", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706367617, "uuid": "52a0a659-7c3c-46cd-a81e-86ee1b874866", "comment": "Malware payload (DCRat)", "value": "0c72d164676c18ddffdc9e3146a3591b2c29f61a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706367617, "uuid": "4eb4d8a8-c3b1-4463-89f4-d25e4af66ff4", "comment": "Malware payload (DCRat)", "value": "b342ebaceee22c3a404f6a46390e75b74449cf32fb684a30b17ab9a58fced7515347e3ec8914fb4cc391c35913a65ba5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706367617, "uuid": "3bf2cf26-adca-4fff-b05b-14bb12b681e1", "value": "T102662344E37850B89D8DD47FE82107D42E41771922E6C6DECDA3694898B08BFEDB89D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706367617, "uuid": "f6401a9a-8044-40d3-be74-3eaa36464027", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706367617, "uuid": "d0bda4b5-04b8-455f-a14c-a489130b5180", "value": "98304:i8QBkA1s3thT4QqcjD5cB0ugju4+pcxfpXSjicgEPZyWPV2GLaz2hDXKFYxMNifV:Xzl3Im81gxOYfpgvPZyWPVTjhqYL+lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706367617, "uuid": "d626d423-3467-4d5a-90cd-e529ba8acfd5", "value": 7034880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706367617, "uuid": "11fc54b6-097a-4e08-8e54-015d7831df4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706367617, "uuid": "74a00748-5480-4dea-8783-a8ce06f2894b", "value": "AB78533880C4F50761EA518991429261CBB921CCC4C87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dcd229-bcf7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706348149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348149, "uuid": "c9b4bf89-e4f5-4dd5-be05-22d5b37ffaec", "comment": "Malware payload", "value": "443cbfda3ae06a42d3d0aaf221321db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348149, "uuid": "4d172a3c-0b2f-44ec-aab6-3c6a098ed7a7", "comment": "Malware payload", "value": "ad7504bc4e74c2f9edbca5a94c4655035ba046ea57777db5f449c6b62970e1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348149, "uuid": "f4f2cabb-eae9-4dd1-948f-56ede7662ce6", "comment": "Malware payload", "value": "d4a7a16794894a839daeec380e7391b4b03eca42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348149, "uuid": "b4bdef16-8e60-40e4-a2dd-4dddee33cf37", "comment": "Malware payload", "value": "b6c1b7cad636761cb7fbc069f8b8e58dad97f746851932e67dda67859e2fe4e43fbfcda3d60498c2c18f1a5014509062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348149, "uuid": "f2f10ce9-066e-48f7-a792-0e140cb12cb6", "value": "T173E73368FD555187DCC88A77A62A7FDC60403393B304EFD30B36DB94AA117781588ABE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348149, "uuid": "5029862e-8981-4ac6-bccf-984370180dc5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348149, "uuid": "4a269f9a-fbb2-4ea0-bf3c-a8c228907887", "value": "1572864:9m6ML+MKi9pkT6SqHPMNMLpZyIdiB860EIk:Q6ML+XAp+6SqHPfLDji+60EIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706348149, "uuid": "57a397b0-8900-4149-868f-f0cc281ee094", "value": 65855928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706348149, "uuid": "03e146b1-ecc4-4f19-819c-61f6ec21cb8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348149, "uuid": "00dfe0b7-17ad-4a6c-9b68-a6173365e216", "value": "SecuriteInfo.com.Win32.Evo-gen.3086.14498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603ad47c-bd55-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SystemBC)", "timestamp": 1706388487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706388487, "uuid": "2e83f8f7-d6fd-471e-b58d-88f54b4d9b96", "comment": "Malware payload (SystemBC)", "value": "e4b306658c26422c3734e38fe35f3901", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706388487, "uuid": "13cd47c1-9ed3-4f42-bd46-3b9e926e35d2", "comment": "Malware payload (SystemBC)", "value": "ae16c9b0453f3cd9829140adcf38934bc8e2497373e1f3ff486c351ae5b1118e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706388487, "uuid": "f532a959-3ab8-40c3-8313-08ec6aec4b84", "comment": "Malware payload (SystemBC)", "value": "1e6cfab2ead962d98819ebb39df2f74cb4ede975", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706388487, "uuid": "edf708da-5664-4745-b0be-b12683b4bd8d", "comment": "Malware payload (SystemBC)", "value": "7de6bc24a1e36f067894a78ab9ae34c357c1cb35c9636775a04edbd9204efd7fb53500b56f709fd7e995beeaadd20239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706388487, "uuid": "ee014ce8-f76d-45dd-8624-2164bc5b7215", "value": "T12CE4E06517354A23CBA6A371E9B367020A21FEB69463D74793C8643969073FF2FE1312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706388487, "uuid": "249b4946-0257-4ca1-ad22-0211011ce201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706388487, "uuid": "688e13d4-656c-4ff2-9c4f-a115b1ea215a", "value": "12288:rFxTiR74R/ZaiskkLLpeVpKMwMRku787TrRANr9EE02+5M:m7UBC8pKMw9uZsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706388487, "uuid": "0dd57b43-55ff-4d52-afce-3c936f12fecb", "value": 660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706388487, "uuid": "b1db11ef-5bce-4c3f-8bd6-0918bd0eda0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706388487, "uuid": "4a735dd4-4704-4747-bb52-8c65de713aae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48b77ba-bcbd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706323399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706323399, "uuid": "c3812d9f-4e81-40c7-a777-2c0637c5a4c1", "comment": "Malware payload (Formbook)", "value": "d9bfe773265d8e646161f64178780d59", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706323399, "uuid": "370bdfe7-cc22-4b59-b3b2-85663eadd85f", "comment": "Malware payload (Formbook)", "value": "afab0351f755075f7e5aec9dc1c2bf64c606449ad15d56a3ca6a86c84b59e6a6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706323399, "uuid": "8107406f-cd92-4471-8685-d9d98877cce5", "comment": "Malware payload (Formbook)", "value": "5f2d2b23ef92f71d462e0cf966e9fdc8a1e50917", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706323399, "uuid": "d51414f5-b974-4e32-8e5f-7bc86374009f", "comment": "Malware payload (Formbook)", "value": "726c3b4e0551a67774858ca88892b4b8b4a9da1393401b7266bc943aba0bbf60ce4e48a75a7e7d354e910fc11f711c3b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "uaysen.cl", "colour": "#77E65E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706323399, "uuid": "ee82fa3c-8cb6-4b1c-a05d-dbd5bc57e853", "value": "T125D4236C9D28976A4D73E9A00A7F267F0FD74158020C68CE9EDA195DAB00F8D57ADF03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706323399, "uuid": "c5387ad0-ba08-4103-ad3e-6639d7cdceaf", "value": "12288:Hhnl5c9i101sYCD3MO41jeA7N4k9PYgMtom2iQXCU8nv6wYECuqu:BnWiCrCD8O41jjWk9PY8biQXUvmHuqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706323399, "uuid": "c3377cbd-5368-4625-8f6e-acb13518d8d8", "value": 609774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706323399, "uuid": "bdb0de3a-9b6a-485e-ac32-1d19d19566be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706323399, "uuid": "8d516a4e-ad7c-4e43-b05e-df855baf16de", "value": "Solicitud de precio_ORDEN DE COMPRA A4 - 000004019_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002ca2b5-bcc4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Heodo)", "timestamp": 1706326049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326049, "uuid": "44667731-4638-42f4-af02-4299b3085ed5", "comment": "Malware payload (Heodo)", "value": "3feba688cff492484e0bbad6032d6467", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326049, "uuid": "8d391d14-1d31-4b64-a0d8-424402102bbe", "comment": "Malware payload (Heodo)", "value": "b4827b98e1d8ae3fcdea2b331847c7a1d61c117b3d84974f89e7980c6eb9f92e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326049, "uuid": "67e60ce6-0e27-4baa-8c48-2deaa1ee4c5d", "comment": "Malware payload (Heodo)", "value": "2d15f80a40254dae9ac419f14a1843b2e3e01c85", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706326049, "uuid": "bf9d7a75-9a3e-4464-bb4f-78bd5b79e3ba", "comment": "Malware payload (Heodo)", "value": "a5a5404e6a6f5088106c733ecb40759182449776e9ef8e642e553e46f1c8a8670b318d76155b2e1436a689d9f4def93d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326049, "uuid": "a2f192c6-1a6a-44b4-9a9b-b4b55738b0fe", "value": "T142B6336839C506FAE9BF803CC990882AAA73B0315335C79F577487610F379DA7C29B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326049, "uuid": "25c330aa-06ef-4285-9d88-5cb284fd51af", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326049, "uuid": "eab46506-63f7-45e7-a1c5-fb7b98c297b0", "value": "196608:b3nxbEWTqgpVon3dDTQRHvUWvoYhxjno/w3iFCxHQbR8SEvXck6b/B:HTqgpVetoRHdTxro/w3uCxHQbr7k6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706326049, "uuid": "ced67642-afc6-4d8a-9385-be6a76cc1a81", "value": 10467683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706326049, "uuid": "87f0f41d-5bc6-4d18-8eb5-27237f4133cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706326049, "uuid": "df7b4188-27d2-44ef-9778-ee8fc2260aa6", "value": "SecuriteInfo.com.Win64.Evo-gen.6508.8965", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e17f7d-bcff-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706351671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351671, "uuid": "bf1c2257-2d73-4f12-80ed-b0dc7e7ac739", "comment": "Malware payload", "value": "aced6b3c9627848f1f20c76d205873a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351671, "uuid": "257397c6-30c2-44ec-8ba6-cc49efc688d4", "comment": "Malware payload", "value": "b4b0da2cdb7ab81095f251f66e71421765a60d0255dc5087959218578d2ecd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351671, "uuid": "184ae24a-5b9c-4dbf-a260-9ccb862ef0d9", "comment": "Malware payload", "value": "4e9f8d334a645b5a68fb7c39203c82cf0341a2b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706351671, "uuid": "1994ced7-799d-40a2-bcfe-2f79781fc405", "comment": "Malware payload", "value": "a7b543bb2f798f8856b0d1af923e641818bab05b07c0df5e61124d59063255b358d1ad24121a5daa0bfabe2e1bc3679f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351671, "uuid": "68252829-f848-41cb-8b81-e3f9f9e030ca", "value": "T19AC5E03FB268653FD5AA0B3146B39360997BBA71B41A8C1F57F0090CCF2A5701E3E655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351671, "uuid": "03f21ae0-9e7d-4964-be51-04b62b993078", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351671, "uuid": "db14d842-046c-4a5c-89b6-7ae328b378bb", "value": "49152:YBuZrEUDBJZDvXdwmfbFsWgOEPrSgmKvrjr:GkLD1/FsWgznxvrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706351671, "uuid": "bb5e222a-295f-47f7-a2b8-d21aa519d81d", "value": 2499080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706351671, "uuid": "dc363ee6-9e7e-4b52-a80e-47fb5d510392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706351671, "uuid": "240dbdbc-6cb6-4992-9cc1-52d5e4c27a3b", "value": "SecuriteInfo.com.Program.VKontakteDJ.127.26073.15069", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6916db-bccc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329561, "uuid": "45a9a16d-984b-4746-849a-1ddb5769d09e", "comment": "Malware payload", "value": "9b7fdf4807b64c91f5dcbfb56167e175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329561, "uuid": "5f430802-f0cf-4a06-b48f-e6ad7330bd91", "comment": "Malware payload", "value": "b5bb2215e233afd06cafd3281753f6a75d56452fb7409940eefc25c10c5d83b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329561, "uuid": "019af40b-386e-4b36-8349-3926b6d3a9e6", "comment": "Malware payload", "value": "bb98e2f80f29495e0f7f4cbebf6b1c7e2eeeda54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329561, "uuid": "273e8433-ed6e-40da-b00f-52d074943181", "comment": "Malware payload", "value": "eeaef15c04fad8555f4273dcf2b2ff8a2d9c4b6bbf72c762f7a4830756d3091aff1559cb2d375044394862ca7281b81e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329561, "uuid": "74e1cf48-94d4-4751-ae69-33bb1a8bc707", "value": "T12BE63341B7E2A0B1C87285F0086A936365BF796549B60F27F7DC6E0E4D34B921E27723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329561, "uuid": "a2df0155-00f9-4fc2-bfbb-c358e015081d", "value": "49c6b21891d7c24dacee0ba3ca0f123e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329561, "uuid": "34185317-d315-42cd-8dd8-f6b942ec693b", "value": "393216:VGWuwYF7mxY9VFfFOppZKLocvbq0pIDJ4uPxBa:VoNJmxY9VF0ppZKLo0pK2uPLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329561, "uuid": "80cbc82a-f6e2-436f-a17f-78157ace4080", "value": 14585760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329561, "uuid": "46f985f6-9cc7-4ace-bea1-384a9efe4ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329561, "uuid": "9136c955-6c0a-426e-920a-b20ebcb86f3f", "value": "SecuriteInfo.com.PUA.Smartspace.32088.16547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff4cd75-bd20-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Spambot.Kelihos)", "timestamp": 1706365616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365616, "uuid": "1017fd41-be66-4b4e-bb92-abbc01419238", "comment": "Malware payload (Spambot.Kelihos)", "value": "efe026bdeacf3927ce31c23cc0020228", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365616, "uuid": "44d4bef2-2b42-4102-903b-1e638d0388f3", "comment": "Malware payload (Spambot.Kelihos)", "value": "b8f8c3e2ff23311b7a135d782da4ca0e75863b39bb773b2dc29c63a6ea70bb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365616, "uuid": "a46f4cb4-da9c-40f4-858c-d4fa33456bd4", "comment": "Malware payload (Spambot.Kelihos)", "value": "61dc3da4fa0125babd7d2b40f1ad9889ff0e8612", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365616, "uuid": "6bb2df55-e320-46ad-8afe-01322bffd282", "comment": "Malware payload (Spambot.Kelihos)", "value": "a5b22abeb5300f0f8d75865bab85af556093f7dd85e09635456d7b3077bcef9e15f7ddf0ff43512b6f681b8eccd5a24f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Spambot.Kelihos", "colour": "#408350", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365616, "uuid": "be4fe9e3-95ca-44d3-b8a3-1a5d3b77b32c", "value": "T1B0C633C95ED8487AC0098D741E669A6087A3F78027529F0C9BFF853EEDA2F015531F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365616, "uuid": "82b7f523-416d-4da3-a250-b1261847c392", "value": "a73b2531bfc838dc3d19df5285b8d0fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365616, "uuid": "c490aac9-a406-45f8-b31c-a6301c25ab5d", "value": "196608:QwAjdbmFtqUToKqiZoXZvbOmdJF/yVZy1dH6EXlLg3tLRkBszi7EUhrovw9RyWWz:PAj+RU4o1rfa61dplALeBsm7x2w94xPr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706365616, "uuid": "eda97674-4043-47f4-b11e-90edf280ad39", "value": 12062721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706365616, "uuid": "8af8c4c7-2167-4622-a598-693d1239baf4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365616, "uuid": "7269a7d0-d520-4689-9a81-673173cd2211", "value": "SecuriteInfo.com.TrojanDownloader.Banload.249.1552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bb86b2e-bccc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329558, "uuid": "04b53dc2-56c6-4059-9908-203c9f065ce6", "comment": "Malware payload", "value": "d0985220a2cc3b185000f0ac9f36f60b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329558, "uuid": "a0e94ecb-5913-427c-8403-a7dbd5903ca8", "comment": "Malware payload", "value": "baa5a2b99fcb2dab6877d2ffe34e15b9de0a4aa8e7722af223f3c092185418c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329558, "uuid": "c4a1198b-1d22-4e99-900b-758edc5adc37", "comment": "Malware payload", "value": "4751c6239f2d28d78e5181addcd1a8faefdefe56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329558, "uuid": "87b09cdf-4370-41b4-895e-612e24b2e1fd", "comment": "Malware payload", "value": "df6164ef631e7a8d30c1801ead88c84b705b034f9368307fe171c950bb45f66b882696144e2d34b1b8c74fcb25fdd7b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329558, "uuid": "8364d8a1-b26f-4253-8691-60439f685b64", "value": "T102C73311F6B1C030DD9A0A31877E9A79143ABE21AB34E4C777C47A2E6F339E19532257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329558, "uuid": "b266fbaf-ca1d-496c-a185-4bb7a7b19982", "value": "e831177f8d48eb8e57badaf80bdfd78b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329558, "uuid": "938b04dd-21ea-49b5-8ecd-c85e613b826f", "value": "786432:agBD6Kwbu048ihxu2yn4N8ROwYs1puxJTQVu5gU/pYLTt1GlorAoqNBgqMOB3dN:F5ibux/3y46RPux8VwpYt10j/N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329558, "uuid": "15d99480-bc7e-4b1d-9877-f179b5ed5342", "value": 54026624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329558, "uuid": "d1036d7f-03d3-4d3c-b5e2-c93906830409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329558, "uuid": "f953d573-3374-4242-988d-c2d8bb026304", "value": "SecuriteInfo.com.W32.PossibleThreat.13283.7399", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dbe74b-bcad-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706316450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316450, "uuid": "e9bfa7fb-8104-41dc-889b-dbf8be54398e", "comment": "Malware payload", "value": "8e70b701e7eb28496984f48125d46fe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316450, "uuid": "12108bc6-33d6-439a-b663-9ebe59a64133", "comment": "Malware payload", "value": "bc27d9273914f9c228ea7f039edd8fe15b311953f9ae6e21b6b660efcb4a58e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316450, "uuid": "23b04cba-27b2-4e4d-85f9-74c5a33ee7ce", "comment": "Malware payload", "value": "faa909b3c19f65e4448f2f9c4949f21a64401af9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316450, "uuid": "b844122f-2b88-410f-bd1b-5bc84fd11349", "comment": "Malware payload", "value": "bcf6aea3e7824b9c40eb42c5de1c84aa595ce72fac9cd1aa58db8df6b6aa4bc0a1037350117547a8c75826a2655c2fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316450, "uuid": "3e272520-2704-4910-91dc-4e6d2dd846a8", "value": "T15C048D0A23E620A6E4B6177089F202835A357CA36B7593FF17C5D57E0E336C0A532F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316450, "uuid": "d6815f1c-b203-4fde-ab51-0ee0b1aabf5c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316450, "uuid": "fd95b71b-84ab-4a4a-8144-b0a4ed3523f9", "value": "3072:XMobR7ezAjLOZvmX1g5GWp1icKAArDZz4N9GhbkrNEkUzN:ceR7eammQp0yN90QEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706316450, "uuid": "6df2c5a3-cdfa-46ae-998d-55250bb5f9d2", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706316450, "uuid": "d6dd4d16-c9a7-45d8-b26c-ed4f094ff3d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316450, "uuid": "23ce87c0-f214-46a5-980a-117a01d8ed27", "value": "SecuriteInfo.com.Trojan.KillProc2.18834.21003.25927", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f42151-bd19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706362890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362890, "uuid": "81d3ad55-afd9-4b13-9058-b77107b731f5", "comment": "Malware payload", "value": "f93049c836f35d92073ccc646e5e0f4a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362890, "uuid": "a2c9c392-f583-438b-9d82-75ad789cf616", "comment": "Malware payload", "value": "bdeb9aa8c9ea7fef90d1d11bcd7a2a060ba3bfff1514ab6e58cc7c7f41bb8bec", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362890, "uuid": "a5008731-aad2-45d9-bedf-8b5d02ebffe1", "comment": "Malware payload", "value": "4cd5f2b547dbbdfd7a82ac1fc2ee41d180cfd629", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362890, "uuid": "5f73b0b2-60b7-42eb-b57d-3115bf01f689", "comment": "Malware payload", "value": "b255bd1aad04e6a9163fbf4e2617fde131ff376320145cf2a96ab836f9c3cbef43fbb362e2ab59033d587a3415800e4d", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362890, "uuid": "035d1a44-95e2-43d6-9ab4-6302b5e311db", "value": "T1BDE2F1D98AB051776F9BB8717EFC7CF1C04B3FC5E81045B8E8D7A624082079D7691A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362890, "uuid": "daec4927-4180-451f-8633-71be57a67e72", "value": "768:0nCWwPMfyV1KY25yJ9K2F5EaJNKHk6CYtN57YO5yPgU4ZsCisPW8:0nYyyV1brJ9K2FKppjtNV0F4SCK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706362890, "uuid": "9279093a-b4c8-480b-9723-c84a0bc66ab5", "value": 33607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706362890, "uuid": "4d791aba-a3cc-41da-8c9f-c5be21b23efb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362890, "uuid": "350a8836-7972-410c-b52d-73a42e993c6c", "value": "New Order.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "405be499-bd09-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1706355792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355792, "uuid": "dff4b1e2-9b74-48c8-a5c5-2bb2277168d6", "comment": "Malware payload (RedLineStealer)", "value": "4191c8de478c955ea6d71076490accd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355792, "uuid": "ac75e16e-f7f6-43c5-b3a4-5a994240cdac", "comment": "Malware payload (RedLineStealer)", "value": "be81af520de8c71d05587b22c03f7e683b0d6798ae8cd18eac451fd6407ec9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355792, "uuid": "903d1a20-707b-4270-839b-06dfd3fbe5fb", "comment": "Malware payload (RedLineStealer)", "value": "9d7dca9709a688a5489770eaf71f71a05205c54a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706355792, "uuid": "6ca6b146-bd86-45a7-afb4-1a2deb8ea8af", "comment": "Malware payload (RedLineStealer)", "value": "2bcca055157c5c0d28dcf403fc652f5441ed5cd4b30e34777560aacc5d57fa90769a6486ce0d368d646bcd484e2833c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355792, "uuid": "935aaf2a-4a3c-485f-975a-246b514fbeb7", "value": "T158A4012071C1C1B3D4B6153189EACA799F39B061477A85DBBBD827B66F213D1E2322CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355792, "uuid": "878fa015-ee9e-48ea-8e3d-ba5556dbeb4d", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355792, "uuid": "39b4f0a2-6917-4e48-801d-e1d51c75cfcd", "value": "12288:Ah1Fk70TnvjcuT5Qd3nFNYmNZZLv4gXq3pOrZv3:Gk70TrcuT5QFP7v4Z8rZv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706355792, "uuid": "10c4b32d-d20a-4be7-89de-202ecd720e25", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706355792, "uuid": "53de3a35-30d0-43e8-8e2b-37abe4df099f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706355792, "uuid": "3caa5173-6c5a-47eb-94bd-3661c5fabfe9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a8ac04b-bd19-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706362735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362735, "uuid": "8e276b30-af7f-44c8-8cbd-92ac8d178b94", "comment": "Malware payload", "value": "065e8f07a776d48cb53478e8bcf5c5fa", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362735, "uuid": "e23c4a92-5623-4f1c-86a6-253666e8e405", "comment": "Malware payload", "value": "bf8655f052eeaafc16bdb467ed99077fc81706a3764b3f839636ad2e2ef48313", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362735, "uuid": "42950cc3-9ad2-400f-a54f-b1b33e0cdc68", "comment": "Malware payload", "value": "0271f4b839c29b6b21d6ecd390776b709a7ca8cb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362735, "uuid": "1a9b9271-ab48-49a4-8b09-38ecef5b2769", "comment": "Malware payload", "value": "e93d80b933dad52dbb137aa1043848da70ebd6c7663bae585219f65725c1ed79f38d153d8a43e371597a492beb96d86f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362735, "uuid": "a8cb9236-e174-4210-b34f-d71556071243", "value": "T17E43466A774E4D69D65AD6F7425D494E0AFCF73A328200C0B9BCB3743B2D50E8B611B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362735, "uuid": "84452070-d108-4532-94bb-a79678e86cff", "value": "1536:bSUQp4TFaGxEq3IBozKEah0UyyCayn9tN6+Y9UAj6la:bSuhgSeSPyi9b6+YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706362735, "uuid": "378c747e-314e-4ed1-ac48-c752d1b789cf", "value": 56944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706362735, "uuid": "0838caae-a8a7-4b34-a73b-a21ecd92e906", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362735, "uuid": "75b00b77-c62d-4c06-9c31-c633f65d5ffd", "value": "mcirosystemcontainercleanerbyconfiuraitonproteocolstartedfrotheindustyrmostsucessfulpersondesignedthisnew.doC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5d0701-bd15-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706360936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360936, "uuid": "cdcb556e-adbd-43e1-8b41-5b588d859c42", "comment": "Malware payload", "value": "69bf4f2074138019ff0a116d0b8b332b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360936, "uuid": "dff8bcae-6073-489f-a7de-126a83a67c76", "comment": "Malware payload", "value": "c39497536a0b5917a7cf78c594a0901077ad83bec399950adf2527bb7c45b4da", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360936, "uuid": "0800c5cd-bbb9-4bdb-9c3d-aaa94fb35bb2", "comment": "Malware payload", "value": "256b3361c0d75a9f4354ba84b4e1ba67b0e90c94", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706360936, "uuid": "76052847-bc1c-426f-88a6-b3866b845180", "comment": "Malware payload", "value": "b2d90f442e0aebcbe47577914c4c43a55f50ea4011593d5f6e296accde8217d4a60da0c3e0718e5c751b4e5e1ea2325b", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360936, "uuid": "e5e8ed20-a242-4c63-8ee5-6f883061ab98", "value": "T1DF23A70175605B5B649D3BC9E68AC64F7848FABC1B348A0C193AF808DBF8D1915E5CFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360936, "uuid": "2e802de9-cd8b-45a2-af64-99f3dc750e19", "value": "768:gOT1jq7aDVyGT+RW3HRg4VZbWhT7dERJEWEyEdEsEZEtEAEFEpEJEyEUE7E+EZEP:ghaDN7q3dEnEWEyEdEsEZEtEAEFEpEJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706360936, "uuid": "bfb99e57-c9f4-4c5a-bf26-0da58ea00976", "value": 48457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706360936, "uuid": "bfced914-dc76-4ad5-8c72-a84688f747c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706360936, "uuid": "bb40b043-0d3f-4e15-b614-79373bdc4bc0", "value": "5nJBg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "158b911a-bcee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706344124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344124, "uuid": "70a5af14-3e13-4561-a4f0-e65f90adc4bb", "comment": "Malware payload", "value": "d368db799abe4419ecf32fc808218c79", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344124, "uuid": "44a9bef2-74df-41ea-970c-34e660ac0f4a", "comment": "Malware payload", "value": "c8140b653bf79bee53a20e1189f80058361dbc9717d8ef637a808a7c1ed77a26", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344124, "uuid": "3e6c0b62-6f58-4d6e-93f5-de7683f7f6a9", "comment": "Malware payload", "value": "f35c044df0749d5c2b6209a7f53b0cd0ff392970", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344124, "uuid": "74c90096-1201-433f-8d8d-c675c16dc0e2", "comment": "Malware payload", "value": "82c8687a19edb7c389ff73d7ebefe2dfa14688da129a17cfee1db96017df41c458c6474cc8b5de0774846cf0ee97dd1d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344124, "uuid": "aebc73b4-3170-42f5-a54a-8b42c39364e3", "value": "T13965AF51F652C0F2E59C02F0A17E7BBF46381A68132185C3B3D42D95EA712E376F6B26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344124, "uuid": "ea00a3e9-41c7-4376-8245-2ca93890d42a", "value": "1225e71e0d78defc2003a5c8fb2c257c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344124, "uuid": "847118b4-8cc9-4161-8781-0b920a4e03b9", "value": "24576:xCX92y/UMkMaVVJTot8FVf34VzIWHk0VhzOil5ZTJJJ23tpe9qs:x5y/27Rcs0VhxnJY3t9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344124, "uuid": "e6079537-0968-45bb-801c-d92860254105", "value": 1413120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344124, "uuid": "8824f31f-8d17-4fab-8107-0071d52363df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344124, "uuid": "ad3bb237-8a21-4f39-a0e0-f399af838809", "value": "SecuriteInfo.com.Variant.Tedy.13838.21470.7841", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05edf0d5-bccd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329924, "uuid": "afb701e7-3853-4658-b530-b8b7838397be", "comment": "Malware payload", "value": "96183ce51c4b468401f99d911d02659e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329924, "uuid": "bd2f62ff-059f-4bc4-b901-207a32d29825", "comment": "Malware payload", "value": "c88ac268d7e56d09a54c4aad3e71c2320f64223274f45516b2b8d8c0212d6bc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329924, "uuid": "c1088d76-0e1c-4f09-a23a-d1a36e25f6fb", "comment": "Malware payload", "value": "a44c27a8e4f1901d603889866170ca1e1a1a266d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329924, "uuid": "b82bcd40-9909-40e3-bbf8-5c5882d76e9c", "comment": "Malware payload", "value": "d9ec3edd861f5a0c0c7fffbeaf733d090c874b1e7e20898758cafec614737e7d176af2f40ed5b0f34b1892493057b6f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329924, "uuid": "85dcaf73-88b6-4d82-a779-439c1848b6ec", "value": "T1AE159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329924, "uuid": "e3aeccbc-6074-4a33-8c51-d434e516a14e", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329924, "uuid": "215e0da6-2196-410a-986f-5de07c9707ac", "value": "12288:FqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaaT2:FqDEvCTbMWu7rQYlBQcBiT6rprG8aq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329924, "uuid": "6e75bdb7-ebcc-4f20-9b41-0a6a0d4b5632", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329924, "uuid": "d3781a84-a437-4816-9e3d-a46c9a0bf770", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329924, "uuid": "e349803c-fa78-456d-af82-e8ce14c0eaf4", "value": "96183ce51c4b468401f99d911d02659e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b634d721-bd62-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706394215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706394215, "uuid": "d4d0c0e9-a61e-4634-a6a7-4f14541945c7", "comment": "Malware payload", "value": "3e5c90947019a1708e4ca616c4bb8535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706394215, "uuid": "40651b89-50fa-4595-a2d0-bee0d8d04247", "comment": "Malware payload", "value": "c98df69f561a03ef23e6154a4a99566f79a3e908a188d6b52724ef0c344e1439", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706394215, "uuid": "8c067e5f-eb74-47de-901d-34e11e59347e", "comment": "Malware payload", "value": "f23e82b51aabc72e7a6962d5a1fbe3b37e11b851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706394215, "uuid": "ffcc0705-45d2-467d-9484-f55dc14103bf", "comment": "Malware payload", "value": "6f5b2e7e0029fdb37c7de3925c8335e559e4635722f284ff185ed24f7707b647c74528f3822b37e22320c47eb6b0e82a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706394215, "uuid": "7457ee8e-cbc0-43cd-a9bb-cfca1a280ebc", "value": "T12D557C52E6F14258E42FC176CAC2D723EB717D0662218E7B4110FE197F367629E2932E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706394215, "uuid": "fcaf2856-37f1-4308-8d08-5ac242612a00", "value": "9d65afe96a54b66c4fbb7b438c958cb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706394215, "uuid": "0fb692db-f8f0-4759-b131-abff3dd402a5", "value": "24576:cGyYkOY8lskdCeu/QpDbTHHKsafd9O93X0HF7uUYoadN6I4LOm5Eg:NyYkE3u/Qxbb0PDYZNBkEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706394215, "uuid": "f6810772-0d1e-4878-b4f1-16dc10f37b77", "value": 1399608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706394215, "uuid": "97fd9110-c3dc-4505-a8ce-62db331c7c9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706394215, "uuid": "38e9d513-d60a-4703-b7ba-34085c21983a", "value": "SecuriteInfo.com.Heur.1201.4476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca3588c-bd1e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlackNET)", "timestamp": 1706364913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706364913, "uuid": "390f4c0c-5fee-4fb6-81c8-9f4aa3cd6fa6", "comment": "Malware payload (BlackNET)", "value": "d5ea5ec6d3dd740d1d8b6b817a667094", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706364913, "uuid": "1df6e943-d214-452b-9b69-273dade1e98f", "comment": "Malware payload (BlackNET)", "value": "c9bd849cb30e63f3fa72d83b52303b21f3a880a5e7c6236e38a92dc078467e8d", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706364913, "uuid": "2b8ef8cf-f3ce-4f2f-a07a-b55a10aea471", "comment": "Malware payload (BlackNET)", "value": "f75cffadf0cb8c7afac041d42d7beb416474e96a", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706364913, "uuid": "f9f06bea-6491-40b2-9ad4-3fa6caebc8c6", "comment": "Malware payload (BlackNET)", "value": "00dcc66f6d9245b3d8819e364ba0481de62eab8a4bede36edca1a653a69a3200bc5f54df0474a96a764f05b09189711e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706364913, "uuid": "335ae022-4bc5-494f-8ae7-36e21033a2cd", "value": "T18A73D44237ED6CA2D0BD9AB4BB3363C1C7B5FD1A0912D61D08C410AD5A7A747B981BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706364913, "uuid": "e90f66b3-44f2-47fe-8622-9429a7ad6f54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706364913, "uuid": "dd2f1072-36b1-4a13-867c-4c207d97be6e", "value": "1536:5ZuhD5z28TC2qM/AEc7s1PsYTgbSUPH4Lb0tY4:eNoEc7suugbSKHaboY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706364913, "uuid": "a6380e43-e114-4b6f-a3ed-c25bd82ebb0e", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706364913, "uuid": "b179e9da-466d-4fe1-bea9-09f018887b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706364913, "uuid": "0892e83a-0fd1-4cf7-b912-ae3ebdd07a71", "value": "D5EA5EC6D3DD740D1D8B6B817A667094.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6a9ef7-bcfc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706350419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706350419, "uuid": "db709e6f-977d-4142-aab2-f88dd82afbee", "comment": "Malware payload (RiseProStealer)", "value": "3a88c91fcb450823a8e9ee5573d81ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706350419, "uuid": "d24284d5-0a92-45d0-a011-4e9c10d38468", "comment": "Malware payload (RiseProStealer)", "value": "cb108cedd665fe2340d78ead74e8c9d3a8c03d1298c37bde34750fa252ff62d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706350419, "uuid": "4421126c-81dd-40aa-957d-9a14647dcf55", "comment": "Malware payload (RiseProStealer)", "value": "43e722df4cfa574560a34aae19b621251a1099f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706350419, "uuid": "f2df442d-97cc-4bd8-9104-94c80168bbb4", "comment": "Malware payload (RiseProStealer)", "value": "134dc742304381f23fbef7dbc6d5d137a37d1be899812713a73ab82321f1560db89dac59196b0037811e1e1e6626ed23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706350419, "uuid": "ef4db533-7726-46fb-ba80-ba2151ca506e", "value": "T1EB4533BE660B4755C14804F79DE8E5326EF8BDF0A29DA91F6E1F229401A50DE3363CC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706350419, "uuid": "e753eeb9-18b8-4bea-881a-1e46d74bf014", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706350419, "uuid": "b427c227-38b1-4560-945d-37c91f6b4490", "value": "24576:XylDG6+YPHJ9l8UZ/HC/a7pnhY7Z+wQHN2K3yWds0JkKyVY/4gXZ:XKDZ6UZP4V+l8adsLqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706350419, "uuid": "520f7dfe-7e6d-42e3-84b0-5ed1ac9c479a", "value": 1195520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706350419, "uuid": "3826a980-0cd0-4d27-ab38-9ce715dc7287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706350419, "uuid": "00a6bfd2-2663-4bca-92f6-490e26b10d3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac60195f-bd37-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1706375730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706375730, "uuid": "509e5694-fe94-4d51-a7ab-e5b68a34cd09", "comment": "Malware payload (Stealc)", "value": "a65402b600fac56a12987ac0acdfce29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706375730, "uuid": "7785bf96-a672-46e8-a0b2-f128172e8733", "comment": "Malware payload (Stealc)", "value": "ccc1b08a35d280181bc0bc35b33a28424528b2fd26bf1cd108d12bbbb028f40c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706375730, "uuid": "82886d36-e4d6-407d-a389-cff06eadb436", "comment": "Malware payload (Stealc)", "value": "1d4340e82a2507627b338643e62cb806cbf4872c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706375730, "uuid": "7774a50f-409f-4d00-81e4-ce0ad5ef0ad0", "comment": "Malware payload (Stealc)", "value": "08cc8d00fa62bc939a796faf7ea09fe75dc6badd3dfa2c120122bfcb7ecc5edbd44c85a1b46837c28e807a5fb1dd08b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706375730, "uuid": "2f57c2f4-0818-4198-9a81-cd6f784426b4", "value": "T1ABA611C07FDA1526B1B85F98C17D79D1E32D38C12E02E62D211A319EA973174C7B9ABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706375730, "uuid": "6955dad5-9cb0-45fc-b1d3-7ae6f6d505b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706375730, "uuid": "a0728bb6-bc12-48de-9a2e-2fb9a50aa3e5", "value": "196608:k2TjgmDUdzS/xy9CMzukTDepx5yKP5ISrUwUlJUkLq/I:VgmGzScxaaepqKKhwe8/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706375730, "uuid": "40571dd8-6865-413d-86e8-bbec36f66a06", "value": 10025472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706375730, "uuid": "a33187c8-f58e-47b1-baac-1ea850541895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706375730, "uuid": "6a8d3ae0-2c4c-497c-b50a-b73d13919dd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da20558e-bcfa-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706349608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349608, "uuid": "3bbc19f9-228b-4b1c-ada1-2415399f1c88", "comment": "Malware payload", "value": "a2e01e1a3116de1abb6a19bfd98b98fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349608, "uuid": "5952f6d0-121b-4902-b76b-7748e3666038", "comment": "Malware payload", "value": "d023904bb8537ca4eae6922683019bbe75f8041e8df2c7bce5522d4b5219d69a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349608, "uuid": "beb40c90-a123-4c49-94eb-8a69b2d45862", "comment": "Malware payload", "value": "fbd8a677484a41d800307350b05fd090ba261365", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706349608, "uuid": "ec40d129-00d0-4e39-a714-b073c157cadc", "comment": "Malware payload", "value": "8718d277847ddf050fa223bd79794ca4fd3ce4261518b9627eafb56b561b33d9f7f9b3c0a23b8bcbcb5c5cc0a9c2a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349608, "uuid": "4e851765-5ebd-4e1f-94de-e68f4b744a26", "value": "T1C7159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349608, "uuid": "0adfe6fd-3718-4cb5-aafb-d44c8413a1f2", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349608, "uuid": "e22c50e9-3291-4dce-a9d5-bd1695f98df3", "value": "12288:sqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDganT/:sqDEvCTbMWu7rQYlBQcBiT6rprG8aT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706349608, "uuid": "ff00ff94-e082-403f-93fe-ff1f76daf42a", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706349608, "uuid": "c234e4ad-7f03-4112-bb26-cd3eed3cc15e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706349608, "uuid": "4a191926-7dc8-473c-9f23-527f9163c284", "value": "a2e01e1a3116de1abb6a19bfd98b98fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6223019-bcad-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706316449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316449, "uuid": "97f37dfb-485f-4f56-aa72-bd775e5dce94", "comment": "Malware payload (AgentTesla)", "value": "4595983f2279e94a794918f99c08aa12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316449, "uuid": "5bb3aa6d-bd2b-41dc-aaa0-e0f4f8a193db", "comment": "Malware payload (AgentTesla)", "value": "d172a99be3a242602683908e636d281504ae75bc8b54b8fa2b22356f445da957", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316449, "uuid": "1a62ed9b-e65a-4791-adac-0a0e047172ac", "comment": "Malware payload (AgentTesla)", "value": "09db508dbafc6baec88cc2a4b810eff2bb4af009", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706316449, "uuid": "95f48988-c1f5-4315-99ed-fb74c63a0413", "comment": "Malware payload (AgentTesla)", "value": "8f8aa5ebdcc95860471c52efc3aece25aa446e7239be6c991181e237cf57849366714228f62d9cf33c9ece7958bed47b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316449, "uuid": "bb09210b-169a-42fd-878e-dd9e12e956d5", "value": "T17B23BE12379906ECC36B0B7C5CB002010B7166ABC81BCB8EAFCA4D9E5D67B9D5701FA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316449, "uuid": "c017efda-b930-478a-bec3-9a4285d60cef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316449, "uuid": "aab9bf7b-6969-4e82-8251-1acb9039f5d3", "value": "768:3IfW2do84tle1yvZxHvwsY3uEmu24Ra2DovIieNhIPVQPaq:YfEtl/DwsEh92m7ov0oWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706316449, "uuid": "c45cc7cd-2315-471a-aff0-a673d8b01d84", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706316449, "uuid": "f5a62cf5-1698-45c2-a073-19223a34b5fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706316449, "uuid": "7295ef57-6ea7-4304-b1be-5936d57ab521", "value": "SecuriteInfo.com.Win32.PWSX-gen.7149.22442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f90f80ea-bcdd-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1706337204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337204, "uuid": "a94a2ceb-08b2-4e3a-a458-32ef419defb7", "comment": "Malware payload (Formbook)", "value": "7c66434cadc9594f0d799ba51e35169e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337204, "uuid": "c8dfb5f0-46f8-4aad-801c-e68ef47765da", "comment": "Malware payload (Formbook)", "value": "d2caf40e890ee4529f112ebfd9be8da1f2ef514f5ff60aa99cdb9e2ff187f44e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337204, "uuid": "c36d3e71-4a86-4859-9959-17a11e82349f", "comment": "Malware payload (Formbook)", "value": "1594343a011ca6a061c40bce3be8444c34d8563d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706337204, "uuid": "e68ad7fe-995c-41aa-860c-f9c8684ef3ed", "comment": "Malware payload (Formbook)", "value": "4b1859a285f3ae6f5122e331e1b69766e1728b0788b22b801a4248dcbdd8ba00306e29ea1cf9fe69e1186978838f308c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "raj", "colour": "#8F309A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337204, "uuid": "800e569b-d1f9-48a5-86c3-bba2e2116897", "value": "T17BD423CA07AC427F48244DCB18C44C3D07FE5F8B11996B69ED40EA6850CAF7562B9B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337204, "uuid": "5b6b2793-4b9f-49de-ac1a-1239e08deaf7", "value": "12288:HJVlCB/fGv9eiB9BHwVGyjxUdhxxDDdOp5mjVBFqX7qDc0W2mUn:pVlsziB9QG0IzxDZOpWVuX7qDc03mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706337204, "uuid": "41377988-0a3a-46db-b5b7-589d09804b74", "value": 620572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706337204, "uuid": "85760a50-063d-4fc2-8de3-e4dd7b15273e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706337204, "uuid": "9af039e7-09e9-4079-83f1-2ff89eacb200", "value": "Payment Advice.raj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "356f4991-bd18-11ee-b7ea-42010a9c0006", "comment": "Malware payload (N-W0rm)", "timestamp": 1706362216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362216, "uuid": "b57e5411-3716-4a3e-ab54-6c39f6fbe8fd", "comment": "Malware payload (N-W0rm)", "value": "cc1924e912c7c31c5c9b18c9c62e9618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362216, "uuid": "c778bacb-ffd7-4d56-86a2-63798544eb08", "comment": "Malware payload (N-W0rm)", "value": "d75c9d4be8e7c01012b95bcd0378a9540333b9deceb56904af353d9a53344cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362216, "uuid": "f7177150-a8e6-417f-9627-7d6e7b36fd6b", "comment": "Malware payload (N-W0rm)", "value": "bf2868fc126c1824a89184e661749b4bb2e17480", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706362216, "uuid": "e32127a5-0c98-44a0-8240-2aa886744459", "comment": "Malware payload (N-W0rm)", "value": "93aee91ad667695c0b26f3ffe10297c22447f6098696395e278433de3a3dc823d282c00cae5f66260f7260d5b8acb2b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362216, "uuid": "a3a3e477-f8cd-4d37-a9b6-961bec2f24a2", "value": "T1DB237C0C778CDA27C3BD69BC84E6114813B491F7BA53D3534D8671A86882FED2A47787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362216, "uuid": "ff819640-ef2c-4a3f-a5f7-f51c5aee6dca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362216, "uuid": "b5c5b44a-33dd-4fb7-8409-4806a1d00443", "value": "768:NMqeds3Wzo/TYoAUwhyx95UjKwAIT2ZCbseTL2KxT85mQ5xDDJ:NMLK3Xso0c75Uvt8CbsSL9xoFDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706362216, "uuid": "1ef0169a-7b7a-4c9f-aec4-01e929402c73", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706362216, "uuid": "9ca96263-fc85-469a-b9d8-691e884ca328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706362216, "uuid": "9ee93c14-0c44-4deb-bdfa-b497b39b0325", "value": "CC1924E912C7C31C5C9B18C9C62E9618.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d5195f-bcd5-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706333442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706333442, "uuid": "51d3a70a-de39-40a5-ab7a-6c60311709fb", "comment": "Malware payload", "value": "c642fc238377c2267351dda1ac5f7faf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706333442, "uuid": "5d5a7ce9-af7d-4391-8176-f0e3974d4312", "comment": "Malware payload", "value": "d84318f316170419c1298f668f8a27afe22898a76bb74bff6ea06048c245d405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706333442, "uuid": "4ac9c20a-cfb9-4fbc-9842-cf5b0c4b0582", "comment": "Malware payload", "value": "5b11bec9bbe2ea9c74480ea0a93277f29c5de1e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706333442, "uuid": "3e055f21-5d94-48ce-abc8-9d1f949d6d9e", "comment": "Malware payload", "value": "2a57975e2da50c3540bfe60cce5cba125235dbbe1ac363fcf73e0c0f8918d38ba763d1f4b54a38d4f8c8f4a206aa70c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706333442, "uuid": "4e33ca66-b822-43be-a6bd-4903235ed9f5", "value": "T164E3E0AB784C70F3DE9ADB7020F56AADECBFA29615F00D0D8714558318B9B20DA4F91D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706333442, "uuid": "b75c449f-3db6-47a3-a503-f85cea9c99f3", "value": "be8581acc8a3e981ce0542b844db54a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706333442, "uuid": "91c67b53-eaee-4daa-aac6-8228db289db6", "value": "3072:FywszNx4nzdPsR4Na6SaDhwGgxKhe5CeZPo44gvRoYte7Ih:WzX4nJflDEFZPQgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706333442, "uuid": "06e4b291-f0c7-41f6-b9c8-4fbb36a78844", "value": 152480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706333442, "uuid": "d9a7d61b-9e19-4cd9-90df-a4c2eabf12c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706333442, "uuid": "bd806f0c-8ff0-438b-9c8c-5a198767f37e", "value": "SecuriteInfo.com.Riskware.00584baa1.28166.30022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7615897-bced-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706344020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344020, "uuid": "6e1cdbf1-6776-4cae-9bcb-0dbce0cd5000", "comment": "Malware payload", "value": "eaec652963be815d68fe09022bf5d383", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344020, "uuid": "64f83282-cabe-437c-8ed2-6292e5d76b27", "comment": "Malware payload", "value": "d887f5623ce83195700817167728a996bf72b9fcb54d705e1d8b8d53c7654480", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344020, "uuid": "65111215-f4e3-4ed9-9aa4-caf4e5670e3e", "comment": "Malware payload", "value": "a38bd020fe4a0496431f209d079831c3617ab05c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344020, "uuid": "54ad6816-21c2-4c0f-a323-3c1d2e26fea4", "comment": "Malware payload", "value": "e0bfc90be20013d87410636c27baa3c64f4e576a32c94dd07403ac4bb384f4bc0e7cf9d6f9656edf77e4febcc612c4c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344020, "uuid": "e9d91bb2-fb28-4f18-92d0-132fd81d6f32", "value": "T12E159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13A81D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344020, "uuid": "0a2db131-0e16-44d2-b2be-8649dd32f729", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344020, "uuid": "725c4c43-ee80-4a7e-b081-80b6cd71a931", "value": "12288:NqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaoTc:NqDEvCTbMWu7rQYlBQcBiT6rprG8awc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344020, "uuid": "d162f593-4e99-48c1-99c1-fefc90e67d9c", "value": 918528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344020, "uuid": "079925dc-fc0e-40c5-a57b-542b801a1a2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344020, "uuid": "d9a9231c-a1c1-480f-9748-372d6f9efb65", "value": "eaec652963be815d68fe09022bf5d383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df197f98-bce9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706342315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342315, "uuid": "0e385ef2-5f90-4764-88c5-064d547f0ff5", "comment": "Malware payload", "value": "9ad0dc56c7f7492b4555812c774fe3d6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342315, "uuid": "8e592b9b-a8e6-42ca-9f2d-e10caa80c95d", "comment": "Malware payload", "value": "dbd9dcd47010476f23da069f9d2c41c9f20b08bf3eb506c5c8bdb6dfa6811c4d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342315, "uuid": "1f16c82a-5f33-4b06-b0f0-d3b4885d9d04", "comment": "Malware payload", "value": "4b18214b4b08864f0073f56d098e2b4f0f1997ec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706342315, "uuid": "7a8a1067-22c5-4741-8066-3ad0d0dcb0ed", "comment": "Malware payload", "value": "5d2f4e23cc58ea4047f80f95f3f3a6ce7e04c2dd74daae9cdca783ad795f005c7f16e70712c568cb89af0c53a1fcffe9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342315, "uuid": "21bcb2b5-8544-4046-98ce-df30ba7e5b8c", "value": "T1A4660932259287AA3B84246DDA94D4C01C3C6C5361D2EF43D9937A26DBCC6B4D2FDA37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342315, "uuid": "502b41f2-b844-4b2a-83e8-401de9b56996", "value": "49152:pDH/1og88w/d8Q3YOkgPJs8vU/knfBLi7kj6dXjocM:M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706342315, "uuid": "89c1a70f-9593-482b-a8f4-c964b4963d9e", "value": 6677712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706342315, "uuid": "e1aa7947-044b-42a4-a930-38b79e7fc168", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706342315, "uuid": "7471421d-7329-4f0d-945c-65b699e95c60", "value": "64201921222189.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0143184-bcd9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1706335391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706335391, "uuid": "0157f9f2-9605-4071-8cfd-a831f3c1ce81", "comment": "Malware payload (Socks5Systemz)", "value": "f94747901a9f32aa41d1212d6ecc4312", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706335391, "uuid": "240c9df9-76ff-46db-82db-5f54c99d8bf6", "comment": "Malware payload (Socks5Systemz)", "value": "dc4f7ed505c4426d0e04c603b1489ee10e46c703fce2c2e427ea9f9ec21b3ec4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706335391, "uuid": "2b13a71c-dee2-4d9a-a712-41cb511c67f5", "comment": "Malware payload (Socks5Systemz)", "value": "d9fc5944eb256160e589d4de0a5ba5ba06167728", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706335391, "uuid": "d7fdd00c-a5bf-47a1-aa77-fbe6bc59e31d", "comment": "Malware payload (Socks5Systemz)", "value": "0642eeae7e4a27bbb2b13b1828ccbbbe6c28934db57fb4972468278cb2f36b4355846cc1e970f3462314fd8cb2c3a990", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706335391, "uuid": "1ce29834-168b-4d42-b025-d1f5b4fc0775", "value": "T16846330A43291479CABBBF7A6C499D1ADD1B5CDD2D1DA688029C24CB4EF2F68007FD53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706335391, "uuid": "a278ddfd-81e0-49d4-9b1b-d52914c1e704", "value": "e92b45c54aa05ec107d5ef90662e6b33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706335391, "uuid": "1c37f245-a404-44fe-857d-1afda244f539", "value": "98304:uiM35yxqVrmzF+oZ8SpqtXNZmRJf+/n5O6fqXqhEaMRnfBizbrLnBdTmxVC1mkL:bMwxqlm5FCdNR/n5O6feqz6Bin2Mmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706335391, "uuid": "591f3435-cf44-4bfb-8823-8f7018c08107", "value": 5828784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706335391, "uuid": "b777fb1a-aac6-4210-98f2-4da24d13a024", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706335391, "uuid": "14d8977e-b7ba-4bcb-998a-39725e21d54a", "value": "f94747901a9f32aa41d1212d6ecc4312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3f45ae-bd30-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1706372829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706372829, "uuid": "dd13e5a2-adc2-4a57-9665-a97a56a08b34", "comment": "Malware payload (AgentTesla)", "value": "ed9803cf4fa4d4251627ce1ed3128bfa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706372829, "uuid": "a6f92853-a88d-401f-ad9d-beb37dfb35c5", "comment": "Malware payload (AgentTesla)", "value": "dd95a518a502780ec49b27354a120d36ed0e804cf4afb26b6887ffd49ba9317f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706372829, "uuid": "2df5c2a7-4746-4af2-8c96-002fa5f56ba5", "comment": "Malware payload (AgentTesla)", "value": "4904106d13d6c892abbcb06594c6a774ba9ea6fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706372829, "uuid": "e3d6be64-e76d-4eed-afc1-c55df2024b65", "comment": "Malware payload (AgentTesla)", "value": "7b88242e1e5df887e2b7dc0180b5c7b70250acc86cbcccde527f42f9b95b32ec44df2aeebc97530a6587539d32e34288", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706372829, "uuid": "74d62c54-b472-46dc-96c6-a4aa0f779684", "value": "T162353343C1F88E3BC5BF97FA20965186077E1F7321A9F9094CC449CE14A2B8542A7B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706372829, "uuid": "01e8ab48-c8ab-4cea-9492-f9ea5d8e7683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706372829, "uuid": "bd04bc46-b4fa-4ac5-8cb8-c41489fcebd1", "value": "24576:pITMvRFhRRbNWoCfkYSEH3OqtwIuXKkqjVnlqud+/2P+A:pITYbNbNWo4kSH3OqtwIjkqXfd+/9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706372829, "uuid": "7dc4c76e-470e-4537-ad92-9d743a1ea98b", "value": 1131520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706372829, "uuid": "699480fe-0432-4893-a50d-911b4c47d4fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706372829, "uuid": "7f8dafa5-5ae2-478c-8c71-fe0d6f8a4de8", "value": "SecuriteInfo.com.W32.MSIL_Agent.GCC.gen.Eldorado.24365.9229", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc902481-bd68-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1706396803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706396803, "uuid": "550f88a1-ae93-4629-93cc-203c139da04d", "comment": "Malware payload (CoinMiner)", "value": "5dec9f02f7067194f9928e37ed05c8f6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706396803, "uuid": "e4aa44f7-7f56-4b01-b6af-82ef17ef9718", "comment": "Malware payload (CoinMiner)", "value": "dfecb99cc255e99b5df34a042f0585c0e8458a4e0075e7d513d2c0b492c41806", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706396803, "uuid": "ebca71da-828c-4b9e-8003-27a488b3cd6b", "comment": "Malware payload (CoinMiner)", "value": "06f13ca068514d08f0595ded4ef140078888235a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706396803, "uuid": "0a2624fe-58c5-4447-ab77-1c782723a3be", "comment": "Malware payload (CoinMiner)", "value": "1c1dd7f0f5a8b61da88445d9bf0ff84cfdf2afce0ccee87b93857b3b05cbddc93624d45af550c8a90b4f6a251abcb90b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706396803, "uuid": "2d485693-7bc1-4677-973b-61aa13c4f58a", "value": "T185C5334A93977330D60D087C02AEABD546992264579877EF8CD9EAB442CCAD4D43FC2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706396803, "uuid": "2bc4cbc4-6181-4cea-b57b-adcf84df30ce", "value": "de41d4e0545d977de6ca665131bb479a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706396803, "uuid": "4086ad6c-5706-4336-b1ed-ad66c86124ae", "value": "49152:A0jhMlqDbsynliN2InCFvy0l2aMEBLWw/3Ry0rP3Fga/EO7xhbAIXdTBpox:QyliNjnCFvxMEWw/hy0bFga/d7vbASB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706396803, "uuid": "629060db-6a36-4c2c-b3c8-2cd8a0fb3c98", "value": 2605056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706396803, "uuid": "37e6e9be-a8f1-475a-96dc-08454a42164a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706396803, "uuid": "65b74c24-b990-43b7-9f60-a1ac51e0f2b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b52a359-bce0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706338228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338228, "uuid": "62a83309-49f9-4b33-bdcf-41212d632569", "comment": "Malware payload (Gafgyt)", "value": "dc870ec901d79937f4abe2b44284612c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338228, "uuid": "e4f2eb46-6e1f-4e07-86d7-786358e48fc8", "comment": "Malware payload (Gafgyt)", "value": "e15fc9d72c9abb34ab053f19730930493b7bc6d881cdefe7ce5ab5d25deed0e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338228, "uuid": "8b67433f-5794-45d9-9345-83024c2e1324", "comment": "Malware payload (Gafgyt)", "value": "f95397fedbc7c802c5fd2360d8af27117aa4c481", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338228, "uuid": "41f14429-7944-4a1d-a476-338c2dce2306", "comment": "Malware payload (Gafgyt)", "value": "f48d539c7265c13e8bb6af5218228f104f676b4f7d32fdb0c2b5816c35a3b0a9bad56ee73ec246aeba5af6b9dae92692", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338228, "uuid": "21455206-6258-4ffa-aa5d-89683b2749cb", "value": "T13CB3943A7E22AFFEE168823107F35F70979521D237919385E26CD6181E7128D1C9FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338228, "uuid": "424b7da3-48d4-4380-9c3a-bcb51f62c2ae", "value": "1536:y7j+1TsKvqunvyoa2rKzoGhGRGpGQHnZdMUseEfi8mOu4RiUmkiCFx1DC7xmgQ:1+KU7nZdMUQhmOJiUmkiCFx1DKxmgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338228, "uuid": "717ae8ff-802d-4563-b83b-7c1c4a7673ba", "value": 117624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338228, "uuid": "34a82c08-ddf3-4ef0-8a15-b4fa2a3d2470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338228, "uuid": "a52d1fae-a850-411c-af19-3ba35200192b", "value": "dc870ec901d79937f4abe2b44284612c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6990bce5-bd11-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706359297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359297, "uuid": "d0093624-40dd-497a-be47-5a859a84ff36", "comment": "Malware payload", "value": "277f8f8a7b767860a8e7bf1aeaa1fd6a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359297, "uuid": "ccc6885b-fb5a-4236-bcc5-f2b074a65101", "comment": "Malware payload", "value": "e2ee9ac33c1e07a99f8cc6044f0a7b830e892fbfbfd7d6e8db916707e9c34035", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359297, "uuid": "5816bbfe-72c3-41d0-9780-5846ca260b77", "comment": "Malware payload", "value": "64142b293363c2a23cbda456023c9fce51b31333", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359297, "uuid": "d1811dd6-5351-4df4-8cd8-a3606f183984", "comment": "Malware payload", "value": "cff16c9d61ca9608683b6c5957bd79380c3d958150492a2b5addc21534f22c860fc55eaa33a83120a96858a141df6e2c", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359297, "uuid": "c8f89201-d2b3-49a2-a682-c48761047043", "value": "T16DE2D163C5602D7EDB664133B1F62BC3D10D7827BA2778299F32B6288C660CF5D75498", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359297, "uuid": "f4b32c86-fef2-4f7a-9cfe-155bb58debb7", "value": "768:XGQt6muFze6j3omfsRYKiAMx9Xg0mphFkH8B7:vH+660CYYek9Xm5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706359297, "uuid": "e8f082a0-94fd-4931-8ba0-319130b2e57a", "value": 31375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706359297, "uuid": "8281f2d0-1e89-4394-b2dd-0bbc4eeef252", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359297, "uuid": "72892ffd-9a6d-4e27-bc6d-b97f8eeb0330", "value": "Copie de plat\u0103.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef75dc3-bcd2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1706332275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332275, "uuid": "57e90414-28a0-4300-bc5b-2fe68da3bbb9", "comment": "Malware payload (Arechclient2)", "value": "781e0a527aa5d0047e6f9c0867550921", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332275, "uuid": "04cb5773-bdfb-4418-bd2b-3c3d72474c77", "comment": "Malware payload (Arechclient2)", "value": "e319163a616fbf86f1f6a92663cf562eabb2aa8970372b3864b30e48b5cf33ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332275, "uuid": "fd5cd57d-d440-4a4a-9d89-2f9669eb83a8", "comment": "Malware payload (Arechclient2)", "value": "d437da87c56228cff0c084a18b1b6844b7152b6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706332275, "uuid": "42bf225a-437d-484a-b5ca-68715765d753", "comment": "Malware payload (Arechclient2)", "value": "c73c9838c96ed4c9a716264263f89ff76312bae2697cfd4ce272deb19d667701d46da5508c2cf76f299532c7b4f06ab9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332275, "uuid": "c4694a71-1010-44a1-b55f-997ae39fd0c5", "value": "T1CE36E0723790CFAAC75F1236D0A20068CBE1D8FE4362FB476B3555B91857316ED4E0AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332275, "uuid": "33c34a1b-4f69-4547-981c-4b1ccb16a2e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332275, "uuid": "b44a8cbd-3628-4940-a55f-4ff619e8acdd", "value": "98304:bBfaLsyuN4Lw7ZgCTGxjlkzb5ZEmLmVTO1D:NSYqLtjWpJYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706332275, "uuid": "d38822c0-b94e-491c-bf48-8072a812a537", "value": 5212672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706332275, "uuid": "d0651e8d-7d64-479a-9927-0f4c6c2f5785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706332275, "uuid": "0a04bd95-581b-4272-87a4-a96eeb0b3504", "value": "781e0a527aa5d0047e6f9c0867550921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e281c138-bd45-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706381834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706381834, "uuid": "451f0150-bb27-4b2a-b050-99ea1709624b", "comment": "Malware payload", "value": "b6c958bc875379f7eb6b3325146ea119", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706381834, "uuid": "9431f6b0-3418-49b0-bb3a-1905d95da44b", "comment": "Malware payload", "value": "e5dac6f6d2ab4c479c5c3e91064f335de141c8399bd93f8267e13f134c578c0f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706381834, "uuid": "4d7b2380-f9e2-4c9e-9095-c42604ea3f5a", "comment": "Malware payload", "value": "7c39660981558777553f3a2413b5e6e581e0120d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706381834, "uuid": "942f83c0-1c74-4cc9-9b1a-98832ba439bb", "comment": "Malware payload", "value": "28ed3bc2c29e0dfa464cd903082f37602c362f10b884c91bfc1f6a7eb260fc92042704e299de46f0f96500b167e6a093", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706381834, "uuid": "5f4da093-a757-41de-afef-967d6f6feabf", "value": "T15F54BE18F2F15B2746CBBB8866263C7C9289AE4702D191B0550CA5F1B7F7DE8D639C32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706381834, "uuid": "d5af711d-f4f5-468b-927d-144dcc18cad5", "value": "6144:y9vq2ZtznY7vt0oUcnQyYdZuuyn4GWkSEiavfyNIOv023tri/3+4Cp:QvhZpY7vyVcnAewSigy+2o+4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706381834, "uuid": "7991e513-33d4-4ae3-87f3-95989a91df67", "value": 279323, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706381834, "uuid": "0c40b420-59ef-4ec5-8081-d332864c3318", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706381834, "uuid": "3b8b5b89-f9a9-422f-8a6b-12cd5071122a", "value": "2.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f573a5d-bcf7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706348140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348140, "uuid": "f67e7f95-63cc-4d68-98ec-59eb3767fef4", "comment": "Malware payload", "value": "7f05c06a72e842d18f5fa5a5e81a044f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348140, "uuid": "de6b20fb-85ed-412e-a576-eff495fe7f39", "comment": "Malware payload", "value": "e627d8f42e56c6be761e1d9f3d9dd7299082f80f1db449353228eb45879e8e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348140, "uuid": "dde49220-fe53-4f92-bb61-3a9809d5be97", "comment": "Malware payload", "value": "dd4bc97454d4ab95001d54147ad9468eb920db90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706348140, "uuid": "dd3b95d8-4d89-4612-9439-b9e9e9fa4d09", "comment": "Malware payload", "value": "82c05f350e152a376bcfc23ae080be9d4d95fc2aba5623996a940ffddf3505eb9c03930394a2e6ab63645253d7c6a88a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348140, "uuid": "255f3327-38f5-466b-9031-c9fde01000ec", "value": "T19A06900BA6F9C114F5B2A670DAB642F6146A7F40E738C5CF528F3C5C7478A70AA20767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348140, "uuid": "1a14a89b-6ca5-47fb-8dfc-360ee25f2110", "value": "0a59a37490abd4dbbd47dd5d4cff884a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348140, "uuid": "edc6f70e-f062-484a-80b9-f35d5715d854", "value": "49152:khWYiqN/jzwSUL9kqxJGjRTZyKCuDHwb0X3nJhp:khWYi8jzpqxJGjDHQS5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706348140, "uuid": "e5dcb71f-b001-457c-ab54-9293190433e9", "value": 3866672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706348140, "uuid": "3ba46078-c3a2-4662-85c0-26c6a0b28898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706348140, "uuid": "3b9cc243-08b9-42ff-a6d2-2ec95ffe045e", "value": "SecuriteInfo.com.W32.PossibleThreat.7754.11139", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ad9712-bd20-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706365619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365619, "uuid": "af55db40-dcac-414d-a46d-04aa8c5b6335", "comment": "Malware payload", "value": "0f49b878cab4c3dc7e377d65926abacc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365619, "uuid": "3f3c3436-f767-44d8-b0c5-f283200bcb81", "comment": "Malware payload", "value": "e6354fa02e134eb355fe13644157e098add4b3d35d4c775b6f114a7304fcad04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365619, "uuid": "3c4a3fc6-c0be-4419-818c-5b0868ddaf35", "comment": "Malware payload", "value": "e94cb44c8ea587b2c10d5e9c399a739608f44476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706365619, "uuid": "63fdadb4-9659-465b-888a-ad8e60d9eeb1", "comment": "Malware payload", "value": "4e907e299ba20e00c4b126f92f0df998c61f7a9bc98791e0cc6ad7ab7268194dd3eb41083d0491326371817932f55d38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365619, "uuid": "d1ebefbc-a6c6-4f53-89e3-a2c78e65a789", "value": "T18CA4AE48ABB74EBAD4DB08354C19F7BB52395C010668CDBBC7E17D27FC281E2243652A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365619, "uuid": "a9587f06-3760-4337-ba13-67ced4e39b6f", "value": "c686ef6e31f22e554b1efe3f5f570e92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365619, "uuid": "f47ad647-61fe-4bb5-b364-179445f6158a", "value": "6144:5ZCcjpKa/2eP515c0vAOB53OqXB6WXrGSzaHCaGSf9vcc7sOYcARWhAR5/RI:5ZCOpl/JNrvDxrGSmzFcc/Yc64Ytm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706365619, "uuid": "c62a2658-5722-442a-9118-2c6b30229353", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706365619, "uuid": "08735731-d8e4-480e-89e4-a1d30209607a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706365619, "uuid": "8787bd9b-bd86-4455-bf8e-0126444b5e33", "value": "SecuriteInfo.com.FileRepMalware.15233.23244", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a0b37a-bce2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1706339049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706339049, "uuid": "bef4e08a-dbe8-4a97-b2d0-27e4aa438e68", "comment": "Malware payload (Vidar)", "value": "57945874573bff6a84d4f8bb94afd0af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706339049, "uuid": "f200d2b5-83fe-473f-99c7-40468106462a", "comment": "Malware payload (Vidar)", "value": "ea221776f53f2c4e9761e92aac53cc4c31f2340346a718d31907932fd684fae1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706339049, "uuid": "70b811d5-965b-48b5-b2b6-59ba1981db3d", "comment": "Malware payload (Vidar)", "value": "e1d69a90da1ac69a909ad40d2c12586d701846c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706339049, "uuid": "03819d83-c510-4d1f-b9e1-0833923055d7", "comment": "Malware payload (Vidar)", "value": "bf66837205981757af70cc9c6f18cbaa368c36df1dd33de8fb21d816f82fd8fd32a126a73bdce23e62bd83ff331bfb51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706339049, "uuid": "a7dc1745-1d76-43ee-9c28-91d8d70db1e4", "value": "T13354AE67F350D162C6A42C3CC45E4B323C69A649A641E20E3E5D71EA2FF0BD392C9D67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706339049, "uuid": "31f60952-4985-4956-bc71-3a54ae86777b", "value": "815a983dc2c1dcfdcf5ea58bd5240e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706339049, "uuid": "d7c375c1-0cd8-4f53-b62d-199c2ff89aec", "value": "3072:it56l5Z+lyy1taJY15sRRuTmsB3DvSiH64UtVAFwMZLE6GwRJ+ewwcLyGz67vu98:iX6lKEJY1emL3+mqtKZI6LRBaJ67lBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706339049, "uuid": "fc50f1d9-5464-4569-b8aa-3d79bbbff4f9", "value": 304281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706339049, "uuid": "497724a7-4e99-496b-a34d-f297221062fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706339049, "uuid": "29c748b9-de8a-45e9-989e-771da19bd902", "value": "57945874573bff6a84d4f8bb94afd0af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ccbf5c-bd0b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706356815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706356815, "uuid": "3f1149a7-91e9-4c26-b7f5-b8d8c6f66c6a", "comment": "Malware payload (njrat)", "value": "c95f727989fffa10d88d55ab77075efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706356815, "uuid": "7d86038f-a22a-4a79-9184-3168626f5205", "comment": "Malware payload (njrat)", "value": "ea8962f13af1485adc1e179cb764320a2896126bdda1b1d7af2ba5318f140a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706356815, "uuid": "c2a7b00e-8782-4420-82de-cb60eadb79b6", "comment": "Malware payload (njrat)", "value": "f5096f73c9e4eff3881a99787ccc80d90a82f961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706356815, "uuid": "ba9dd002-4dc4-4e96-8ad2-709ba40c08fb", "comment": "Malware payload (njrat)", "value": "2c0267652222d9899fca5c1ea38f4cd79e18ad78aae355c1773d7afa0dcc05de0f8f30467a93a741993622166632f227", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706356815, "uuid": "cc89d8fc-8bc8-4583-a671-4f4da9cc60bf", "value": "T12D552340B55DDB22EFE79DB086B2131557D0ECA20352C52A9C92FC6EA45F3C6CB13B4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706356815, "uuid": "3943f1dc-e476-48e7-a4f6-e3131c47901d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706356815, "uuid": "1f533d63-43d7-485f-ad2e-6c7aa14a3cc4", "value": "24576:z21r5Y3sQdzQ1pqiKSm50p51uNv1r5Y3sQdzQ1pqiKSm50p51uNUhYO84xtyWx:crScQdEu70irScQdEu70jhYOJxtyWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706356815, "uuid": "8837c8a1-275d-4b55-8979-1e7ba59e8667", "value": 1349120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706356815, "uuid": "4108b8e0-b8bc-4f91-86b0-172d3c5136b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706356815, "uuid": "dfeea236-9f21-41f0-83c6-f993071b28c6", "value": "c95f727989fffa10d88d55ab77075efb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6782b5e8-bcbb-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706322357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322357, "uuid": "69e60be0-b5fb-4e94-9a76-59ec28dc196a", "comment": "Malware payload", "value": "933b5d538f5bd0ef91a24ccbb8447e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322357, "uuid": "c6f3a8a8-e5b5-48f4-b2c1-05d968201018", "comment": "Malware payload", "value": "eb189dc9c5eebd7dfa2bd6d734a2df4ef6a0a6baa13c0b1b0cd7e88a646d0be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322357, "uuid": "20fc4acf-c6b2-4eb2-ae70-f587c4cf657c", "comment": "Malware payload", "value": "92bc5bc11eb5f4143900c648240efbb02acf1d6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706322357, "uuid": "d5e87c1c-1637-40b2-979c-5022a6760ca7", "comment": "Malware payload", "value": "f64300de86e55eb8f44de7a1b6c6412ad6033bc40b3070449058e6634e7cbd661f8cb2c6be4478792d32bba96ec5b7ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322357, "uuid": "89e3600f-57bf-4ccf-b653-2b6796f04c43", "value": "T1D4839E0776E054B6D0944BF08C18D258D677BF343E3960AF36A66A1E2DA97830F0CB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322357, "uuid": "34d59cca-1e96-4b47-a7b2-ca09f03c39b8", "value": "4253b95b56bb106a42e003aea00a8c3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322357, "uuid": "74200cdb-2aeb-437f-a459-52c772f2779c", "value": "1536:3dJkC2gcA3aFBYjBPZS40aNEiIImbDPgwxOt:3dJkPeKFOZS+Sxblxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706322357, "uuid": "0f0db470-08e1-4061-90c4-8e3c8c676093", "value": 88088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706322357, "uuid": "d8668dd7-0627-4405-8795-ee1790593e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706322357, "uuid": "fa58776d-48eb-44e0-af8c-74ea2819e6f9", "value": "SecuriteInfo.com.TScope.Trojan.Delf.15729.11571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99bf91b-bd29-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1706369713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369713, "uuid": "e5561aa5-0f65-41c2-80f6-02f985d6c327", "comment": "Malware payload (njrat)", "value": "ecb25b8adf7f999fba6245d362153fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369713, "uuid": "900ed6f5-210b-47e4-ba3c-a76262831a7a", "comment": "Malware payload (njrat)", "value": "ebe160919d1646d96694de6a38b7ac570f1827dedb163174bee9253a7475dd54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369713, "uuid": "230e52bb-3228-4c53-9489-afe4f67668f3", "comment": "Malware payload (njrat)", "value": "b406b28ea8c548d9456704075f0eca1cae069d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706369713, "uuid": "8d3cb49a-d8f8-49c4-a80d-9f666292c47b", "comment": "Malware payload (njrat)", "value": "a61fd199a6b40d04f6762d5444b43a18ec356f425a7808f4644e29b7138c60794a1c01f9f64b186c682c1dea80f800bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369713, "uuid": "7286d531-fc3a-4fe3-82b9-f07bf9cd9585", "value": "T1CB3533DF1B034E0EE64D2BBB6294521006F52DFFB25D1372602B7EF1165FEA85990B21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369713, "uuid": "75cc2c83-8b8e-457a-af0d-bb0feeb969d6", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369713, "uuid": "99644f14-4a35-4af1-8a1a-ad6d8b0a4f7b", "value": "24576:ytJvXP4qv3tj+kZKwkffUrUDzV+8a2sXICfxsBqieGD5B4S:ytlgqd3K9ZfV+AsYCfxfof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706369713, "uuid": "591a907b-426c-4e97-a023-d3270a7c3229", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706369713, "uuid": "fc90a79f-3af5-4cd9-a318-7e2308aa87ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706369713, "uuid": "713c738b-62d6-43a5-bf15-39c734733ea2", "value": "ECB25B8ADF7F999FBA6245D362153FDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "120c335a-bcee-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706344118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344118, "uuid": "5f56d818-09f6-40b9-a2e0-5b2a491ef728", "comment": "Malware payload", "value": "c4b40d484e2a48266a08f873e267ca7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344118, "uuid": "2af36e50-a019-4fce-b1a4-42ae6a2767d3", "comment": "Malware payload", "value": "ee0e869cfd8051a211a805baffc80ad6e060d2ec32f7b1b150947a5269f222e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344118, "uuid": "f1b5e212-a254-496e-8c81-71cd288f1f91", "comment": "Malware payload", "value": "3eeb74c2ab3ea475da49b58f4ff27e74e78e7faa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706344118, "uuid": "3623d1f4-554b-4772-8f5f-709b33f2b472", "comment": "Malware payload", "value": "b8819c69fea9bcef4b27d14d4299808c6e8e4f7274bcb085d87a50066f02152732227dcf009dc4bfa0195c2b4714c4d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344118, "uuid": "389f4955-73fe-49eb-bc7b-1ab5583ce3c0", "value": "T13D6633F30E179A33EA20853473C7ADC89B9A21055ADF8E71EB1DE6C325BF3525852136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344118, "uuid": "1379de52-98da-4aa2-8138-cdc246dc17a5", "value": "2727f0d94e0c2b34be08cf90725d9024", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344118, "uuid": "8a0d70f1-f992-4c94-9148-63efa701d07b", "value": "196608:aiptpvrQaQ/XCFZs9Mfz/OJCD9U6N0XkUL:1p7QB/8Znz/fDjNMkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706344118, "uuid": "ca8df7bf-3788-4e23-9acb-4b5b0d4d60d8", "value": 6925824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706344118, "uuid": "3285fbc7-5bf4-44f7-8dee-b2ccff662d29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706344118, "uuid": "f2b764c1-463e-4cab-a558-faa63e385441", "value": "SecuriteInfo.com.BackDoor.Rootkit.15.8978.8492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33331734-bd6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706397861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397861, "uuid": "652062ca-e5c1-40d8-b944-64478424e5a3", "comment": "Malware payload", "value": "bf6eed6cdc17a0130189a33a55ef5209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397861, "uuid": "096459a6-2ccc-483d-b1c9-6e05972f9720", "comment": "Malware payload", "value": "ef2734657b11113a433abb7ebac962e2bf6bf685f05c5f672997f01875430168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397861, "uuid": "b0768aa6-4a02-4f7a-9e47-25075452f7f1", "comment": "Malware payload", "value": "e337f5a0931f69c464f162385f1330b4d27b372f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397861, "uuid": "95b12f46-f87f-44d0-8950-82cf7c225621", "comment": "Malware payload", "value": "d17ae9b45111e80d187e7e1ffe371896769ed4209545e99cb73427eb95c8851515e3cbde8a06f0d7d2119aaabbb81454", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397861, "uuid": "be9a6915-ae36-44b4-8936-2d07fc5dd405", "value": "T119166C02F6408039FAD201FAC3B64978EE789F141389A1D383D5B8F96B765D2783675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397861, "uuid": "2892e6a6-a864-48a2-bfc6-b2c4ecd4c769", "value": "b0e06ecdf8487b878b515f6169fa199b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397861, "uuid": "4a70ee5d-6fa4-4935-84f2-49cb5db2846e", "value": "98304:QOlxyx1rYP44YaQqtGeIEAGoZXvFYfyCu:QOS7dqtGeIhGQXNYfRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706397861, "uuid": "bd40c935-a54f-4103-9c08-1ecd8460a416", "value": 4032264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706397861, "uuid": "1f7f2edc-cb05-42d1-8954-5061701dac5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397861, "uuid": "97a70a51-57ee-4445-b8cb-3d15c84b8dee", "value": "SecuriteInfo.com.Adware.Relevant.202.2265.2455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c450ea3-bd11-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706359275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359275, "uuid": "5662b5ee-d689-452b-8d37-c27b5fc90044", "comment": "Malware payload", "value": "8d7167b663a07bdb1a05a47289712ecd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359275, "uuid": "6ba7dc04-d05f-4082-8e23-a61a048a5003", "comment": "Malware payload", "value": "f3ed72f4d4bd6a15e39b80e78ccc098cd17deac213ab77f7a92dbf3b9e15c652", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359275, "uuid": "f7934a66-4da4-4813-af60-16163fe7ee76", "comment": "Malware payload", "value": "b0f857cbdd33560ae446a942257b34885f735677", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706359275, "uuid": "344634e1-9642-4c36-af73-3375e3d4492c", "comment": "Malware payload", "value": "2177c51164a5ed7555b479c01c8fc87c863d6e7fe77f4f2c2791b0b1bbad4a7c4a5b29b3a74db715f8f0e51b558804cc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359275, "uuid": "d20fa6c8-bed0-409f-a3c3-6dcbb157b5c6", "value": "T152F433DA1FA116DAEBB52620C4C5F592337EA6DFC0F60251F98044AE9E33718CD99E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359275, "uuid": "6f184b18-2fcc-4c4e-b583-57fa090e5416", "value": "12288:Ek/J0cXhCcQvhTJXSSKBjiYyS/Ifu/jDesd95gbvBkagOKjHeVCXt4e++7qZ:X7LQZTR9KMBS/cKesWvBkaxVLe+G8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706359275, "uuid": "ce6f01ff-738a-45a0-9a41-f71c4df1f35a", "value": 749469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706359275, "uuid": "d478d0ef-fd79-41d3-aac3-fba4f5101ba9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706359275, "uuid": "0f7f374c-609f-4cf1-9edb-1a1847468ec1", "value": "IMG 01262024 746726472.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d272b5-bd4b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706384314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706384314, "uuid": "0f89cb87-5d9c-47b6-8e4c-c35817e690e2", "comment": "Malware payload", "value": "866915387fd9d409cf87bec28fe1ce71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706384314, "uuid": "1a75bc67-7782-420b-afdc-1cab02afb960", "comment": "Malware payload", "value": "f51e69edf64319087e514f4ac61005149f5dd84134a1cd7988ea65b399b37b2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706384314, "uuid": "72a1d504-a011-42b7-a002-3c3c28acb7ac", "comment": "Malware payload", "value": "030118d2802f0d29c63c3dd7db773a981ef27918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706384314, "uuid": "aae7475c-c3bf-4239-8b93-a950e93e2ad8", "comment": "Malware payload", "value": "6741d6e449431f40e9292f3429524272120ba67c4fb3fc891dd932306a4e347bf202e594eb95930f40b7e1a2101e620e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706384314, "uuid": "4df3519c-e039-46b7-aa1d-e93780812586", "value": "T12FB63340A3500CF6FAF6D03A8551C967E276F6210350D5AB2774B22A2FAB3478F3D75A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706384314, "uuid": "56f7f2c7-a191-4b93-a929-223e6fe77aec", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706384314, "uuid": "b703b7f0-f9a2-4d1b-bd4a-df7a780d10d2", "value": "196608:UyEEkGEYn61W903eV4QR7MToEuGxgh858F0ibfU36e7mgABjbk91tllW:iEkGVnwW+eGQR7MTozGxu8C0ibfY6e5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706384314, "uuid": "04d7df04-9c90-4a45-8352-69606c496305", "value": 10682908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706384314, "uuid": "9474c9f8-f0a9-4afe-ad93-57bcebc8a4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706384314, "uuid": "a5249711-0e86-4a88-a070-73bbcfbef700", "value": "SecuriteInfo.com.Python.Agent-SP.30073.13717", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f7a72e-bce0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1706338219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338219, "uuid": "46d6a876-efe2-4002-94be-ddd77a3c56f6", "comment": "Malware payload (Gafgyt)", "value": "6c1d972e892b3266fbf4d4f67242838e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338219, "uuid": "73e5c59b-a13d-4032-9677-c5f52b9a94fc", "comment": "Malware payload (Gafgyt)", "value": "f7bc18070f39ede182ffa7da42e6871c21b4a2e3c836811fc1544048d6134eee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338219, "uuid": "27f6643d-6429-4d64-90b3-d4e90a28fb78", "comment": "Malware payload (Gafgyt)", "value": "ee5156caca579dc3cb1ea711e0eed3c801e1b590", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706338219, "uuid": "4e3e5e60-ea2d-4275-bedf-b4b9b2de665c", "comment": "Malware payload (Gafgyt)", "value": "84a021300e7acb4a8655ef38165a1c6fb4e7f1dd8ace4a80dca157403935045683c23030fba81691b17463a35de9e806", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338219, "uuid": "6d345dbe-453d-4a43-a041-4677c253c77e", "value": "T106A31A01F9418727C2D32BBAE78F479D3B365AA457D733016A357EB42BC27892E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338219, "uuid": "a9f05c07-bf8a-41a4-9d39-1c0f10dc74de", "value": "1536:LeCc11gPMnIDlU7y8RWR617DM0+OHWvA+Py3XuWZnkU8mChrQAhPW9OXFLQ:mgplU4oMDA+PqZkU8mChrQAhPiOXFLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706338219, "uuid": "9e793f97-8f5a-411e-ba95-c45d54d4522c", "value": 101355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706338219, "uuid": "d6b31e91-a6d0-4efa-be29-4dcc77866b48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706338219, "uuid": "4ba33ac2-963a-4061-b17c-396fac328bf8", "value": "6c1d972e892b3266fbf4d4f67242838e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb42bea6-bd16-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706361609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361609, "uuid": "fd6875ff-a82f-419a-bc61-0c6298f30c96", "comment": "Malware payload", "value": "2d7050d3e043e3f5208611221f560e5e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361609, "uuid": "e6f178c9-355d-4a74-9597-090ab8780788", "comment": "Malware payload", "value": "f9076e826448f4cf5ac036d2dd34daaf187847a61a64418192036e59faebae4f", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361609, "uuid": "aabe4aa6-de73-4ce0-a74a-0b33324e227b", "comment": "Malware payload", "value": "b915e64d24245385a4f3ef4cbb92c39168ecaa1b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706361609, "uuid": "e3398b96-049e-4fef-a0fd-a219ec6c1d7c", "comment": "Malware payload", "value": "576f9283d4567c1a17f13489e1b55971fd4fa7e4dd9db2e53d8c5bbc65db33fc77abfd222a632ba656e29b0f7b0c5024", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361609, "uuid": "dc018624-1d51-41a0-90c9-2b6a37340203", "value": "T1F8B4228070DBD92BD08770704DD5C1DB1A86BC11AB9AFDAB7078BB6E087EB50C473966", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361609, "uuid": "a48a227a-8f65-48d5-b9d5-44c2bfc54370", "value": "12288:gSNCBC6uEkeQpozwjTqCfgcpCWaqziKJrQCXzFl8c5X:Cw6saWWCfgICWawiKJrQSZlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706361609, "uuid": "d1584626-5fbd-48f2-884c-0dd7cfc4d8e0", "value": 509440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706361609, "uuid": "88317ea9-ed96-47fb-827f-9557c0295da9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706361609, "uuid": "3828fe95-6d89-4bde-9842-edd9d53187af", "value": "PO 240.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2749d056-bccc-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1706329551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329551, "uuid": "1803a77b-cc99-4123-adba-750878a602b9", "comment": "Malware payload", "value": "83ef95311d217e5156a2ac79ebfb9e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329551, "uuid": "de1e63e3-5bd4-4d79-bf8f-ce310c9b54b0", "comment": "Malware payload", "value": "f9ba39cc36ba8dd4cfb3f461e834660d55f12f76c8696dd04244db1e9db87051", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329551, "uuid": "5a182a35-a80b-4e83-9a00-00504ac89421", "comment": "Malware payload", "value": "6e33e3ac6a1d1f0949b1426275b76e7dfe21db72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706329551, "uuid": "96a416ed-0159-49d0-bb69-ebf49ca4fcb3", "comment": "Malware payload", "value": "859c964b0002a33bcceded70b24445e7f53306c60265113a890cf2e8b260f2c398d66a5a31e845a731953fe42ec88368", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329551, "uuid": "04a619a1-541d-4388-855f-ccfcdce28532", "value": "T1C4C523027AC184F1C4772D336938AF11B5797C311F699ADBA3E46A8DDE221C0CB36766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329551, "uuid": "07682c42-c5a9-4d79-b45f-9cd240fbf6b7", "value": "0ae9e38912ff6bd742a1b9e5c003576a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329551, "uuid": "5e8fcce3-9272-48ae-acf7-0361400b20e5", "value": "49152:qILEUZJ9W8furgfV3IbrrTbx8HvfGwlEPNIuPK2nVgTJpltBLr:qWW8fuUd3IbZ8HvOwCO2nVgTJplfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706329551, "uuid": "461d18ab-7c8a-43b3-87be-24f93eb98973", "value": 2651536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706329551, "uuid": "5ceffe3f-1226-43cf-bc62-b33aabe014cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706329551, "uuid": "c640d8a5-10c8-48c9-b00a-7f58d4099bcb", "value": "SecuriteInfo.com.Trojan.MulDrop24.57126.22451.19833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bf82dc-bd6b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1706397964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397964, "uuid": "7c8d09f0-6dc8-4521-910c-7a57a0972c3b", "comment": "Malware payload (RiseProStealer)", "value": "5dddd440665580cdf78e0a2f87e1a7df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397964, "uuid": "75bed3f4-dd45-4aa6-a6a2-2a5739db1612", "comment": "Malware payload (RiseProStealer)", "value": "fea21c72ee724e5bbfc7578f1165be0262f9f4be470d72e48461195a947911f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397964, "uuid": "ac04060c-c4be-4cd0-9e36-e4e656e45e84", "comment": "Malware payload (RiseProStealer)", "value": "a2d0311e30eee578684d717104e87ff0ab9f3ebf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1706397964, "uuid": "13042f5e-d3fe-4dcd-a9ea-d4b9429cf993", "comment": "Malware payload (RiseProStealer)", "value": "7ade3d9fb6b2c96cce69a963b587b66e9909510f00056b975dd8135773f925c6b88176115da553cbf12be7b6a8823659", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397964, "uuid": "3effb55a-5e8f-424a-abaa-439540c70490", "value": "T1FB4523A80F5BA364E135F2B4244455EC49343EEC4D01DB1B598F89CB58983DFBB2DA8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397964, "uuid": "555bfb10-526c-4413-afb3-74668a71f869", "value": "5ab723dc8d5af21b79dc301ed6a56a64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397964, "uuid": "b5df8496-400e-42c4-8473-835c0307488a", "value": "24576:GzkSrxSJOS5pXhLb8T/xhTCjpzp/wQqsiK3+idmcl7D8ZQ:GzDreFhUthTCjpFlX3ecl7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1706397964, "uuid": "3be57b3b-1cb4-4b13-bfb5-b446cc60acbd", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1706397964, "uuid": "714f07f7-6a29-4e7a-866b-27ebe67fbfb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1706397964, "uuid": "0b5324eb-e186-49ce-80b9-9ba7a1fc80c7", "value": "5dddd440665580cdf78e0a2f87e1a7df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }